CSP: Use CryptoAPI to get the hash (thumbprint) value of the X509 certificate

Please pay attention to the previous series of articles

Decode X509 certificate content using CryptoAPI
Parsing X509 Certificate Primitives using CryptoAPI

Through the previous article, we can use CryptoAPI to decode the X509 certificate file and parse the basic key of the certificate, this time we try to get the hash value of the certificate through CryptoAPI . The hash value of the certificate, also called the fingerprint value, is the property of checking the integrity and correctness of the certificate. If you use a parent certificate to verify the signature of the certificate, the hash value is used.
The certificate hash (thumbprint) values that you see through Windows View certificates are as follows:

With the foundation of the previous series, we assume that the certificate file has been decoded through CryptoAPI and that a X509 certificate context handle has been obtained:

Pccert_contextm_pcertcontext;

Then you can get the hash value of the certificate by using the function CertGetCertificateContextProperty (), which is defined as follows:

BOOL WINAPI certgetcertificatecontextproperty (  pccert_context pcertcontext,  DWORD dwpropid,  void* PvData,  dword* pcbdata);

which

Pcertcontext: A handle to the certificate context.

Dwpropid:hash algorithm ID, commonly used are cert_md5_hash_prop_id and cert_sha1_hash_prop_id, respectively, corresponding to MD5 and SHA1. However, the current standard V3 version of the certificate is the use of the SHA1 algorithm.

PvData: The buffer address that accepts the hash data.

Pcbdata: Starts indicating the buffer length, which indicates the actual data length after the function returns.

Then use this function to obtain the full function of the certificate hash data as follows:

ULONG Ccspcertificate::get_hashvalue (lpbyte lpbthash, ulong *pulhashlen) {ulong ulres = 0; ULONG ulhashalg = 0;if (!m_pcertcontext) {return cert_err_invilidcall;} if (!pulhashlen) {return cert_err_invalidparam;} Get_hashalgid (&ULHASHALG); switch (ULHASHALG) {case Cert_hash_alg_md5:certgetcertificatecontextproperty (m_ Pcertcontext, cert_md5_hash_prop_id, Lpbthash, Pulhashlen); Break;case CERT_HASH_ALG_SHA1: CertGetCertificateContextProperty (M_pcertcontext, cert_sha1_hash_prop_id, Lpbthash, PulHashLen); Break;default: break;} if (*pulhashlen = = 0) {ulres = GetLastError ();} Else{ulres = CERT_ERR_OK;} return ulres;}

Use my Certificate resolution tool to view the hash value of the certificate such as:

(The tool Code project can be downloaded in my download resources, download connection: X509 Certificate resolution tool V1.1)

Copyright NOTICE: This article for Bo Master original article, without Bo Master permission not reproduced.

CSP: Use CryptoAPI to get the hash (thumbprint) value of the X509 certificate