Getting wininet server SSL cert

[Colin]

I'm trying to write a piece of code to validate a Server SSL certificate. I
can open a socket to the SSL site and read the certificate from the Client
SSL Hello packet OK and then validate the cert (using the certificate
verification functions) but this doesn't work if there is a proxy being used
on the machine because the socket connection doesn't go via the proxy.

Rather than add a whole lot of extra code to handle the proxy (and
authentication) I thought I'd use wininet to make the connection
(InternetOpenUrl) and then use the socket from the connection to send the
SSL Hello packet.

First problem was that the socket isn't that easy to get hold of. By using
an async wininet call and catching the INTERNET_STATUS_CONNECTED_TO_SERVER
callback event then using the INTERNET_OPTION_DIAGNOSTIC_SOCKET_INFO option
to InternetQueryOption I can retrieve the socket.

With the socket I then send the SSL hello packet and get back the server SSL
certificate.

The problem is that this seems to only work about 50% of the time. I can
retrieve the socket and write the Client SSL Hello each time but reading the
response often fails.

Question:
- Is this the right way to approach this?
- Should I be able to write and read my own data on the socket? I have found
that only on this event will the remote server respond. (I assume after this
wininet has completed it's own SSL handshake so everything needs to be
encrypted)
- Is there an easier way to get the complete server SSL certificate from
wininet?

There does seem to be a timing related problem because usually if I step
through the process in the debugger it works fine but just letting it run
starts getting read errors.

Thanks for any assistance
Colin

[Stephen Sulzer]

It may not be possible to do what you want with WinInet. WinInet does not
want (or support) the application using the socket directly.

WinInet can provide some information about the server's certificate--see the
INTERNET_CERTIFICATE_INFO structure defined in WinInet.h. However, WinInet
does not provide a way to obtain a CERT_CONTEXT pointer (defined in
wincrypt.h) to the server's certificate.

If you want to use WinInet to get information about the server's
certificate, then send an HTTP request (over SSL) to the server. (A simple
"HEAD" request to the root directory "/" should do.) Then you can obtain an
INTERNET_CERTIFICATE_INFO structure describing the server's certificate by
querying the INTERNET_OPTION_SECURITY_CERTIFCATE_STRUCT option.

If you do need the CERT_CONTEXT pointer, then consider using WinHTTP
instead. WinHTTP provides an option (WINHTTP_OPTION_SERVER_CERT_CONTEXT)
that supplies a CERT_CONTEXT pointer to the server's certificate. But using
WinHTTP still requires that you send an HTTP request to the server.


- Stephen

[Colin]

Thanks Stephen I'll take a look at WinHTTP. It looks a very similar API to
Wininet.

Is it going to be available on all clients? ie Win98, WinNT, Win2000, 2003,
XP?
Does it provide the same proxy authentication mechanisms as Wininet, and
default dialogs?

Much appreciated
Colin

[Stephen Sulzer]

Have a look at the online WinHTTP documentation in MSDN:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/winhttp/http/winhttp_start_page.asp

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/winhttp/http/porting_wininet_applications_to_winhttp.asp?frame=true

WinHTTP ships with Windows 2000 (SP3/SP4), XP (SP1/SP2) and Server 2003. It
never supported Win98/ME clients. There used to be an older version of
WinHTTP for NT, but it is no longer widely available.

WinHTTP does support the same authentication scenarios as WinInet, but it
does not provide any UI dialogs. WinHTTP was designed primarily for
server-based applications and NT services--e.g., ISAPI and ASP components &
applications.

The newsgroup for WinHTTP support is microsoft.public.winhttp.

- Stephen

Post by Colin
Thanks Stephen I'll take a look at WinHTTP. It looks a very similar API to
Wininet.
Is it going to be available on all clients? ie Win98, WinNT, Win2000, 2003,
XP?
Does it provide the same proxy authentication mechanisms as Wininet, and
default dialogs?
Much appreciated
Colin