ドキュメントの署名と証明書を確認する
このトピックでは、XPS ドキュメントの署名を確認する方法と、それらの署名に関連する証明書を確認する方法について説明します。
プログラムで次のコード例を使用する前に、「一般的なデジタル署名プログラミング タスク」の免責事項をお読みください。
次のコード例では、XPS ドキュメント内にあるデジタル署名を確認します。
XPS ドキュメントの署名を確認するには、次の手順に従います:
- 「署名マネージャーの初期化」の説明に従って、ドキュメントを署名マネージャーに読み込みます。
- デジタル署名マネージャーから署名のコレクションを取得します。
- コレクション内の署名の数を取得します。
- コレクション内のシグネチャごとに、次のコード例に示すように Verify メソッドを呼び出します。
HRESULT
VerifyAllDigitalSignaturesAndAuthenticateCertificates(
IXpsSignatureManager *signatureManager
)
{
HRESULT hr = S_OK;
IXpsSignature *signature = NULL;
IXpsSignatureCollection *signaturesInDocument = NULL;
UINT32 numberOfSignaturesInDocument = NULL;
hr = signatureManager->GetSignatures(&signaturesInDocument);
if (SUCCEEDED(hr)) {
hr = signaturesInDocument->GetCount(&numberOfSignaturesInDocument);
}
if (SUCCEEDED(hr)) {
// Check each signature in the XPS document that was opened in
// the signature manager.
for (UINT32 index = 0; index < numberOfSignaturesInDocument; index++)
{
// Get the signature in the current index of the
// IXpsSignatureCollection object
hr = signaturesInDocument->GetAt(index, &signature);
if (SUCCEEDED(hr)) {
PCCERT_CONTEXT signingCertificate = NULL;
XPS_SIGNATURE_STATUS signatureStatus;
signatureStatus = XPS_SIGNATURE_STATUS_BROKEN;
// Verify the signature and authenticate
// its signing certificate
hr = VerifySignatureAndCertificates (
signature,
&signingCertificate,
&signatureStatus);
if (FAILED(hr)) {
// If a FACILITY_SECURITY error code is returned then
// the current certificate was not the
// signing certificate, so continue with
// the enumeration.
if (HRESULT_FACILITY(hr) != FACILITY_SECURITY)
{
// If the error was not a FACILITY_SECURITY error
// then exit and return the error
break; // out of for loop
}
}
// release pointers for next loop
if (NULL != signature) {
signature->Release();
signature = NULL;
}
if (NULL != signingCertificate) {
CertFreeCertificateContext (signingCertificate);
signingCertificate = NULL;
}
}
}
}
if (NULL != signaturesInDocument) signaturesInDocument->Release();
return hr;
}
デジタル署名を確認するには、まず署名証明書によって作成された署名を確認してから、署名証明書を検証します。 次のコード例で使用する検証メソッドは、証明書を一時証明書ストアにキャッシュします。これは、Crypto API 関数をこの例の後半で呼び出すときに使用します。
一時証明書ストアを作成するには、次の手順に従います:
- 署名で使用される証明書を保持する一時証明書ストアを作成します。
- 署名の証明書セットを反復処理し、各証明書を一時証明書ストアに読み込みます。
HRESULT VerifySignatureAndCertificates (
IXpsSignature *signature,
PCCERT_CONTEXT *signingCertificate,
XPS_SIGNATURE_STATUS *signatureStatus
)
{
HRESULT hr = S_OK;
BOOL moreCertificates = FALSE;
IOpcCertificateEnumerator *certificatesInSignature = NULL;
HCERTSTORE signatureCertificateStore = NULL;
// Create a temporary certificate store.
signatureCertificateStore = CertOpenStore(
CERT_STORE_PROV_MEMORY,
X509_ASN_ENCODING,
NULL,
0,
NULL);
// Create a certificate enumerator to store the certificates
// that are associated with the current signature.
hr = signature->GetCertificateEnumerator(&certificatesInSignature);
if (SUCCEEDED(hr))
{
// We need to call the MoveNext method to initialize the enumerator.
hr = certificatesInSignature->MoveNext(&moreCertificates);
}
if (SUCCEEDED(hr))
{
// Iterate through the certificates in the signature,
// and add each one to the temporary certificate store.
// This temporary certificate store simplifies
// authentication of the signing certificate.
while (moreCertificates)
{
PCCERT_CONTEXT certificate = NULL;
hr = certificatesInSignature->GetCurrent(&certificate);
if (SUCCEEDED(hr))
{
// got the next certificate so
// add the current certificate to the temporary certificate store.
if (!CertAddCertificateContextToStore(signatureCertificateStore,
certificate,
CERT_STORE_ADD_REPLACE_EXISTING,
NULL))
{
hr = E_FAIL;
// ERROR: could not add the certificate to the certificate store
break; // out of while loop
}
CertFreeCertificateContext (certificate);
}
else
{
// unable to get the certificate so skip
}
// move to next certificate in set
if (FAILED(hr = certificatesInSignature->MoveNext(&moreCertificates)))
{
// ERROR: could not move to the next certificate in the enumerator
break; // out of while loop
}
// moreCertificates == FALSE when the end of the set has been reached.
}//End while
}
if (NULL != certificatesInSignature) certificatesInSignature->Release();
デジタル署名と、ドキュメントの署名に使用される証明書を確認するには、次の手順を実行します:
- 署名で使用される証明書を反復処理して、署名証明書を見つけます。
- 証明書に対して署名を確認して、証明書をテストします。 署名証明書は、Verify メソッドが XPS_SIGNATURE_STATUS_VALID または XPS_SIGNATURE_STATUS_QUESTIONABLE のXPS_SIGNATURE_STATUS を返し、FACILITY_SECURITY エラーを返さない場合に見つかります。
// Reset the enumerator
hr = signature->GetCertificateEnumerator(&certificatesInSignature);
if (SUCCEEDED (hr))
{
moreCertificates = FALSE;
hr = certificatesInSignature->MoveNext(&moreCertificates);
}
if (SUCCEEDED(hr))
{
// Iterate through the certificates in the signature,
// and call the IXpsSignature.Verify() method
// on each certificate.
// A signature can include an entire certificate chain, and so
// only one of the certificates found in this enumeration
// is the certificate that was used to sign the package.
// The signing certificate is the one to authenticate.
// To find the signing certificate, iterate through
// the certificates in the signature and select the certificate that
// returns an XPS_SIGNATURE_STATUS of XPS_SIGNATURE_STATUS_VALID
// or XPS_SIGNATURE_STATUS_QUESTIONABLE and does not return a
// FACILITY_SECURITY error.
XPS_SIGNATURE_STATUS localSignatureStatus;
localSignatureStatus = XPS_SIGNATURE_STATUS_INCOMPLIANT;
do
{
PCCERT_CONTEXT certificate = NULL;
DWORD certificateStatus = NULL;
if (FAILED(hr = certificatesInSignature->GetCurrent(&certificate)))
{
// We will skip corrupted certificates
// free this one and move to the next
CertFreeCertificateContext (certificate);
hr = certificatesInSignature->MoveNext(&moreCertificates);
if (FAILED(hr))
{
// ERROR: could not move to the next
// certificate in the enumerator
break; // out of do loop with failed hr
}
// continue with next loop iteration
continue;
}
// Verify that the signature conforms to the XPS signing policy.
hr = signature->Verify(certificate, &localSignatureStatus);
if (FAILED(hr))
{
// If a FACILITY_SECURITY error code is returned, then the
// current certificate was not the signing certificate,
// so continue to the next certificate.
if (HRESULT_FACILITY(hr) == FACILITY_SECURITY)
{
// free this one and move to the next
CertFreeCertificateContext (certificate);
hr = certificatesInSignature->MoveNext(&moreCertificates);
if (FAILED(hr))
{
// ERROR: could not move to the next certificate
// in the enumerator
break; // out of do loop with failed hr
}
continue;
}
// ERROR: An attempt to verify the signature has failed
break; // out of do loop with failed hr
}
// if verification was successful, localSignatureStatus will
// contain the status of the signature.
//
// do loop continues in next code example
署名証明書が見つかったら、次の手順を実行します:
- 返された署名の状態を保存します。
- 必要に応じてローカルの状態を更新して、後続の証明書テストを実行します:
- 署名の状態が成功した場合は、証明書をテストするために、ローカルの状態を疑問 (questionable) に設定します。
- 署名の状態が非準拠の場合は、ローカルの状態を非準拠 (incompliant) のままにします。
- 署名の状態が壊れているか不完全な場合は、ローカルの状態を破損 (broken) に設定します。
署名の状態が XPS_SIGNATURE_STATUS_INCOMPLIANT の場合は、署名されていない XPS ドキュメントの一部が署名されていたか、署名されているはずの XPS ドキュメントの一部が署名されなかったことを意味します。 Verify からこの署名の状態が返された場合、署名をさらに確認する必要はありません。
// continuing do loop from previous code example
*signingCertificate = certificate;
*signatureStatus = localSignatureStatus;
// note that this test should only downgrade the
// signature status, it should not upgrade it.
switch (localSignatureStatus) {
case XPS_SIGNATURE_STATUS_VALID:
case XPS_SIGNATURE_STATUS_QUESTIONABLE:
// the signature is valid or questionable so
// save the actual status and set the new status
// to questionable so the certificates will be checked.
localSignatureStatus = XPS_SIGNATURE_STATUS_QUESTIONABLE;
break;
case XPS_SIGNATURE_STATUS_INCOMPLIANT:
// the signature is not compliant
break;
case XPS_SIGNATURE_STATUS_INCOMPLETE:
case XPS_SIGNATURE_STATUS_BROKEN:
// The Windows 7 XPS viewer displays incomplete signatures
// and broken signatures as broken.
*signatureStatus = XPS_SIGNATURE_STATUS_BROKEN;
localSignatureStatus = XPS_SIGNATURE_STATUS_BROKEN;
break;
default:
// there should be no other possible status values
break;
}
// do loop continues in next code example
署名の状態が有効か疑わしいか、証明書の信頼を確認するには、次の手順を実行します:
- 証明書の信頼状態を取得します。
- 返された証明書の信頼状態を評価します。
- 結果の状態を返します。
次のコード例では、考えられるすべての証明書信頼状態をテストするわけではありません。 返される状態値の詳細については、CERT_TRUST_STATUS を参照してください。
// continuing do loop from previous code example
//
// at this point, localSignatureStatus should be less than or
// equal to what it was before the test.
// Check the certificate to see if it is valid
if ((localSignatureStatus == XPS_SIGNATURE_STATUS_VALID) ||
(localSignatureStatus == XPS_SIGNATURE_STATUS_QUESTIONABLE))
{
// This call builds the certificate trust chain from the
// supplied certificate. The certificate chain is used to
// authenticate the supplied certificate.
hr = GetCertificateTrustStatus (
*signingCertificate,
&signatureCertificateStore,
&certificateStatus);
if (FAILED(hr))
{
// ERROR: An attempt to authenticate the certificate
// has failed
break; // out of do loop with failed hr
}
// The Crypt API returns a status that can contain more than
// one status value.
// statusFlagMask is set to test all bits except for the
// CERT_TRUST_REVOCATION_STATUS_UNKNOWN
// CERT_TRUST_IS_OFFLINE_REVOCATION
// CERT_TRUST_IS_NOT_TIME_VALID
// values because, for this test, these are not considered
// to be error conditions.
DWORD statusFlagMask = ~(
CERT_TRUST_REVOCATION_STATUS_UNKNOWN |
CERT_TRUST_IS_OFFLINE_REVOCATION |
CERT_TRUST_IS_NOT_TIME_VALID);
if (CERT_TRUST_NO_ERROR == (certificateStatus & statusFlagMask))
{
// If *signatureStatus is already
// XPS_SIGNATURE_STATUS_VALID then there is no need to
// change the status as the certificate status has no
// certificate trust errors.
// If *signatureStatus is already
// XPS_SIGNATURE_STATUS_QUESTIONABLE then we will not
// upgrade the trust status of the signature just
// because there is no trust issue with the certificate.
}
else
{
// If trust errors were detected with the certificate,
// then this XPS signature is given a status of
// XPS_SIGNATURE_STATUS_QUESTIONABLE
*signatureStatus = XPS_SIGNATURE_STATUS_QUESTIONABLE;
}
// Handle additional certificate errors.
// This is not an exhaustive list of possible errors.
if (certificateStatus & CERT_TRUST_IS_NOT_TIME_VALID)
{
// The XPS Viewer considers signatures with
// expired certificates as valid.
}
if (certificateStatus & CERT_TRUST_IS_PARTIAL_CHAIN)
{
// This test ensures that we only degrade the
// trust status and never upgrade it
if (XPS_SIGNATURE_STATUS_VALID == *signatureStatus)
{
*signatureStatus = XPS_SIGNATURE_STATUS_QUESTIONABLE;
}
}
if (certificateStatus & CERT_TRUST_IS_NOT_SIGNATURE_VALID)
{
// This test ensures that we only degrade the
// trust status and never upgrade it
if (XPS_SIGNATURE_STATUS_VALID == *signatureStatus)
{
*signatureStatus = XPS_SIGNATURE_STATUS_QUESTIONABLE;
}
}
if (certificateStatus & CERT_TRUST_IS_SELF_SIGNED)
{
// This test ensures that we only degrade the
// trust status and never upgrade it
if (XPS_SIGNATURE_STATUS_VALID == *signatureStatus)
{
*signatureStatus = XPS_SIGNATURE_STATUS_QUESTIONABLE;
}
}
if (certificateStatus & CERT_TRUST_IS_UNTRUSTED_ROOT)
{
// This test ensures that we only degrade the
// trust status and never upgrade it
if (XPS_SIGNATURE_STATUS_VALID == *signatureStatus)
{
*signatureStatus = XPS_SIGNATURE_STATUS_QUESTIONABLE;
}
}
}//End if
hr = certificatesInSignature->MoveNext(&moreCertificates);
if (FAILED(hr))
{
// ERROR: could not move to the next
// certificate in the enumerator
break; // out of do loop with failed hr
}
} while((*signatureStatus != XPS_SIGNATURE_STATUS_VALID) &&
moreCertificates);
} // end if successful
if (NULL != certificatesInSignature) certificatesInSignature->Release();
return hr;
}
次のコード例では、証明書の信頼状態は、次のコード例に示すメソッドを呼び出すことによって取得されます。
HRESULT GetCertificateTrustStatus(
__in PCCERT_CONTEXT certificate,
__in HCERTSTORE* certificateStore,
__out DWORD* certificateStatus
)
{
HRESULT hr = S_OK;
// The certificate chain that will be created from
// the PCCERT_CONTEXT object passed in.
PCCERT_CHAIN_CONTEXT certificateChain = NULL;
hr = CreateCertificateChain(
certificate,
*certificateStore,
&certificateChain);
if (SUCCEEDED(hr)) {
*certificateStatus =
certificateChain->TrustStatus.dwErrorStatus;
}
return hr;
}
前のコード例で使用した証明書チェーンは、次のコード例に示すメソッドを呼び出すことによって作成されます。
HRESULT
CreateCertificateChain (
__in PCCERT_CONTEXT certificate,
__in HCERTSTORE certificateStore,
__out PCCERT_CHAIN_CONTEXT* certificateChain
)
{
HRESULT hr = S_OK;
CERT_CHAIN_PARA certificateChainParameters = {0};
certificateChainParameters.cbSize = sizeof(CERT_CHAIN_PARA);
certificateChainParameters.RequestedUsage.dwType = USAGE_MATCH_TYPE_AND;
// CertGetCertificateChain builds a certificate chain that starts
// from the PCCERT_CONTEXT structure provided by the caller.
// After the certificate chain has been successfully created,
// then the authenticity of the certificate can be determined
// by examining the errors, if any, that occurred while the chain
// was created.
BOOL successCreatingCertChain = CertGetCertificateChain (
NULL,
certificate,
NULL,
certificateStore,
&certificateChainParameters,
CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT,
NULL,
certificateChain);
if (!successCreatingCertChain)
{
hr = HRESULT_FROM_WIN32(GetLastError());
}
return hr;
}
関連トピック
-
このセクションで使用
-
詳細情報