<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:Arial;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>All,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I am trying to get the tls_schannel.c module to work with a
DeviceScape supplicant build. The network requires a client certificate, which
I have in PFX form. The first thing I noticed about the code is that there
doesn’t seem to be any support for client certificates (I found the
header comment “</span></font><b><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New";font-weight:bold'>TODO: add
support for EAP-TLS (client cert/key conf</span></font></b><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>” as well ! )<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Anyway, I added some code to use PFXImportCertStore to get
the certificate credential handle, but when I try to use the credential with
InitializeSecurityContext, I actually get a ARM processor exception (Misaligned
Datatype). Other CryptoAPI calls I make on this credential handle seem to work
OK.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Now the exception might be a side effect of something else I
am doing wrong, but my real question is, does anybody on here have any
experience with CryptoAPI and using client certificates on WinCE that might be
able to help?<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Here is a code fragment of the steps I am taking (var types
and error handling omitted for clarity):<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> // first open the PFX file<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> hPemFile =
CreateFile(pfxFilename, …);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> pfxBufLength =
GetFileSize(hPemFile,NULL);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> // allocate a buffer to hold the
file content<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> pfxBuf = (unsigned
char*)malloc(pfxBufLength);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> // read the content to the buffer<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> ReadFile(hPemFile, pfxBuf,
pfxBufLength, &bytesRead, NULL);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> // now proceed to import PFX
content<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> certBlob.pbData = pfxBuf;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> certBlob.cbData = pfxBufLength;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> // Create temporary store<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> hCertStore1 =
PFXImportCertStore(&certBlob, passwordW, CRYPT_EXPORTABLE);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> // Get the certificate context<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> pCertContext =
CertEnumCertificatesInStore(hCertStore1, pCertContext);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> // try to use this certificate<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>
memset(&conn->schannel_cred, 0, sizeof(conn->schannel_cred));<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> conn->schannel_cred.dwVersion
= SCHANNEL_CRED_VERSION;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>
conn->schannel_cred.grbitEnabledProtocols = SP_PROT_TLS1;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> algs[0] = CALG_RSA_KEYX;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>
conn->schannel_cred.cSupportedAlgs = 1;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>
conn->schannel_cred.palgSupportedAlgs = algs;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> conn->schannel_cred.dwFlags |=
SCH_CRED_NO_DEFAULT_CREDS;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>
conn->schannel_cred.cCreds = 1;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>
conn->schannel_cred.paCred = &pCertContext;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> status =
global->sspi->AcquireCredentialsHandle(<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>
NULL, UNISP_NAME, SECPKG_CRED_OUTBOUND, NULL,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>
&conn->schannel_cred, NULL, NULL,
&conn->creds, &ts_expiry);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> sspi_flags =
ISC_REQ_REPLAY_DETECT |<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>
ISC_REQ_CONFIDENTIALITY |<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>
ISC_RET_EXTENDED_ERROR |<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>
ISC_REQ_ALLOCATE_MEMORY |<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>
ISC_REQ_MANUAL_CRED_VALIDATION;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> outbufs[0].pvBuffer =
NULL;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> outbufs[0].BufferType
= SECBUFFER_TOKEN;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> outbufs[0].cbBuffer =
0;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> outbuf.cBuffers = 1;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> outbuf.pBuffers =
outbufs;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> outbuf.ulVersion =
SECBUFFER_VERSION;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> //<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> /**** THIS CALL
GOES BOOM **********/<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-indent:.5in'><font size=1 face="Courier New"><span
style='font-size:9.0pt;font-family:"Courier New"'>//<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'> status =
global->sspi->InitializeSecurityContext(<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>
&conn->creds, NULL, NULL,
sspi_flags, 0,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>
SECURITY_NATIVE_DREP, NULL, 0,
&conn->context,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>
&outbuf, &sspi_flags_out,
&ts_expiry);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>Thanks in advance,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'>Rich<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Courier New"><span style='font-size:9.0pt;
font-family:"Courier New"'><o:p> </o:p></span></font></p>
</div>
</body>
</html>