0

THTTPRIO component, in HTTPWebNode property, when you click in ClientCertificate, Delphi opens a form to choose the certificate and load it's information in the component's propertys. Is this a windows screen? If it is, how can I use it? Today I'm using SecureBlackBox to load the certificates in a combobox, but I'd like to know if is possible to use this screen. Thanks

Screen to choose certificate

UPDATE

I was able to show the dialog using the ms function CryptUIDlgSelectCertificateFromStore, using JWAPI. Now I'm having problems with the result of the function, the PCCERT_CONTEXT structure.

var
  P: Pointer;
  Context: PCCERT_CONTEXT;
  Issuer: DATA_BLOB;

  function GetDataBlobText(Data: DATA_BLOB): string;
  begin
    SetString(Result, PAnsiChar(Data.pbData), Data.cbData div SizeOf(AnsiChar));
  end;

begin
  P := CertOpenSystemStore(0, 'MY');
  Context := CryptUIDlgSelectCertificateFromStore(P, 0, PChar('test'), nil, CRYPTUI_SELECT_ISSUEDTO_COLUMN, 0, nil);
  if Context <> nil then
  begin
    Issuer := Context.pCertInfo.Issuer;
    ShowMessage((GetDataBlobText(Issuer)));
  end;
end;

The result in ShowMessage is:

UPDATE2

Thanks @RbMm. To get string of ASN encoding fields (Issuer and Subject)

var
  P: Pointer;
  Context: PCCERT_CONTEXT;
  Subject: DATA_BLOB;
  SubjectStr: string;
  size : Cardinal;
begin
  P := CertOpenSystemStore(0, PAnsiChar('MY'));
  Context := CryptUIDlgSelectCertificateFromStore(P, 0, 'test', 'select certificate',
    CRYPTUI_SELECT_ISSUEDTO_COLUMN, 0, nil);
  if Context <> nil then
  begin
    Subject := Context.pCertInfo.Subject;
    size := CertNameToStr(X509_ASN_ENCODING or PKCS_7_ASN_ENCODING, @Subject, CERT_X500_NAME_STR, 0, 0);
    SetString(SubjectStr, PAnsiChar(Subject.pbData), size);
    CertNameToStr(X509_ASN_ENCODING or PKCS_7_ASN_ENCODING, @Subject, CERT_X500_NAME_STR, PAnsiChar(SubjectStr), size);
    Result := SubjectStr;
  end;

To get the string of raw data block (SerialNumber):

var
  SerialNumber: CRYPT_INTEGER_BLOB;
  size : Cardinal;
  s: PWideChar;
  ss: string;
begin
SerialNumber := Context.pCertInfo.SerialNumber;
CryptBinaryToStringW(SerialNumber.pbData, SerialNumber.cbData, CRYPT_STRING_HEX, nil, size);
s := AllocMem(SizeOf(Char) * size);
CryptBinaryToStringW(SerialNumber.pbData, SerialNumber.cbData, CRYPT_STRING_HEX, s, size);
ss := s;
showmessage(ss);
FreeMem(s, SizeOf(Char) * size);
3
  • Use Task Manager to figure out what process is displaying the dialog. Attach to the process using a debugger. Stop the process and look at the stack trace. You should be able to get symbols for all the Microsoft components and from there you should be able to see whether there is an API you can use, or if there isn't. May 17, 2017 at 18:48
  • 3
    this dialog is created by CryptUIDlgSelectCertificateFromStore
    – RbMm
    May 17, 2017 at 19:01
  • Thanks @RbMm, I was able to show the dialog. Now I'm having problems in showing the result of the funcion, the PCCERT_CONTEXT structure. I'll update my question with this. May 18, 2017 at 11:57

1 Answer 1

1

all data blobs in certificate is encoded. so you need decode it. in general by using CryptDecodeObjectEx api. however for Issuer ( i.e. CERT_NAME_BLOB) decode you can use also CertNameToStrW. only after converts an encoded name in a CERT_NAME_BLOB structure to a null-terminated character string you can print it. code example on c/c++:

void PrintIssuer(PCCERT_CONTEXT Context)
{
    CERT_NAME_BLOB Issuer = Context->pCertInfo->Issuer;

    // option #1
    if (ULONG len = CertNameToStrW(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &Issuer, CERT_X500_NAME_STR, 0, 0))
    {
        PWSTR sz = (PWSTR)alloca( len * sizeof(WCHAR));

        if (CertNameToStrW(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &Issuer, CERT_X500_NAME_STR, sz, len))
        {
            DbgPrint("%S\n", sz);
        }
    }

    // option #2 
    PCERT_NAME_INFO pcni;
    ULONG size;

    if (CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, X509_NAME, Issuer.pbData, Issuer.cbData,
        CRYPT_DECODE_ALLOC_FLAG, 0, &pcni, &size))
    {
        if (DWORD cRDN = pcni->cRDN)
        {
            PCERT_RDN rgRDN = pcni->rgRDN;
            do 
            {
                if (DWORD cRDNAttr = rgRDN->cRDNAttr)
                {
                    PCERT_RDN_ATTR rgRDNAttr = rgRDN->rgRDNAttr;
                    do 
                    {
                        DbgPrint("ObjId = %s\n", rgRDNAttr->pszObjId);

                        switch (rgRDNAttr->dwValueType)
                        {
                        case CERT_RDN_PRINTABLE_STRING:
                            DbgPrint("Value = %s\n", rgRDNAttr->Value.pbData);
                            break;
                        }

                    } while (rgRDNAttr++, --cRDNAttr);
                }

            } while (rgRDN++, --cRDN);
        }

        LocalFree(pcni);
    }
}

and output

CN=***
ObjId = 2.5.4.3
Value = ***

(the string after CN= and Value = is the same)

you can note that "2.5.4.3" is szOID_COMMON_NAME or "CN". so first api is append CN= before Issuer name. second variant return you name as is and additional ObjId = 2.5.4.3


convert SerialNumber to printable string can next way:

CRYPT_INTEGER_BLOB SerialNumber = Context->pCertInfo->SerialNumber;
DWORD cb = 0;
if (CryptBinaryToStringW(SerialNumber.pbData, SerialNumber.cbData, CRYPT_STRING_HEX, 0, &cb))
{
    PWSTR sz = (PWSTR)alloca( cb * sizeof(WCHAR));
    if (CryptBinaryToStringW(SerialNumber.pbData, SerialNumber.cbData, CRYPT_STRING_HEX, sz, &cb))
    {
        DbgPrint("%S\n", sz);
    }
}
6
  • Thanks @RbMm. I was able to get the fields which is not encoded (Issuer and Subject, or CommonName), but the second optiion, for encoded fields, did not work. I'll update my question with what I did. May 19, 2017 at 11:51
  • @RodrigoCaetano the Issuer is always encoded in asn. CertNameToStrW call CryptDecodeObjectEx internal. this 2 api simply return result in little different form. one prefix the issuer name, another return to you oid string
    – RbMm
    May 19, 2017 at 11:57
  • Got it. But can I get the SerialNumber (i.e.) using the first option? When I use it, it return to me an empty string. What I need is just get an identifier for the certificate, to use in my code. I can get the certificate it self using a Delphi component SecureBlackBox, but I want just to use this dlg to let the user choose one, and then identifier this choosen in the list of certificates returned by the component. May 19, 2017 at 12:07
  • Thanks again men, sorry for the misinformation, but I'm new in the certificate area May 19, 2017 at 12:09
  • @RodrigoCaetano - SerialNumber is not encoded. this is raw bytes data block. for convert it to string use CryptBinaryToStringW with CRYPT_STRING_HEX flag
    – RbMm
    May 19, 2017 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.