0

I'm trying to implement a mechanism that allows me to maintain a list of SSL server certificate public keys that have been verified as trusted during an application run time. For example:

  • Application makes an HTTP request to a server
  • SSL handshake takes place to verify server certificate
  • Server certificate public key is used to encrypt session key

I'm trying to find out if there is a way to access the public key used in the third step while the application is running.

My initial attempt was to use Microsoft Detours to intercept win32 Cyrpt API calls, such as CryptImportKey. However, I can't find any of the hooks that has enough context in it to tell me the public key, and if the public key has been verified as trusted. For example I can intercept CertVerifyCertificateChainPolicy as well, but reading the documentation I can't see how to retrieve the public key.

Is there any cache store that Windows creates for an application to store trusted public keys?

Essentially what I'm trying to do is find out servers public keys that have been identified as trusted during an application run.

5
  • 2
    "Server certificate public key is used to encrypt session key" - it's not, at least with modern key exchange methods. What you describe is the obsolete RSA key exchange. Still, what you seem to look for is the public key from the certificate in step 2 (not step 3), i.e. server certificate validation. "Is there any cache store that Windows creates for an application to store trusted public keys?" - I don't think so since there is no need for this. But an application should have access to the server certificate used in the current TLS handshake. This is more a programming question though. Jun 23 at 23:42
  • Thanks @SteffenUllrich - You're right, I've worded the question badly (bit of a hard question to word). Are you aware of any programming APIs (e.g., win32 functions) that allow me to retrieve a server certificate used in a TLS handshake?
    – Kakalokia
    Jun 23 at 23:49
  • This is more a programming question, i.e. off-topic here. But usually the SSL library in use supports such things, see for example get ssl certificate in .net. Jun 24 at 0:28
  • Thanks @SteffenUllrich, that points me in the right direction. Happy to move this question to stackoverflow, but not sure how :)
    – Kakalokia
    Jun 24 at 0:31
  • stackoverflow.com/questions/38121372/… appears to do what you want for a 'context' i.e. a connection Jun 24 at 0:38

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.