c++ - 使用 SCH_CRED_FORMAT_CERT_HASH 时，AcquireCredentialsHandle 在内核模式下失败

Question

我调用AcquireCredentialsHandle在内核驱动程序中，传入 SCHANNEL_CRED dwCredFormat 设置为 SCH_CRED_FORMAT_CERT_HASH。它因 SEC_E_NO_CREDENTIALS 而失败。这是我的代码:

BYTE certHashBytes[20] = { 0x6d,0x64,0xed,0x56,0xd2,0x94,0x15,0xf4,0x49,0x08,0xaf,0x18,0xf1,0xca,0xf5,0xa2,0xc8,0x01,0x20,0x96 };
CredHandle credHandle;
RtlZeroMemory(&credHandle, sizeof(CredHandle));

SCHANNEL_CRED schannelCred;
RtlZeroMemory(&schannelCred, sizeof(SCHANNEL_CRED));
schannelCred.dwVersion = 4;
schannelCred.cCreds = 1;
schannelCred.paCred = certHashBytes;
schannelCred.dwCredFormat = 1;

UNICODE_STRING unispName;
RtlUnicodeStringInit(&unispName, L"Microsoft Unified Security Protocol Provider");
TimeStamp ts;

SECURITY_STATUS res = AcquireCredentialsHandle(NULL, &unispName, SECPKG_CRED_INBOUND, NULL, &schannelCred, NULL, NULL, &credHandle, &ts);
DbgPrintEx(DPFLTR_IHVNETWORK_ID, DPFLTR_INFO_LEVEL, "AcquireCredentialsHandle %x\n", res);

对于用户帐户和本地计算机，我的证书哈希绝对正确，并且正确安装在我的商店中。我知道这一点是因为它在用户模式下工作正常，如下所示:

HCERTSTORE certStore = CertOpenSystemStore(NULL, L"MY");
BYTE certHashBytes[20] = { 0x6d,0x64,0xed,0x56,0xd2,0x94,0x15,0xf4,0x49,0x08,0xaf,0x18,0xf1,0xca,0xf5,0xa2,0xc8,0x01,0x20,0x96 };
CERT_NAME_BLOB certHash { 20, certHashBytes };
PCCERT_CONTEXT cert = CertFindCertificateInStore(certStore, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, CERT_FIND_SHA1_HASH, &certHash, NULL);

CredHandle credHandle;
ZeroMemory(&credHandle, sizeof(CredHandle));

SCHANNEL_CRED cred;
ZeroMemory(&cred, sizeof(SCHANNEL_CRED));
cred.dwVersion = SCHANNEL_CRED_VERSION;
cred.cCreds = 1;
cred.paCred = &cert;

SECURITY_STATUS res = AcquireCredentialsHandle(NULL, const_cast<LPWSTR>(UNISP_NAME), SECPKG_CRED_INBOUND, NULL, &cred, NULL, NULL, &credHandle, NULL);

我相信我完全遵循了关于如何使用 SCH_CRED_FORMAT_CERT_HASH 的 MSDN 说明 - 有什么问题吗？

Answer 1

如果不调试就很难确定，但是我看到了一些可能是问题的地方:- 如果无法验证证书链；或者它是自签名的；或者在您的代码执行检查 CRL 时机器无法访问互联网，您的调用将失败。如果是这种情况，请使用 CRYPT_E_NO_REVOCATION_CHECK- 如果您的证书用于向远程服务器证明身份是正确的？

Windows 中最近的一些安全强化措施在证书方面非常挑剔。自签名证书有时比签名证书更容易测试。我已经看到越来越多的应用程序因为没有 100% 证明的证书而停止工作。缺少它，我看不出问题是什么。