windows-server-2003/ds/security/services/ca/certsrv/crl.cpp

//+-------------------------------------------------------------------------n-
//
// Microsoft Windows
// Copyright (C) Microsoft Corporation, 1996 - 1999
//
// File:        crl.cpp
//
// Contents:    Cert Server CRL processing
//
//---------------------------------------------------------------------------

#include <pch.cpp>

#pragma hdrstop

#include <stdio.h>
#include <esent.h>

#include "cscom.h"
#include "csprop.h"

#include "dbtable.h"
#include "resource.h"

#include "elog.h"
#include "certlog.h"

#include <winldap.h>
#include "csldap.h"
#include "cainfop.h"

#define __dwFILE__	__dwFILE_CERTSRV_CRL_CPP__

HANDLE g_hCRLManualPublishEvent = NULL;

FILETIME g_ftCRLNextPublish;
FILETIME g_ftDeltaCRLNextPublish;

BOOL g_fCRLPublishDisabled = FALSE;	 // manual publishing always allowed
BOOL g_fDeltaCRLPublishDisabled = FALSE; // controls manual publishing, too

DWORD g_dwCRLFlags = CRLF_DELETE_EXPIRED_CRLS;
LDAP *g_pld = NULL;

typedef struct _CSMEMBLOCK
{
    struct _CSMEMBLOCK *pNext;
    BYTE               *pbFree;
    DWORD               cbFree;
} CSMEMBLOCK;

#define CBMEMBLOCK	4096


typedef struct _CSCRLELEMENT
{
    USHORT   usRevocationReason;
    USHORT   uscbSerialNumber;
    BYTE    *pbSerialNumber;
    FILETIME ftRevocationDate;
} CSCRLELEMENT;


// size the structure just under CBMEMBLOCK to keep it from being just over
// a page size.

#define CCRLELEMENT  ((CBMEMBLOCK - 2 * sizeof(DWORD)) / sizeof(CSCRLELEMENT))

typedef struct _CSCRLBLOCK
{
    struct _CSCRLBLOCK *pNext;
    DWORD	        cCRLElement;
    CSCRLELEMENT        aCRLElement[CCRLELEMENT];
} CSCRLBLOCK;


typedef struct _CSCRLREASON
{
    struct _CSCRLREASON *pNext;
    DWORD                RevocationReason;
    CERT_EXTENSION       ExtReason;
} CSCRLREASON;


typedef struct _CSCRLPERIOD
{
    LONG lCRLPeriodCount;
    ENUM_PERIOD enumCRLPeriod;
    DWORD dwCRLOverlapMinutes;
} CSCRLPERIOD;


#ifdef DBG_CERTSRV_DEBUG_PRINT
# define DPT_DATE	1
# define DPT_DELTA	2
# define DPT_DELTASEC	3
# define DPT_DELTAMS	4

# define DBGPRINTTIME(pfDelta, pszName, Type, ft) \
    DbgPrintTime((pfDelta), (pszName), __LINE__, (Type), (ft))

VOID
DbgPrintTime(
    OPTIONAL IN BOOL const *pfDelta,
    IN char const *pszName,
    IN DWORD Line,
    IN DWORD Type,
    IN FILETIME ft)
{
    HRESULT hr;
    WCHAR *pwszTime = NULL;
    WCHAR awc[1];
    LLFILETIME llft;
    
    llft.ft = ft;
    if (Type == DPT_DATE)
    {
	if (0 != llft.ll)
	{
	    hr = myGMTFileTimeToWszLocalTime(&ft, TRUE, &pwszTime);
	    _PrintIfError(hr, "myGMTFileTimeToWszLocalTime");
	}
    }
    else
    {
	if (DPT_DELTAMS == Type)
	{
	    llft.ll /= 1000;		// milliseconds to seconds
	    Type = DPT_DELTASEC;
	}
	if (DPT_DELTASEC == Type)
	{
	    llft.ll *= CVT_BASE;	// seconds to FILETIME period
	}
	llft.ll = -llft.ll;		// FILETIME Period must be negative

	if (0 != llft.ll)
	{
	    hr = myFileTimePeriodToWszTimePeriod(
			    &llft.ft,
			    TRUE,	// fExact
			    &pwszTime);
	    _PrintIfError(hr, "myFileTimePeriodToWszTimePeriod");
	}
    }
    if (NULL == pwszTime)
    {
	awc[0] = L'\0';
	pwszTime = awc;
    }

    DBGPRINT((
	DBG_SS_CERTSRVI,
	"%hs(%d):%hs time(%hs): %lx:%08lx %ws\n",
	"crl.cpp",
	Line,
	NULL == pfDelta? "" : (*pfDelta? " Delta CRL" : " Base CRL"),
	pszName,
	ft.dwHighDateTime,
	ft.dwLowDateTime,
	pwszTime));

//error:
    if (NULL != pwszTime && awc != pwszTime)
    {
	LocalFree(pwszTime);
    }
}


VOID
CertSrvDbgPrintTime(
    IN char const *pszDesc,
    IN FILETIME const *pftGMT)
{
    HRESULT hr;
    WCHAR *pwszTime = NULL;
    WCHAR awc[1];

    hr = myGMTFileTimeToWszLocalTime(pftGMT, TRUE, &pwszTime);
    _PrintIfError(hr, "myGMTFileTimeToWszLocalTime");
    if (S_OK != hr)
    {
	awc[0] = L'\0';
	pwszTime = awc;
    }
    DBGPRINT((DBG_SS_CERTSRV, "%hs: %ws\n", pszDesc, pwszTime));

//error:
    if (NULL != pwszTime && awc != pwszTime)
    {
	LocalFree(pwszTime);
    }
}
#else // DBG_CERTSRV_DEBUG_PRINT
# define DBGPRINTTIME(pfDelta, pszName, Type, ft)
#endif // DBG_CERTSRV_DEBUG_PRINT


HRESULT
crlMemBlockAlloc(
    IN OUT CSMEMBLOCK **ppBlock,
    IN DWORD cb,
    OUT BYTE **ppb)
{
    HRESULT hr;
    CSMEMBLOCK *pBlock = *ppBlock;

    *ppb = NULL;
    cb = POINTERROUND(cb);
    if (NULL == pBlock || cb > pBlock->cbFree)
    {
	pBlock = (CSMEMBLOCK *) LocalAlloc(LMEM_FIXED, CBMEMBLOCK);
        if (NULL == pBlock)
        {
            hr = E_OUTOFMEMORY;
            _JumpError(hr, error, "LocalAlloc");
        }
	pBlock->pNext = *ppBlock;
	pBlock->pbFree = (BYTE *) Add2Ptr(pBlock, sizeof(CSMEMBLOCK));
	pBlock->cbFree = CBMEMBLOCK - sizeof(CSMEMBLOCK);
	*ppBlock = pBlock;
    }
    CSASSERT(cb <= pBlock->cbFree);
    *ppb = pBlock->pbFree;
    pBlock->pbFree += cb;
    pBlock->cbFree -= cb;
    hr = S_OK;

error:
    return(hr);
}


VOID
crlBlockListFree(
    IN OUT CSMEMBLOCK *pBlock)
{
    CSMEMBLOCK *pBlockNext;

    while (NULL != pBlock)
    {
	pBlockNext = pBlock->pNext;
	LocalFree(pBlock);
	pBlock = pBlockNext;
    }
}


HRESULT
crlElementAlloc(
    IN OUT CSCRLBLOCK **ppBlock,
    OUT CSCRLELEMENT **ppCRLElement)
{
    HRESULT hr;
    CSCRLBLOCK *pBlock = *ppBlock;

    *ppCRLElement = NULL;
    if (NULL == pBlock ||
	ARRAYSIZE(pBlock->aCRLElement) <= pBlock->cCRLElement)
    {
	pBlock = (CSCRLBLOCK *) LocalAlloc(LMEM_FIXED, sizeof(*pBlock));
        if (NULL == pBlock)
        {
            hr = E_OUTOFMEMORY;
            _JumpError(hr, error, "LocalAlloc");
        }
	pBlock->pNext = *ppBlock;
	pBlock->cCRLElement = 0;
	*ppBlock = pBlock;
    }
    CSASSERT(ARRAYSIZE(pBlock->aCRLElement) > pBlock->cCRLElement);
    *ppCRLElement = &pBlock->aCRLElement[pBlock->cCRLElement++];
    hr = S_OK;

error:
    return(hr);
}


VOID
crlFreeCRLArray(
    IN OUT VOID *pvBlockSerial,
    IN OUT CRL_ENTRY *paCRL)
{
    crlBlockListFree((CSMEMBLOCK *) pvBlockSerial);
    if (NULL != paCRL)
    {
        LocalFree(paCRL);
    }
}


HRESULT
crlCreateCRLReason(
    IN OUT CSMEMBLOCK **ppBlock,
    IN OUT CSCRLREASON **ppReason,
    IN DWORD RevocationReason,
    OUT DWORD *pcExtension,
    OUT CERT_EXTENSION **ppExtension)
{
    HRESULT hr;
    CSCRLREASON *pReason = *ppReason;
    BYTE *pbEncoded = NULL;
    DWORD cbEncoded;

    for (pReason = *ppReason; NULL != pReason; pReason = pReason->pNext)
    {
	if (RevocationReason == pReason->RevocationReason)
	{
	    break;
	}
    }

    if (NULL == pReason)
    {
	if (!myEncodeObject(
			X509_ASN_ENCODING,
			X509_ENUMERATED,
			(const void *) &RevocationReason,
			0,
			CERTLIB_USE_LOCALALLOC,
			&pbEncoded,
			&cbEncoded))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "myEncodeObject");
	}

	hr = crlMemBlockAlloc(
		    ppBlock,
		    sizeof(CSCRLREASON) + cbEncoded,
		    (BYTE **) &pReason);
	_JumpIfError(hr, error, "crlMemBlockAlloc");

	pReason->pNext = *ppReason;
	pReason->RevocationReason = RevocationReason;
	pReason->ExtReason.pszObjId = szOID_CRL_REASON_CODE;
	pReason->ExtReason.fCritical = FALSE;
	pReason->ExtReason.Value.pbData =
	    (BYTE *) Add2Ptr(pReason, sizeof(*pReason));
	pReason->ExtReason.Value.cbData = cbEncoded;
	CopyMemory(pReason->ExtReason.Value.pbData, pbEncoded, cbEncoded);

	*ppReason = pReason;

	//printf("crlCreateCRLReason: new %x  cb %x\n", RevocationReason, cbEncoded);
    }
    //printf("crlCreateCRLReason: %x\n", RevocationReason);
    CSASSERT(NULL != pReason && RevocationReason == pReason->RevocationReason);

    *pcExtension = 1;
    *ppExtension = &pReason->ExtReason;
    hr = S_OK;

error:
    if (NULL != pbEncoded)
    {
	LocalFree(pbEncoded);
    }
    return(hr);
}


// Convert linked list of CRL blocks to an array.
// If the output array pointer is NULL, just free the list.

HRESULT
ConvertOrFreeCRLList(
    IN OUT CSCRLBLOCK **ppBlockCRL,	// Freed
    IN OUT CSMEMBLOCK **ppBlockReason,	// Used to allocate reason extensions
    IN DWORD cCRL,
    OPTIONAL OUT CRL_ENTRY **paCRL)
{
    HRESULT hr;
    CSCRLREASON *pReasonList = NULL;	// linked list of reason extensions
    CSCRLBLOCK *pBlockCRL = *ppBlockCRL;
    CRL_ENTRY *aCRL = NULL;
    CRL_ENTRY *pCRL;
    DWORD i;

    if (NULL != paCRL)
    {
        aCRL = (CRL_ENTRY *) LocalAlloc(LMEM_FIXED, sizeof(aCRL[0]) * cCRL);
        if (NULL == aCRL)
        {
            hr = E_OUTOFMEMORY;
            _JumpError(hr, error, "LocalAlloc");
        }
    }

    pCRL = aCRL;
    while (NULL != pBlockCRL)
    {
	CSCRLBLOCK *pBlockCRLNext;

	if (NULL != pCRL)
	{
	    for (i = 0; i < pBlockCRL->cCRLElement; i++)
	    {
		CSCRLELEMENT *pCRLElement = &pBlockCRL->aCRLElement[i];

		pCRL->SerialNumber.pbData = pCRLElement->pbSerialNumber;
		pCRL->SerialNumber.cbData = pCRLElement->uscbSerialNumber;
		pCRL->RevocationDate = pCRLElement->ftRevocationDate;
		pCRL->cExtension = 0;
		pCRL->rgExtension = NULL;

		if (CRL_REASON_UNSPECIFIED != pCRLElement->usRevocationReason)
		{
		    hr = crlCreateCRLReason(
				    ppBlockReason,
				    &pReasonList,
				    pCRLElement->usRevocationReason,
				    &pCRL->cExtension,
				    &pCRL->rgExtension);
		    _JumpIfError(hr, error, "crlCreateCRLReason");
		}
		pCRL++;
	    }
	}
	pBlockCRLNext = pBlockCRL->pNext;
	LocalFree(pBlockCRL);
	pBlockCRL = pBlockCRLNext;
    }

    if (NULL != paCRL)
    {
	CSASSERT(pCRL == &aCRL[cCRL]);
        *paCRL = aCRL;
        aCRL = NULL;
    }
    CSASSERT(NULL == pBlockCRL);
    hr = S_OK;

error:
    *ppBlockCRL = pBlockCRL;
    if (NULL != aCRL)
    {
        LocalFree(aCRL);
    }
    return(hr);
}


HRESULT
AddCRLElement(
    IN OUT CSMEMBLOCK **ppBlockSerial,
    IN OUT CSCRLBLOCK **ppBlockCRL,
    IN WCHAR const *pwszSerialNumber,
    IN FILETIME const *pftRevokedEffectiveWhen,
    IN DWORD RevocationReason)
{
    HRESULT hr;
    CSCRLELEMENT *pCRLElement;
    DWORD cbSerial;
    BYTE *pbSerial = NULL;

    hr = crlElementAlloc(ppBlockCRL, &pCRLElement);
    _JumpIfError(hr, error, "crlElementAlloc");

    hr = WszToMultiByteInteger(
			    FALSE,
			    pwszSerialNumber,
			    &cbSerial,
			    &pbSerial);
    _JumpIfError(hr, error, "WszToMultiByteInteger");

    hr = crlMemBlockAlloc(ppBlockSerial, cbSerial, &pCRLElement->pbSerialNumber);
    _JumpIfError(hr, error, "crlMemBlockAlloc");

    CopyMemory(pCRLElement->pbSerialNumber, pbSerial, cbSerial);

    pCRLElement->ftRevocationDate = *pftRevokedEffectiveWhen;
    pCRLElement->usRevocationReason = (USHORT) RevocationReason;
    pCRLElement->uscbSerialNumber = (USHORT) cbSerial;

    CSASSERT(pCRLElement->usRevocationReason == RevocationReason);
    CSASSERT(pCRLElement->uscbSerialNumber == cbSerial);

error:
    if (NULL != pbSerial)
    {
	LocalFree(pbSerial);
    }
    return(hr);
}


DWORD g_aColCRL[] = {

#define ICOL_DISPOSITION	0
    DTI_REQUESTTABLE | DTR_REQUESTDISPOSITION,

#define ICOL_SERIAL		1
    DTI_CERTIFICATETABLE | DTC_CERTIFICATESERIALNUMBER,

#define ICOL_EFFECTIVEWHEN	2
    DTI_REQUESTTABLE | DTR_REQUESTREVOKEDEFFECTIVEWHEN,

#define ICOL_REASON		3
    DTI_REQUESTTABLE | DTR_REQUESTREVOKEDREASON,
};


HRESULT
BuildCRLList(
    IN BOOL fDelta,
    IN DWORD iKey,
    OPTIONAL IN FILETIME const *pftQueryMinimum,
    IN FILETIME const *pftThisPublish,
    IN FILETIME const *pftLastPublishBase,
    IN OUT DWORD *pcCRL,
    IN OUT CSCRLBLOCK **ppBlockCRL,
    IN OUT CSMEMBLOCK **ppBlockSerial)
{
    HRESULT hr;
    CERTVIEWRESTRICTION acvr[5];
    CERTVIEWRESTRICTION *pcvr;
    IEnumCERTDBRESULTROW *pView = NULL;
    DWORD celtFetched;
    DWORD NameIdMin;
    DWORD NameIdMax;
    DWORD i;
    BOOL fEnd;
    CERTDBRESULTROW aResult[10];
    BOOL fResultActive = FALSE;
    DWORD cCRL = *pcCRL;
    CSCRLBLOCK *pBlockCRL = *ppBlockCRL;
    CSMEMBLOCK *pBlockSerial = *ppBlockSerial;

    DBGPRINTTIME(NULL, "*pftThisPublish", DPT_DATE, *pftThisPublish);

    // Set up restrictions as follows:

    pcvr = acvr;

    // Request.RevokedEffectiveWhen <= *pftThisPublish (indexed column)

    pcvr->ColumnIndex = DTI_REQUESTTABLE | DTR_REQUESTREVOKEDEFFECTIVEWHEN;
    pcvr->SeekOperator = CVR_SEEK_LE;
    pcvr->SortOrder = CVR_SORT_DESCEND;
    pcvr->pbValue = (BYTE *) pftThisPublish;
    pcvr->cbValue = sizeof(*pftThisPublish);
    pcvr++;

    // Cert.NotAfter >= *pftLastPublishBase

    if (0 == (CRLF_PUBLISH_EXPIRED_CERT_CRLS & g_dwCRLFlags))
    {
	pcvr->ColumnIndex = DTI_CERTIFICATETABLE | DTC_CERTIFICATENOTAFTERDATE;
	pcvr->SeekOperator = CVR_SEEK_GE;
	pcvr->SortOrder = CVR_SORT_NONE;
	pcvr->pbValue = (BYTE *) pftLastPublishBase;
	pcvr->cbValue = sizeof(*pftLastPublishBase);
	pcvr++;
    }

    // NameId >= MAKECANAMEID(iCert == 0, iKey)

    NameIdMin = MAKECANAMEID(0, iKey);
    pcvr->ColumnIndex = DTI_CERTIFICATETABLE | DTC_CERTIFICATEISSUERNAMEID;
    pcvr->SeekOperator = CVR_SEEK_GE;
    pcvr->SortOrder = CVR_SORT_NONE;
    pcvr->pbValue = (BYTE *) &NameIdMin;
    pcvr->cbValue = sizeof(NameIdMin);
    pcvr++;

    // NameId <= MAKECANAMEID(iCert == _16BITMASK, iKey)

    NameIdMax = MAKECANAMEID(_16BITMASK, iKey);
    pcvr->ColumnIndex = DTI_CERTIFICATETABLE | DTC_CERTIFICATEISSUERNAMEID;
    pcvr->SeekOperator = CVR_SEEK_LE;
    pcvr->SortOrder = CVR_SORT_NONE;
    pcvr->pbValue = (BYTE *) &NameIdMax;
    pcvr->cbValue = sizeof(NameIdMax);
    pcvr++;

    CSASSERT(ARRAYSIZE(acvr) > SAFE_SUBTRACT_POINTERS(pcvr, acvr));

    if (NULL != pftQueryMinimum)
    {
	// Request.RevokedWhen >= *pftQueryMinimum

	pcvr->ColumnIndex = DTI_REQUESTTABLE | DTR_REQUESTREVOKEDWHEN;
	pcvr->SeekOperator = CVR_SEEK_GE;
	pcvr->SortOrder = CVR_SORT_NONE;
	pcvr->pbValue = (BYTE *) pftQueryMinimum;
	pcvr->cbValue = sizeof(*pftQueryMinimum);
	pcvr++;

	CSASSERT(ARRAYSIZE(acvr) >= SAFE_SUBTRACT_POINTERS(pcvr, acvr));
    }

    celtFetched = 0;
    hr = g_pCertDB->OpenView(
			SAFE_SUBTRACT_POINTERS(pcvr, acvr),
			acvr,
			ARRAYSIZE(g_aColCRL),
			g_aColCRL,
			0,		// no worker thread
			&pView);
    _JumpIfError(hr, error, "OpenView");

    fEnd = FALSE;
    while (!fEnd)
    {
	hr = pView->Next(NULL, ARRAYSIZE(aResult), aResult, &celtFetched);
	if (S_FALSE == hr)
	{
	    fEnd = TRUE;
	    if (0 == celtFetched)
	    {
		break;
	    }
	    hr = S_OK;
	}
	_JumpIfError(hr, error, "Next");

	fResultActive = TRUE;

	CSASSERT(ARRAYSIZE(aResult) >= celtFetched);

	for (i = 0; i < celtFetched; i++)
	{
	    DWORD Disposition;
	    DWORD Reason;
	
	    CERTDBRESULTROW *pResult = &aResult[i];

	    CSASSERT(ARRAYSIZE(g_aColCRL) == pResult->ccol);

	    CSASSERT(NULL != pResult->acol[ICOL_DISPOSITION].pbValue);
	    CSASSERT(PROPTYPE_LONG == (PROPTYPE_MASK & pResult->acol[ICOL_DISPOSITION].Type));
	    CSASSERT(sizeof(Disposition) == pResult->acol[ICOL_DISPOSITION].cbValue);
	    Disposition = *(DWORD *) pResult->acol[ICOL_DISPOSITION].pbValue;

	    CSASSERT(NULL != pResult->acol[ICOL_SERIAL].pbValue);
	    CSASSERT(PROPTYPE_STRING == (PROPTYPE_MASK & pResult->acol[ICOL_SERIAL].Type));
	    CSASSERT(0 < pResult->acol[ICOL_SERIAL].cbValue);

	    if (NULL == pResult->acol[ICOL_EFFECTIVEWHEN].pbValue)
	    {
		continue;
	    }
	    CSASSERT(sizeof(FILETIME) == pResult->acol[ICOL_EFFECTIVEWHEN].cbValue);
	    CSASSERT(PROPTYPE_DATE == (PROPTYPE_MASK & pResult->acol[ICOL_EFFECTIVEWHEN].Type));

	    CSASSERT(PROPTYPE_LONG == (PROPTYPE_MASK & pResult->acol[ICOL_REASON].Type));
	    Reason = CRL_REASON_UNSPECIFIED;
	    if (NULL != pResult->acol[ICOL_REASON].pbValue)
	    {
		CSASSERT(sizeof(Reason) == pResult->acol[ICOL_REASON].cbValue);
		Reason = *(DWORD *) pResult->acol[ICOL_REASON].pbValue;
	    }

	    if (NULL == pResult->acol[ICOL_SERIAL].pbValue ||
		CRL_REASON_REMOVE_FROM_CRL == Reason)
	    {
		continue;
	    }

	    // Add to CRL unless it's:
	    //    not a revoked issued cert &&
	    //    not a root CA cert &&
	    //    not an unrevoked issued cert

	    if (DB_DISP_REVOKED != Disposition &&
		!(DB_DISP_CA_CERT == Disposition && IsRootCA(g_CAType)) &&
		!(DB_DISP_ISSUED == Disposition && MAXDWORD == Reason))
	    {
		continue;
	    }
	    if (MAXDWORD == Reason)
	    {
		if (!fDelta)
		{
		    continue;
		}
		Reason = CRL_REASON_REMOVE_FROM_CRL;
	    }
	    hr = AddCRLElement(
		    &pBlockSerial,
		    &pBlockCRL,
		    (WCHAR const *) pResult->acol[ICOL_SERIAL].pbValue,
		    (FILETIME const *) pResult->acol[ICOL_EFFECTIVEWHEN].pbValue,
		    Reason);
	    _JumpIfError(hr, error, "AddCRLElement");

	    CONSOLEPRINT3((
			DBG_SS_CERTSRV,
			"Cert is %ws: %ws: %d\n",
			CRL_REASON_REMOVE_FROM_CRL == Reason?
			    L"UNREVOKED" : L"Revoked",
			pResult->acol[ICOL_SERIAL].pbValue,
			Reason));
	    cCRL++;
	}
	pView->ReleaseResultRow(celtFetched, aResult);
	fResultActive = FALSE;
    }
    *pcCRL = cCRL;
    hr = S_OK;

error:
    *ppBlockSerial = pBlockSerial;
    *ppBlockCRL = pBlockCRL;
    if (NULL != pView)
    {
	if (fResultActive)
	{
	    pView->ReleaseResultRow(celtFetched, aResult);
	}
	pView->Release();
    }
    return(hr);
}
#undef ICOL_DISPOSITION
#undef ICOL_SERIAL
#undef ICOL_EFFECTIVEWHEN
#undef ICOL_REASON


HRESULT
crlBuildCRLArray(
    IN BOOL fDelta,
    OPTIONAL IN FILETIME const *pftQueryMinimum,
    IN FILETIME const *pftThisPublish,
    IN FILETIME const *pftLastPublishBase,
    IN DWORD iKey,
    OUT DWORD *pcCRL,
    OUT CRL_ENTRY **paCRL,
    OUT VOID **ppvBlock)
{
    HRESULT hr;
    BOOL fCoInitialized = FALSE;
    CSCRLBLOCK *pBlockCRL = NULL;
    CSMEMBLOCK *pBlockSerial = NULL;

    *pcCRL = 0;
    *paCRL = NULL;
    *ppvBlock = NULL;

    hr = CoInitializeEx(NULL, GetCertsrvComThreadingModel());
    if (S_OK != hr && S_FALSE != hr)
    {
	_JumpError(hr, error, "CoInitializeEx");
    }
    fCoInitialized = TRUE;

    hr = BuildCRLList(
		fDelta,
		iKey,
		pftQueryMinimum,
		pftThisPublish,
		pftLastPublishBase,
		pcCRL,
		&pBlockCRL,
		&pBlockSerial);
    _JumpIfError(hr, error, "BuildCRLList");

    hr = ConvertOrFreeCRLList(&pBlockCRL, &pBlockSerial, *pcCRL, paCRL);
    _JumpIfError(hr, error, "ConvertOrFreeCRLList");

    *ppvBlock = pBlockSerial;
    pBlockSerial = NULL;

error:
    if (NULL != pBlockCRL)
    {
	ConvertOrFreeCRLList(&pBlockCRL, NULL, 0, NULL);
    }
    if (NULL != pBlockSerial)
    {
	crlBlockListFree(pBlockSerial);
    }
    if (fCoInitialized)
    {
        CoUninitialize();
    }
    return(hr);
}


HRESULT
crlGetRegCRLNextPublish(
    IN BOOL DBGPARMREFERENCED(fDelta),
    IN WCHAR const *pwszSanitizedName,
    IN WCHAR const *pwszRegName,
    OUT FILETIME *pftNextPublish)
{
    HRESULT hr;
    BYTE *pbData = NULL;
    DWORD cbData;
    DWORD dwType;

    hr = myGetCertRegValue(
                        NULL,
			pwszSanitizedName,
			NULL,
			NULL,
			pwszRegName,
			&pbData,		// free using LocalFree
			&cbData,
			&dwType);
    if (HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND) == hr)
    {
        hr = S_OK;
	goto error;
    }
    _JumpIfErrorStr(hr, error, "myGetCertRegValue", pwszRegName);

    if (REG_BINARY != dwType || sizeof(*pftNextPublish) != cbData)
    {
	hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	goto error;
    }
    *pftNextPublish = *(FILETIME *) pbData;
    DBGPRINTTIME(&fDelta, "*pftNextPublish", DPT_DATE, *pftNextPublish);
error:
    if (NULL != pbData)
    {
        LocalFree(pbData);
    }
    return(hr);
}


HRESULT
crlSetRegCRLNextPublish(
    IN BOOL DBGPARMREFERENCED(fDelta),
    IN WCHAR const *pwszSanitizedName,
    IN WCHAR const *pwszRegName,
    IN FILETIME const *pftNextPublish)
{
    HRESULT hr;

    hr = mySetCertRegValue(
                        NULL,
			pwszSanitizedName,
			NULL,
			NULL,
			pwszRegName,
			REG_BINARY,
			(BYTE const *) pftNextPublish,
			sizeof(*pftNextPublish),
			FALSE);
    _JumpIfErrorStr(hr, error, "mySetCertRegValue", pwszRegName);

    DBGPRINTTIME(&fDelta, "*pftNextPublish", DPT_DATE, *pftNextPublish);

error:
    return(hr);
}


// called from CoreInit
// inits process-static data: g_ftCRLNextPublish, etc.

HRESULT
CRLInit(
    IN WCHAR const *pwszSanitizedName)
{
    HRESULT hr;
    DWORD dw;

    ZeroMemory(&g_ftCRLNextPublish, sizeof(g_ftCRLNextPublish));
    ZeroMemory(&g_ftDeltaCRLNextPublish, sizeof(g_ftDeltaCRLNextPublish));

    hr = crlGetRegCRLNextPublish(
		    FALSE,
		    pwszSanitizedName,
		    wszREGCRLNEXTPUBLISH,
		    &g_ftCRLNextPublish);
    _JumpIfError(hr, error, "crlGetRegCRLNextPublish");

    hr = crlGetRegCRLNextPublish(
		    TRUE,
		    pwszSanitizedName,
		    wszREGCRLDELTANEXTPUBLISH,
		    &g_ftDeltaCRLNextPublish);
    _JumpIfError(hr, error, "crlGetRegCRLNextPublish");

    hr = myGetCertRegDWValue(
			pwszSanitizedName,
			NULL,
			NULL,
			wszREGCRLFLAGS,
			(DWORD *) &dw);
    _PrintIfErrorStr(hr, "myGetCertRegDWValue", wszREGCRLFLAGS);
    if (S_OK == hr)
    {
	g_dwCRLFlags = dw;
    }
    hr = S_OK;

error:
    return(hr);
}


VOID
CRLTerminate()
{
    if (NULL != g_pld)
    {
        ldap_unbind(g_pld);
        g_pld = NULL;
    }
}


HRESULT
crlGetRegPublishParams(
    IN BOOL fDelta,
    IN WCHAR const *pwszSanitizedName,
    IN WCHAR const *pwszRegCRLPeriodCount,
    IN WCHAR const *pwszRegCRLPeriodString,
    IN WCHAR const *pwszRegCRLOverlapPeriodCount,
    IN WCHAR const *pwszRegCRLOverlapPeriodString,
    IN LONG lPeriodCountDefault,
    IN WCHAR const *pwszPeriodStringDefault,
    OPTIONAL OUT CSCRLPERIOD *pccp,
    OUT BOOL *pfCRLPublishDisabled)
{
    HRESULT hr;
    WCHAR *pwszCRLPeriodString = NULL;
    WCHAR *pwszCRLOverlapPeriodString = NULL;
    CSCRLPERIOD ccp;

    if (NULL == pccp)
    {
	pccp = &ccp;
    }
    ZeroMemory(pccp, sizeof(*pccp));

    CSASSERT(NULL != pfCRLPublishDisabled);

    // get if need lCRLPeriodCount OR enumCRLPeriod
    // if any of these fail, skip to error handling below

    hr = myGetCertRegDWValue(
			pwszSanitizedName,
			NULL,
			NULL,
			pwszRegCRLPeriodCount,
			(DWORD *) &pccp->lCRLPeriodCount);
    _PrintIfErrorStr(hr, "myGetCertRegDWValue", pwszRegCRLPeriodCount);

    if (hr == S_OK)
    {
        hr = myGetCertRegStrValue(
			pwszSanitizedName,
			NULL,
			NULL,
			pwszRegCRLPeriodString,
			&pwszCRLPeriodString);
	_PrintIfErrorStr(hr, "myGetCertRegDWValue", pwszRegCRLPeriodString);
	if (hr == S_OK)
	{
	    hr = myTranslatePeriodUnits(
			    pwszCRLPeriodString,
			    pccp->lCRLPeriodCount,
			    &pccp->enumCRLPeriod,
			    &pccp->lCRLPeriodCount);
	    _PrintIfError(hr, "myTranslatePeriodUnits");
	}
       
        // don't allow base to be disabled anymore: force defaults to be loaded
        if (!fDelta &&
	    (0 == pccp->lCRLPeriodCount || -1 == pccp->lCRLPeriodCount))
	{
            hr = E_INVALIDARG;
	}
    }

    if (hr != S_OK)
    {
        _PrintError(hr, "Error reading CRLPub params. Overwriting with defaults.");

	if (CERTLOG_WARNING <= g_dwLogLevel)
	{
	    hr = LogEvent(
		    EVENTLOG_WARNING_TYPE,
		    MSG_INVALID_CRL_SETTINGS,
		    0,
		    NULL);
	    _PrintIfError(hr, "LogEvent");
	}

        // slam default publishing to whatever the caller said
	hr = myTranslatePeriodUnits(
			    pwszPeriodStringDefault,
			    lPeriodCountDefault,
			    &pccp->enumCRLPeriod,
			    &pccp->lCRLPeriodCount);
	_JumpIfError(hr, error, "myTranslatePeriodUnits");

        // blindly reset defaults
        mySetCertRegDWValue(
			pwszSanitizedName,
			NULL,
			NULL,
			pwszRegCRLPeriodCount,
			pccp->lCRLPeriodCount);

        mySetCertRegStrValue(
			pwszSanitizedName,
			NULL,
			NULL,
			pwszRegCRLPeriodString,
			pwszPeriodStringDefault);
    }
    *pfCRLPublishDisabled = 0 == pccp->lCRLPeriodCount;

    if (&ccp != pccp)			// If caller wants the data
    {
        BOOL fRegistryOverlap = FALSE;
        DWORD dwCRLOverlapCount;
        ENUM_PERIOD enumCRLOverlap;
        LLFILETIME llftDeltaPeriod;

        // try and gather overlap values from registry - bail on any failure

	enumCRLOverlap = ENUM_PERIOD_YEARS;
        hr = myGetCertRegDWValue(
			pwszSanitizedName,
			NULL,
			NULL,
			pwszRegCRLOverlapPeriodCount,
			&dwCRLOverlapCount);
        if (hr == S_OK && 0 != dwCRLOverlapCount)	// if not disabled
        {
            hr = myGetCertRegStrValue(
			    pwszSanitizedName,
			    NULL,
			    NULL,
			    pwszRegCRLOverlapPeriodString,
			    &pwszCRLOverlapPeriodString);// free w/ LocalFree
            if (hr == S_OK)
            {
                hr = myTranslatePeriodUnits(
				    pwszCRLOverlapPeriodString,
				    dwCRLOverlapCount,
				    &enumCRLOverlap,
				    (LONG *) &dwCRLOverlapCount);

                // we have enough info to override overlap calculation

                if (hr == S_OK)
                {
                    fRegistryOverlap = TRUE;
                    DBGPRINT((
			DBG_SS_CERTSRVI,
                        "Loaded CRL Overlap values. Overriding overlap calculation with specified values.\n"));
                }
            }
        }

        // always possible to revert to calculated value
        if (fRegistryOverlap)
        {
	    LLFILETIME llftOverlap;

            // convert registry-specified CRL overlap to FILETIME

	    llftOverlap.ll = 0;
	    myMakeExprDateTime(
			&llftOverlap.ft,
			dwCRLOverlapCount,
			enumCRLOverlap);
	    DBGPRINTTIME(&fDelta, "ftdelta1", DPT_DELTA, llftOverlap.ft);

	    llftOverlap.ll /= CVT_BASE;  // now in seconds

            // (DELTA sec / 60 secpermin)
            pccp->dwCRLOverlapMinutes = (DWORD) (llftOverlap.ll / CVT_MINUTES);
        }

	// convert CRL period to FILETIME

        llftDeltaPeriod.ll = 0;
	myMakeExprDateTime(
		    &llftDeltaPeriod.ft,
		    pccp->lCRLPeriodCount,
		    pccp->enumCRLPeriod);
	DBGPRINTTIME(&fDelta, "ftdelta2", DPT_DELTA, llftDeltaPeriod.ft);

	llftDeltaPeriod.ll /= CVT_BASE;		// now in seconds
	llftDeltaPeriod.ll /= CVT_MINUTES;	// now in minutes

        if (!fRegistryOverlap)
        {
	    if (fDelta)
	    {
		// default CRLOverlap for delta CRLs: same as period

		pccp->dwCRLOverlapMinutes = llftDeltaPeriod.ft.dwLowDateTime;
	    }
	    else
	    {
		// default CRLOverlap for base CRLs: 10% of period

		pccp->dwCRLOverlapMinutes = (DWORD) (llftDeltaPeriod.ll / 10);
	    }

            // Clamp computed overlap to less than 12 hours

	    if (pccp->dwCRLOverlapMinutes > 12 * 60)
	    {
		pccp->dwCRLOverlapMinutes = 12 * 60;
	    }
        }

        // Always clamp lower bound: (1.5 * skew) < g_dwCRLOverlapMinutes
        // must be at least 1.5x skew

	dwCRLOverlapCount = (3 * g_dwClockSkewMinutes) >> 1;
	if (pccp->dwCRLOverlapMinutes < dwCRLOverlapCount)
	{
	    pccp->dwCRLOverlapMinutes = dwCRLOverlapCount;
	}

        // Always clamp upper bound: must be no more than CRL period

	if (pccp->dwCRLOverlapMinutes > llftDeltaPeriod.ft.dwLowDateTime)
	{
	    pccp->dwCRLOverlapMinutes = llftDeltaPeriod.ft.dwLowDateTime;
	}
    }
    hr = S_OK;

error:
    if (NULL != pwszCRLPeriodString)
    {
        LocalFree(pwszCRLPeriodString);
    }
    if (NULL != pwszCRLOverlapPeriodString)
    {
        LocalFree(pwszCRLOverlapPeriodString);
    }
    return(hr);
}


// Reload publication params during each CRL publication

HRESULT
crlGetRegCRLPublishParams(
    IN WCHAR const *pwszSanitizedName,
    OPTIONAL OUT CSCRLPERIOD *pccpBase,
    OPTIONAL OUT CSCRLPERIOD *pccpDelta)
{
    HRESULT hr;

    hr = crlGetRegPublishParams(
			FALSE,
			pwszSanitizedName,
			wszREGCRLPERIODCOUNT,
			wszREGCRLPERIODSTRING,
			wszREGCRLOVERLAPPERIODCOUNT,
			wszREGCRLOVERLAPPERIODSTRING,
			dwCRLPERIODCOUNTDEFAULT,	// default period
			wszCRLPERIODSTRINGDEFAULT,	// default period
			pccpBase,
			&g_fCRLPublishDisabled);
    _JumpIfError(hr, error, "crlGetRegPublishParams");

    hr = crlGetRegPublishParams(
			TRUE,
			pwszSanitizedName,
			wszREGCRLDELTAPERIODCOUNT,
			wszREGCRLDELTAPERIODSTRING,
			wszREGCRLDELTAOVERLAPPERIODCOUNT,
			wszREGCRLDELTAOVERLAPPERIODSTRING,
			dwCRLDELTAPERIODCOUNTDEFAULT,	// default period
			wszCRLDELTAPERIODSTRINGDEFAULT,	// default period
			pccpDelta,
			&g_fDeltaCRLPublishDisabled);
    _JumpIfError(hr, error, "crlGetRegPublishParams");

error:
    return(hr);
}


#define CERTSRV_CRLPUB_RETRY_COUNT_DEFAULT	10
#define CERTSRV_CRLPUB_RETRY_SECONDS		(10 * CVT_MINUTES)

	    
VOID
crlComputeTimeOutSub(
    OPTIONAL IN BOOL *DBGPARMREFERENCED(pfDelta),
    IN FILETIME const *pftFirst,
    IN FILETIME const *pftLast,
    OUT DWORD *pdwMSTimeOut)
{
    LLFILETIME llft;

    // llft.ll = *pftLast - *pftFirst;

    llft.ll = mySubtractFileTimes(pftLast, pftFirst);
    
    DBGPRINTTIME(pfDelta, "*pftFirst", DPT_DATE, *pftFirst);
    DBGPRINTTIME(pfDelta, "*pftLast", DPT_DATE, *pftLast);

    llft.ll /= (CVT_BASE / 1000);	// convert 100ns to msecs

    DBGPRINTTIME(pfDelta, "llft", DPT_DELTAMS, llft.ft);

    if (0 > llft.ll || MAXLONG < llft.ll)
    {
	// wait as long as we can without going infinite

	llft.ll = MAXLONG;
    }
    *pdwMSTimeOut = llft.ft.dwLowDateTime;
}


VOID
crlComputeTimeOutEx(
    IN BOOL fDelta,
    IN FILETIME const *pftFirst,
    IN FILETIME const *pftLast,
    OUT DWORD *pdwMSTimeOut)
{
    crlComputeTimeOutSub(&fDelta, pftFirst, pftLast, pdwMSTimeOut);
}


VOID
CRLComputeTimeOut(
    IN FILETIME const *pftFirst,
    IN FILETIME const *pftLast,
    OUT DWORD *pdwMSTimeOut)
{
    crlComputeTimeOutSub(NULL, pftFirst, pftLast, pdwMSTimeOut);
}


#ifdef DBG_CERTSRV_DEBUG_PRINT
VOID
DbgPrintRemainTime(
    IN BOOL fDelta,
    IN FILETIME const *pftCurrent,
    IN FILETIME const *pftCRLNextPublish)
{
    HRESULT hr;
    LLFILETIME llftDelta;
    WCHAR *pwszTime = NULL;
    WCHAR awc[1];

    llftDelta.ll = mySubtractFileTimes(pftCRLNextPublish, pftCurrent);

    DBGPRINTTIME(&fDelta, "delta", DPT_DELTA, llftDelta.ft);

    llftDelta.ll = -llftDelta.ll;
    hr = myFileTimePeriodToWszTimePeriod(
			    &llftDelta.ft,
			    TRUE,	// fExact
			    &pwszTime);
    _PrintIfError(hr, "myFileTimePeriodToWszTimePeriod");
    if (S_OK != hr)
    {
	awc[0] = L'\0';
	pwszTime = awc;
    }

    DBGPRINT((
	DBG_SS_CERTSRV,
	"CRLPubWakeupEvent(tid=%d): Next %hs CRL: %ws\n",
	GetCurrentThreadId(),
	fDelta? "Delta" : "Base",
	pwszTime));
    if (NULL != pwszTime && awc != pwszTime)
    {
	LocalFree(pwszTime);
    }
}
#endif // DBG_CERTSRV_DEBUG_PRINT


DWORD g_aColExpiredCRL[] = {

#define ICOLEXP_ROWID		0
    DTI_CRLTABLE | DTL_ROWID,

#define ICOLEXP_MINBASE		1
    DTI_CRLTABLE | DTL_MINBASE,

#define ICOLEXP_CRLNEXTUPDATE	2
    DTI_CRLTABLE | DTL_NEXTUPDATEDATE,
};

HRESULT
crlDeleteExpiredCRLs(
    IN FILETIME const *pftCurrent,
    IN FILETIME const *pftQueryDeltaDelete,
    IN DWORD RowIdBase)
{
    HRESULT hr;
    CERTVIEWRESTRICTION acvr[1];
    CERTVIEWRESTRICTION *pcvr;
    IEnumCERTDBRESULTROW *pView = NULL;
    BOOL fResultActive = FALSE;
    CERTDBRESULTROW aResult[1];
    CERTDBRESULTROW *pResult;
    DWORD celtFetched;

    celtFetched = 0;
    if (CRLF_DELETE_EXPIRED_CRLS & g_dwCRLFlags)
    {
	DBGPRINTTIME(NULL, "DeleteCRL:*pftCurrent", DPT_DATE, *pftCurrent);
	DBGPRINTTIME(NULL, "DeleteCRL:*pftQueryDeltaDelete", DPT_DATE, *pftQueryDeltaDelete);

	// Set up restrictions as follows:

	pcvr = acvr;

	// CRL Expiration < ftCurrent (indexed column)

	pcvr->ColumnIndex = DTI_CRLTABLE | DTL_NEXTPUBLISHDATE;
	pcvr->SeekOperator = CVR_SEEK_LT;
	pcvr->SortOrder = CVR_SORT_ASCEND;	// Oldest propagated CRL first
	pcvr->pbValue = (BYTE *) pftCurrent;
	pcvr->cbValue = sizeof(*pftCurrent);
	pcvr++;

	CSASSERT(ARRAYSIZE(acvr) == SAFE_SUBTRACT_POINTERS(pcvr, acvr));

	hr = g_pCertDB->OpenView(
			    ARRAYSIZE(acvr),
			    acvr,
			    ARRAYSIZE(g_aColExpiredCRL),
			    g_aColExpiredCRL,
			    0,		// no worker thread
			    &pView);
	_JumpIfError(hr, error, "OpenView");

	for (;;)
	{
	    DWORD RowId;
	    DWORD MinBase;
	    FILETIME ftNextUpdate;
	    BOOL fDelete;
	    
	    hr = pView->Next(NULL, ARRAYSIZE(aResult), aResult, &celtFetched);
	    if (S_FALSE == hr)
	    {
		if (0 == celtFetched)
		{
		    break;
		}
	    }
	    _JumpIfError(hr, error, "Next");

	    fResultActive = TRUE;

	    CSASSERT(ARRAYSIZE(aResult) == celtFetched);

	    pResult = &aResult[0];

	    CSASSERT(ARRAYSIZE(g_aColExpiredCRL) == pResult->ccol);
	    CSASSERT(NULL != pResult->acol[ICOLEXP_ROWID].pbValue);
	    CSASSERT(PROPTYPE_LONG == (PROPTYPE_MASK & pResult->acol[ICOLEXP_ROWID].Type));
	    CSASSERT(sizeof(RowId) == pResult->acol[ICOLEXP_ROWID].cbValue);
	    RowId = *(DWORD *) pResult->acol[ICOLEXP_ROWID].pbValue;

	    CSASSERT(NULL != pResult->acol[ICOLEXP_MINBASE].pbValue);
	    CSASSERT(PROPTYPE_LONG == (PROPTYPE_MASK & pResult->acol[ICOLEXP_MINBASE].Type));
	    CSASSERT(sizeof(MinBase) == pResult->acol[ICOLEXP_MINBASE].cbValue);
	    MinBase = *(DWORD *) pResult->acol[ICOLEXP_MINBASE].pbValue;

	    if (NULL != pResult->acol[ICOLEXP_CRLNEXTUPDATE].pbValue)
	    {
		CSASSERT(PROPTYPE_DATE == (PROPTYPE_MASK & pResult->acol[ICOLEXP_CRLNEXTUPDATE].Type));
		CSASSERT(sizeof(FILETIME) == pResult->acol[ICOLEXP_CRLNEXTUPDATE].cbValue);
		ftNextUpdate = *(FILETIME *) pResult->acol[ICOLEXP_CRLNEXTUPDATE].pbValue;
	    }
	    else
	    {
		ftNextUpdate.dwLowDateTime = 0;
		ftNextUpdate.dwHighDateTime = 0;
	    }

	    pView->ReleaseResultRow(celtFetched, aResult);
	    fResultActive = FALSE;

	    CSASSERT(0 != RowId);

	    // Delete the CRL row if it is not the current Base CRL and the
	    // row represents a CRL that expired prior to the current Base CRL.

	    fDelete = FALSE;
	    if (0 != ftNextUpdate.dwLowDateTime ||
		0 != ftNextUpdate.dwHighDateTime)
	    {
		if (RowIdBase != RowId &&
		    0 < CompareFileTime(pftQueryDeltaDelete, &ftNextUpdate))
		{
		    fDelete = TRUE;
		}
	    }
	    DBGPRINTTIME(NULL, "DeleteCRL:ftNextUpdate", DPT_DATE, ftNextUpdate);
	    DBGPRINT((
		DBG_SS_CERTSRVI,
		"crlDeleteExpiredCRLs(RowId=%x) %ws\n",
		RowId,
		fDelete? L"DELETE" : L"SKIP"));

	    if (fDelete)
	    {
		ICertDBRow *prow;

		hr = g_pCertDB->OpenRow(
				    PROPOPEN_DELETE | PROPTABLE_CRL,
				    RowId,
				    NULL,
				    &prow);
		_JumpIfError(hr, error, "OpenRow");

		hr = prow->Delete();
		_PrintIfError(hr, "Delete");

		if (S_OK == hr)
		{
		    hr = prow->CommitTransaction(TRUE);
		    _PrintIfError(hr, "CommitTransaction");
		}
		if (S_OK != hr)
		{
		    HRESULT hr2 = prow->CommitTransaction(FALSE);
		    _PrintIfError(hr2, "CommitTransaction");
		}
		prow->Release();
	    }
	}
    }
    hr = S_OK;

error:
    if (NULL != pView)
    {
	if (fResultActive)
	{
	    pView->ReleaseResultRow(celtFetched, aResult);
	}
	pView->Release();
    }
    return(hr);
}
#undef ICOLEXP_ROWID
#undef ICOLEXP_MINBASE
#undef ICOLEXP_CRLNEXTUPDATE


///////////////////////////////////////////////////
// CRLPubWakeupEvent is the handler for wakeup notifications.
//
// This function is called at miscellaneous times and
// determines whether or not it is time to rebuild the
// CRL to be published.
//
// It then calls CRLPublishCRLs and advises it as to whether to
// rebuild or not.
//
// Its final task is to recalculate the next wakeup time, which
// depends on current time, if the exit module needs to be retried,
// or whether CRL publishing is disabled.

HRESULT
CRLPubWakeupEvent(
    OUT DWORD *pdwMSTimeOut)
{
    HRESULT hr;
    HRESULT hrPublish;
    FILETIME ftZero;
    FILETIME ftCurrent;
    BOOL fBaseTrigger = TRUE;
    BOOL fRebuildCRL = FALSE;
    BOOL fForceRepublish = FALSE;
    BOOL fShadowDelta = FALSE;
    BOOL fSetRetryTimer = FALSE;
    DWORD dwMSTimeOut = CERTSRV_CRLPUB_RETRY_SECONDS * 1000;
    DWORD State = 0;
    static BOOL s_fFirstWakeup = TRUE;

    CSASSERT(NULL != pdwMSTimeOut);

    // if anything goes wrong, call us again after a pause

    hr = CertSrvEnterServer(&State);
    _JumpIfError(hr, error, "CertSrvEnterServer");

    __try
    {
	BOOL fCRLPublishDisabledOld = g_fCRLPublishDisabled;
	BOOL fDeltaCRLPublishDisabledOld = g_fDeltaCRLPublishDisabled;

        // Recalc Timeout
        GetSystemTimeAsFileTime(&ftCurrent);

#ifdef DBG_CERTSRV_DEBUG_PRINT
	{
	    WCHAR *pwszNow = NULL;

	    myGMTFileTimeToWszLocalTime(&ftCurrent, TRUE, &pwszNow);

	    DBGPRINT((DBG_SS_CERTSRV, "CRLPubWakeupEvent(%ws)\n", pwszNow));

	    if (NULL != pwszNow)
	    {
		LocalFree(pwszNow);
	    }
	}
#endif // DBG_CERTSRV_DEBUG_PRINT

	// get current publish params

	hr = crlGetRegCRLPublishParams(g_wszSanitizedName, NULL, NULL);
	_LeaveIfError(hr, "crlGetRegCRLPublishParams");

	if (s_fFirstWakeup)
	{
	    s_fFirstWakeup = FALSE;
	    if (g_fDBRecovered)
	    {
		fForceRepublish = TRUE;
	    }
	}
	else
	{
	    if (!g_fCRLPublishDisabled &&
		(fCRLPublishDisabledOld ||
		 g_fDeltaCRLPublishDisabled != fDeltaCRLPublishDisabledOld))
	    {
		fRebuildCRL = TRUE;	// state change: force new CRLs

		// If delta CRLs were just now disabled, make one attempt to
		// publish shadow deltas; force clients to fetch a new base CRL.

		if (!fDeltaCRLPublishDisabledOld && g_fDeltaCRLPublishDisabled)
		{
		    fShadowDelta = TRUE;	// force shadow delta
		}
	    }
	}

        // if "not yet ready"

	if (0 < CompareFileTime(&g_ftCRLNextPublish, &ftCurrent))
	{
	    fBaseTrigger = FALSE;
#ifdef DBG_CERTSRV_DEBUG_PRINT
	    // give next pub status
	    DbgPrintRemainTime(FALSE, &ftCurrent, &g_ftCRLNextPublish);
#endif // DBG_CERTSRV_DEBUG_PRINT
	}

        // if "not yet ready"

	if (!fBaseTrigger &&
	    (g_fDeltaCRLPublishDisabled ||
	     0 < CompareFileTime(&g_ftDeltaCRLNextPublish, &ftCurrent)))
	{
#ifdef DBG_CERTSRV_DEBUG_PRINT
	    // give next pub status
	    if (!g_fDeltaCRLPublishDisabled)
	    {
		DbgPrintRemainTime(TRUE, &ftCurrent, &g_ftDeltaCRLNextPublish);
	    }
#endif // DBG_CERTSRV_DEBUG_PRINT
	}
	else    // "ready to publish" trigger
	{
            if (!g_fCRLPublishDisabled)		// is publishing enabled?
	    {
                fRebuildCRL = TRUE;		// ENABLED, ready to go!
	    }
	    else
            {
                DBGPRINT((
                    DBG_SS_CERTSRV,
                    "CRLPubWakeupEvent(tid=%d): Publishing disabled\n",
                    GetCurrentThreadId() ));
            }
        }

	ftZero.dwLowDateTime = 0;
	ftZero.dwHighDateTime = 0;

	for (;;)
	{
	    hr = CRLPublishCRLs(
		    fRebuildCRL,
		    fForceRepublish,
		    NULL,				// pwszUserName
		    !fForceRepublish &&			// fDeltaOnly
			!fBaseTrigger &&
			!g_fDeltaCRLPublishDisabled &&
			!fDeltaCRLPublishDisabledOld,
		    fShadowDelta,
		    ftZero,
		    &fSetRetryTimer,
		    &hrPublish);
	    if (S_OK == hr)
	    {
		break;
	    }
	    _PrintError(hr, "CRLPublishCRLs");

	    if (!fForceRepublish || fRebuildCRL)
	    {
		_leave;		// give up
	    }

	    // We failed to republish existing CRLs after a database restore
	    // and recovery; generate new base and delta CRLs and publish them.

	    fRebuildCRL = TRUE;
	}
	_PrintIfError(hrPublish, "CRLPublishCRLs(hrPublish)");

        // if we called CRLPublishCRLs, clear the manual event it'll trigger

        ResetEvent(g_hCRLManualPublishEvent);

        // how many ms until next publish?  set dwMSTimeOut

        if (g_fCRLPublishDisabled)
        {
            // if disabled, don't set timeout
            dwMSTimeOut = INFINITE;
            CONSOLEPRINT1((
			DBG_SS_CERTSRV,
			"CRL Publishing Disabled, TimeOut=INFINITE (%d ms)\n",
			dwMSTimeOut));
        }
        else
        {
            DWORD dwMSTimeOutDelta;
	    WCHAR *pwszCRLType = NULL;

	    crlComputeTimeOutEx(
			FALSE,
			&ftCurrent,
			&g_ftCRLNextPublish,
			&dwMSTimeOut);

	    if (g_fDeltaCRLPublishDisabled)
	    {
		pwszCRLType = L"Base";
	    }
	    else
	    {
		crlComputeTimeOutEx(
			    TRUE,
			    &ftCurrent,
			    &g_ftDeltaCRLNextPublish,
			    &dwMSTimeOutDelta);
		if (dwMSTimeOut > dwMSTimeOutDelta)
		{
		    dwMSTimeOut = dwMSTimeOutDelta;
		}
		pwszCRLType = L"Base + Delta";
	    }
	    if (NULL != pwszCRLType)
	    {
		LONGLONG ll;
		WCHAR *pwszTimePeriod = NULL;
		WCHAR awc[1];

		ll = dwMSTimeOut;
		ll *= CVT_BASE / 1000;	// milliseconds to FILETIME Period
		ll = -ll;		// FILETIME Period must be negative

		hr = myFileTimePeriodToWszTimePeriod(
				    (FILETIME const *) &ll,
				    TRUE,	// fExact
				    &pwszTimePeriod);
		_PrintIfError(hr, "myFileTimePeriodToWszTimePeriod");
		if (S_OK != hr)
		{
		    awc[0] = L'\0';
		    pwszTimePeriod = awc;
		}
		CONSOLEPRINT3((
			DBG_SS_CERTSRV,
			"%ws CRL Publishing Enabled, TimeOut=%ds, %ws\n",
			pwszCRLType,
			dwMSTimeOut/1000,
			pwszTimePeriod));
		if (NULL != pwszTimePeriod && awc != pwszTimePeriod)
		{
		    LocalFree(pwszTimePeriod);
		}
	    }
        }

        // if we need to retry, wait no longer than the retry period

        if (fSetRetryTimer)
        {
            if (dwMSTimeOut > CERTSRV_CRLPUB_RETRY_SECONDS * 1000)
            {
                dwMSTimeOut = CERTSRV_CRLPUB_RETRY_SECONDS * 1000;
                CONSOLEPRINT1((
			DBG_SS_CERTSRV,
			"CRL Publishing periodic retry, TimeOut=%ds\n",
			dwMSTimeOut/1000));
            }
        }
	hr = S_OK;
    }
    __except(hr = myHEXCEPTIONCODE(), EXCEPTION_EXECUTE_HANDLER)
    {
	_PrintError(hr, "Exception");
    }

error:
    *pdwMSTimeOut = dwMSTimeOut;
    CertSrvExitServer(State, hr);
    return(hr);
}


HRESULT
CRLWriteToLockedFile(
    IN BYTE const *pbEncoded,
    IN DWORD cbEncoded,
    IN BOOL fDelete,
    IN WCHAR const *pwszFile)
{
    HRESULT hr;
    WCHAR *pwszDir = NULL;
    WCHAR *pwszT;
    WCHAR wszTmpPrepFile[MAX_PATH];
    WCHAR wszTmpInUseFile[MAX_PATH];
    BYTE *pbData = NULL;
    DWORD cbData;

    // According to JohnL, the best way to do this is to gen a temp
    // file name, rename the existing file to that, then delete it.
    //
    // Logic:
    // create unique preparation filename
    // write new data to prep file
    // create unique destination filename for old file (possibly locked)
    // move old file to destination filename
    // move prep file to (vacated) file name
    // delete old file from destination filename

    if (!fDelete)
    {
	hr = DecodeFileW(pwszFile, &pbData, &cbData, CRYPT_STRING_BINARY);
	if (S_OK == hr &&
	    cbEncoded == cbData &&
	    0 == memcmp(pbData, pbEncoded, cbData))
	{
	    CSASSERT(S_OK == hr);
	    goto error;		// already written, do nothing
	}
    }

    // create a prep file

    hr = myDupString(pwszFile, &pwszDir);
    _JumpIfError(hr, error, "myDupString");

    pwszT = wcsrchr(pwszDir, L'\\');
    if (NULL != pwszT)
    {
	*pwszT = L'\0';	// for dir path, remove "\filename.ext"
    }

    if (!fDelete)
    {
	if (0 == GetTempFileName(pwszDir, L"pre", 0, wszTmpPrepFile))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "GetTempFileName");
	}

	// write file to prep area

	hr = EncodeToFileW(
		    wszTmpPrepFile,
		    pbEncoded,
		    cbEncoded,
		    DECF_FORCEOVERWRITE | CRYPT_STRING_BINARY);
	_JumpIfError(hr, error, "EncodeToFileW");
    }

    if (0 == GetTempFileName(pwszDir, L"crl", 0, wszTmpInUseFile))
    {
        hr = myHLastError();
	_JumpError(hr, error, "GetTempFileName");
    }

    // move old to "in use" file (empty file already exists from
    // GetTempFileName call) may not exist, so don't bother checking status

    MoveFileEx(
	    pwszFile,
	    wszTmpInUseFile,
	    MOVEFILE_WRITE_THROUGH | MOVEFILE_REPLACE_EXISTING);

    // move prepared file to current file

    if (!fDelete)
    {
	if (!MoveFileEx(wszTmpPrepFile, pwszFile, MOVEFILE_WRITE_THROUGH))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "MoveFileEx");
	}
    }

    // The "in use" file may not exist, so don't bother checking status.
    DeleteFile(wszTmpInUseFile);
    hr = S_OK;

error:
    if (NULL != pwszDir)
    {
	LocalFree(pwszDir);
    }
    if (NULL != pbData)
    {
	LocalFree(pbData);
    }
    return(hr);
}


WCHAR const g_wszPropCRLNumber[] = wszPROPCRLNUMBER;
WCHAR const g_wszPropCRLMinBase[] = wszPROPCRLMINBASE;
WCHAR const g_wszPropCRLNameId[] = wszPROPCRLNAMEID;
WCHAR const g_wszPropCRLCount[] = wszPROPCRLCOUNT;
WCHAR const g_wszPropCRLThisUpdateDate[] = wszPROPCRLTHISUPDATE;
WCHAR const g_wszPropCRLNextUpdateDate[] = wszPROPCRLNEXTUPDATE;
WCHAR const g_wszPropCRLThisPublishDate[] = wszPROPCRLTHISPUBLISH;
WCHAR const g_wszPropCRLNextPublishDate[] = wszPROPCRLNEXTPUBLISH;
WCHAR const g_wszPropCRLEffectiveDate[] = wszPROPCRLEFFECTIVE;
WCHAR const g_wszPropCRLPropagationCompleteDate[] = wszPROPCRLPROPAGATIONCOMPLETE;
WCHAR const g_wszPropCRLLastPublished[] = wszPROPCRLLASTPUBLISHED;
WCHAR const g_wszPropCRLPublishAttempts[] = wszPROPCRLPUBLISHATTEMPTS;
WCHAR const g_wszPropCRLPublishFlags[] = wszPROPCRLPUBLISHFLAGS;
WCHAR const g_wszPropCRLPublishStatusCode[] = wszPROPCRLPUBLISHSTATUSCODE;
WCHAR const g_wszPropCRLPublishError[] = wszPROPCRLPUBLISHERROR;
WCHAR const g_wszPropCRLRawCRL[] = wszPROPCRLRAWCRL;

HRESULT
crlWriteCRLToDB(
    IN DWORD CRLNumber,
    IN DWORD CRLMinBase,		// 0 implies base CRL
    OPTIONAL IN WCHAR const *pwszUserName, // else timer thread
    IN BOOL fShadowDelta,		// empty delta CRL with new MinBaseCRL
    IN DWORD CRLNameId,
    IN DWORD CRLCount,
    IN FILETIME const *pftThisUpdate,
    OPTIONAL IN FILETIME const *pftNextUpdate,
    IN FILETIME const *pftThisPublish,
    OPTIONAL IN FILETIME const *pftNextPublish,
    OPTIONAL IN FILETIME const *pftQuery,
    IN FILETIME const *pftPropagationComplete,
    OPTIONAL IN BYTE const *pbCRL,
    IN DWORD cbCRL,
    OUT DWORD *pdwRowId)
{
    HRESULT hr;
    ICertDBRow *prow = NULL;
    DWORD CRLPublishFlags;
    BOOL fCommitted = FALSE;

    *pdwRowId = 0;

    // Create a new CRL table entry

    hr = g_pCertDB->OpenRow(
			PROPTABLE_CRL,
			0,
			NULL,
			&prow);
    _JumpIfError(hr, error, "OpenRow");

    prow->GetRowId(pdwRowId);

    hr = prow->SetProperty(
		    g_wszPropCRLNumber,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_CRL,
		    sizeof(CRLNumber),
		    (BYTE const *) &CRLNumber);
    _JumpIfError(hr, error, "SetProperty");

    hr = prow->SetProperty(
		    g_wszPropCRLMinBase,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_CRL,
		    sizeof(CRLMinBase),
		    (BYTE const *) &CRLMinBase);
    _JumpIfError(hr, error, "SetProperty");

    hr = prow->SetProperty(
		    g_wszPropCRLNameId,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_CRL,
		    sizeof(CRLNameId),
		    (BYTE const *) &CRLNameId);
    _JumpIfError(hr, error, "SetProperty");

    hr = prow->SetProperty(
		    g_wszPropCRLCount,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_CRL,
		    sizeof(CRLCount),
		    (BYTE const *) &CRLCount);
    _JumpIfError(hr, error, "SetProperty");

    hr = prow->SetProperty(
		    g_wszPropCRLThisUpdateDate,
		    PROPTYPE_DATE | PROPCALLER_SERVER | PROPTABLE_CRL,
                    sizeof(*pftThisUpdate),
                    (BYTE const *) pftThisUpdate);
    _JumpIfError(hr, error, "SetProperty");

    if (NULL != pftNextUpdate)
    {
	hr = prow->SetProperty(
			g_wszPropCRLNextUpdateDate,
			PROPTYPE_DATE | PROPCALLER_SERVER | PROPTABLE_CRL,
			sizeof(*pftNextUpdate),
			(BYTE const *) pftNextUpdate);
	_JumpIfError(hr, error, "SetProperty");
    }
    hr = prow->SetProperty(
		    g_wszPropCRLThisPublishDate,
		    PROPTYPE_DATE | PROPCALLER_SERVER | PROPTABLE_CRL,
                    sizeof(*pftThisPublish),
                    (BYTE const *) pftThisPublish);
    _JumpIfError(hr, error, "SetProperty");

    if (NULL != pftNextPublish)
    {
	hr = prow->SetProperty(
			g_wszPropCRLNextPublishDate,
			PROPTYPE_DATE | PROPCALLER_SERVER | PROPTABLE_CRL,
			sizeof(*pftNextPublish),
			(BYTE const *) pftNextPublish);
	_JumpIfError(hr, error, "SetProperty");
    }
    if (NULL != pftQuery)
    {
	hr = prow->SetProperty(
			g_wszPropCRLEffectiveDate,
			PROPTYPE_DATE | PROPCALLER_SERVER | PROPTABLE_CRL,
			sizeof(*pftQuery),
			(BYTE const *) pftQuery);
	_JumpIfError(hr, error, "SetProperty");
    }
    hr = prow->SetProperty(
		    g_wszPropCRLPropagationCompleteDate,
		    PROPTYPE_DATE | PROPCALLER_SERVER | PROPTABLE_CRL,
                    sizeof(*pftPropagationComplete),
                    (BYTE const *) pftPropagationComplete);
    _JumpIfError(hr, error, "SetProperty");

    CRLPublishFlags = 0 == CRLMinBase? CPF_BASE : CPF_DELTA;
    if (fShadowDelta)
    {
	CRLPublishFlags |= CPF_SHADOW;
    }
    if (NULL != pwszUserName)
    {
	CRLPublishFlags |= CPF_MANUAL;
    }
    hr = prow->SetProperty(
		    g_wszPropCRLPublishFlags,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_CRL,
		    sizeof(CRLPublishFlags),
		    (BYTE const *) &CRLPublishFlags);
    _JumpIfError(hr, error, "SetProperty");

    hr = prow->SetProperty(
		    g_wszPropCRLRawCRL,
		    PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_CRL,
		    cbCRL,
		    pbCRL);
    _JumpIfError(hr, error, "SetProperty");

    hr = prow->CommitTransaction(TRUE);
    _JumpIfError(hr, error, "CommitTransaction");

    fCommitted = TRUE;

error:
    if (NULL != prow)
    {
	if (S_OK != hr && !fCommitted)
	{
	    HRESULT hr2 = prow->CommitTransaction(FALSE);
	    _PrintIfError(hr2, "CommitTransaction");
	}
	prow->Release();
    }
    return(hr);
}


// crlSplitStrings -- split newline separated strings into pwszz

HRESULT
crlSplitStrings(
    IN WCHAR const *pwszIn,
    OUT WCHAR **ppwszzOut)
{
    HRESULT hr;
    DWORD cwc;
    WCHAR *pwsz;

    *ppwszzOut = NULL;
    cwc = wcslen(pwszIn) + 1;
    pwsz = (WCHAR *) LocalAlloc(LMEM_FIXED, (cwc + 1) * sizeof(WCHAR));
    if (NULL == pwsz)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }
    *ppwszzOut = pwsz;
    wcscpy(pwsz, pwszIn);
    pwsz[cwc] = L'\0';	// double terminate

    for (;;)
    {
	pwsz = wcschr(pwsz, L'\n');
	if (NULL == pwsz)
	{
	    break;
	}
	*pwsz++ = L'\0';
    }
    hr = S_OK;

error:
    return(hr);
}


// crlUnsplitStrings -- combine pwszz list in-place into newline separated list

VOID
crlUnsplitStrings(
    IN OUT WCHAR *pwszInOut)
{
    WCHAR *pwsz;

    if (NULL != pwszInOut)
    {
	pwsz = pwszInOut;
	while (L'\0' != *pwsz)
	{
	    pwsz += wcslen(pwsz);
	    *pwsz++ = L'\n';
	}
	if (pwsz > pwszInOut && L'\n' == *--pwsz)
	{
	    *pwsz = L'\0';	// no newline terminator!
	}
    }
}


DWORD
CRLIsStringInList(
    IN WCHAR const *pwszSearch,
    OPTIONAL IN WCHAR const *pwszzList)
{
    DWORD iRet = MAXDWORD;

    if (NULL != pwszzList)
    {
	DWORD i = 0;
	WCHAR const *pwsz;

	for (pwsz = pwszzList; L'\0' != *pwsz; pwsz += wcslen(pwsz) + 1)
	{
	    if (0 == mylstrcmpiL(pwsz, pwszSearch))
	    {
		iRet = i;
		break;
	    }
	    i++;
	}
    }
    return(iRet);
}


// crlMergeURLList -- merge two newline separated URL lists into a pwszz list

HRESULT
crlMergeURLList(
    OPTIONAL IN WCHAR const *pwszURLsOld,
    OPTIONAL IN WCHAR const *pwszURLsNew,
    OUT WCHAR **ppwszzURLsMerged)
{
    HRESULT hr;
    WCHAR *pwszzURLsOld = NULL;
    WCHAR *pwszzURLsNew = NULL;
    WCHAR const *pwsz;
    DWORD cwc;
    DWORD cwcT;
    WCHAR *pwszzMerged = NULL;
    WCHAR *pwszNext;

    *ppwszzURLsMerged = NULL;
    cwc = 0;
    if (NULL != pwszURLsOld)
    {
	hr = crlSplitStrings(pwszURLsOld, &pwszzURLsOld);
	_JumpIfError(hr, error, "crlSplitStrings");

	for (pwsz = pwszzURLsOld; L'\0' != *pwsz; pwsz += cwcT)
	{
	    cwcT = wcslen(pwsz) + 1;
	    cwc += cwcT;
	}
    }

    if (NULL != pwszURLsNew)
    {
	hr = crlSplitStrings(pwszURLsNew, &pwszzURLsNew);
	_JumpIfError(hr, error, "crlSplitStrings");

	for (pwsz = pwszzURLsNew; L'\0' != *pwsz; pwsz += cwcT)
	{
	    cwcT = wcslen(pwsz) + 1;
	    if (MAXDWORD == CRLIsStringInList(pwsz, pwszzURLsOld))
	    {
		cwc += cwcT;
	    }
	}
    }
    if (0 == cwc)
    {
	hr = S_OK;
	goto error;
    }

    pwszzMerged = (WCHAR *) LocalAlloc(LMEM_FIXED, (cwc + 1) * sizeof(WCHAR));
    if (NULL == pwszzMerged)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }

    pwszNext = pwszzMerged;
    if (NULL != pwszzURLsOld)
    {
	for (pwsz = pwszzURLsOld; L'\0' != *pwsz; pwsz += cwcT)
	{
	    cwcT = wcslen(pwsz) + 1;
	    wcscpy(pwszNext, pwsz);
	    pwszNext += cwcT;
	}
    }
    if (NULL != pwszzURLsNew)
    {
	for (pwsz = pwszzURLsNew; L'\0' != *pwsz; pwsz += cwcT)
	{
	    cwcT = wcslen(pwsz) + 1;
	    if (MAXDWORD == CRLIsStringInList(pwsz, pwszzURLsOld))
	    {
		wcscpy(pwszNext, pwsz);
		pwszNext += cwcT;
	    }
	}
    }
    *pwszNext = L'\0';
    *ppwszzURLsMerged = pwszzMerged;
    hr = S_OK;

error:
    if (NULL != pwszzURLsOld)
    {
	LocalFree(pwszzURLsOld);
    }
    if (NULL != pwszzURLsNew)
    {
	LocalFree(pwszzURLsNew);
    }
    return(hr);
}


// crlBuildUserURLReferenceList -- construct a new User and URL reference list
//
// "-" means the system published successfully (no failed URLs).
// "Published by User\Domain" means User\Domain published successfully.
// "Published by User\Domain -- 0 3" means User\Domain published CRLs, but
// publishing failed for URLs 0 and 3 in the merged URL list.


HRESULT
crlBuildUserURLReferenceList(
    OPTIONAL IN WCHAR const *pwszUserName,
    OPTIONAL IN WCHAR const *pwszURLsNew,
    OPTIONAL IN WCHAR const *pwszzURLsMerged,
    OUT WCHAR **ppwszUserURLReference)
{
    HRESULT hr;
    DWORD cwc;
    WCHAR *pwszzURLsNew = NULL;
    WCHAR const *pwsz;
    WCHAR *pwszT;
    DWORD cURL;
    WCHAR *pwszUserURLReference;

    *ppwszUserURLReference = NULL;

    cwc = 1;
    if (NULL != pwszUserName)
    {
	cwc = wcslen(g_pwszPublishedBy) + wcslen(pwszUserName);
    }
    cURL = 0;
    if (NULL != pwszURLsNew)
    {
	hr = crlSplitStrings(pwszURLsNew, &pwszzURLsNew);
	_JumpIfError(hr, error, "crlSplitStrings");

	for (pwsz = pwszzURLsNew; L'\0' != *pwsz; pwsz += wcslen(pwsz) + 1)
	{
	    cURL++;
	}
	if (0 != cURL)
	{
	    cwc += 3 + (1 + cwcDWORDSPRINTF) * cURL;
	}
    }

    pwszUserURLReference = (WCHAR *) LocalAlloc(
					    LMEM_FIXED,
					    (cwc + 1) * sizeof(WCHAR));
    if (NULL == pwszUserURLReference)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }

    wcscpy(pwszUserURLReference, L"-");
    if (NULL != pwszUserName)
    {
	swprintf(pwszUserURLReference, g_pwszPublishedBy, pwszUserName);
    }
    if (0 != cURL)
    {
	pwszT = wcschr(pwszUserURLReference, L'\0');
	wcscpy(pwszT, L" --");

	for (pwsz = pwszzURLsNew; L'\0' != *pwsz; pwsz += wcslen(pwsz) + 1)
	{
	    pwszT += wcslen(pwszT);
	    swprintf(pwszT, L" %u", CRLIsStringInList(pwsz, pwszzURLsMerged));
	}
    }
    CSASSERT(wcslen(pwszUserURLReference) <= cwc);
    *ppwszUserURLReference = pwszUserURLReference;
    hr = S_OK;

error:
    if (NULL != pwszzURLsNew)
    {
	LocalFree(pwszzURLsNew);
    }
    return(hr);
}


// crlCombineCRLError -- merge new and existing CRL error strings
//
// pwszCRLError consists of "Url0\nUrl1..."
//
// pwszCRLErrorNew will consist of "User\n\nUrl0\nUrl1..."
// After second and third attempts, pwszCRLErrorNew will consist of
// "User\nUser\n\nUrl0\nUrl1..." and "User\nUser\nUser\n\nUrl0\nUrl1..."
//
// 
// pwszCRLErrorNew will consist of "User -- 0 1 ...\n\nUrl0\nUrl1..."
// After second and third attempts, pwszCRLErrorNew will consist of
// "User -- 0 1 ...\nUser -- 1\n\nUrl0\nUrl1..." and
// "User -- 0 1 ...\nUser -- 1\nUser -- 1\n\nUrl0\nUrl1..."


HRESULT
crlCombineCRLError(
    IN ICertDBRow *prow,
    OPTIONAL IN WCHAR const *pwszUserName,	// else timer thread
    OPTIONAL IN WCHAR const *pwszURLsNew,	// else no errors
    OUT WCHAR **ppwszCRLErrorNew)
{
    HRESULT hr;
    WCHAR *pwszUserListOld = NULL;
    WCHAR *pwszCRLErrorNew = NULL;
    WCHAR *pwszURLsOld;
    WCHAR *pwszzURLsMerged = NULL;
    WCHAR *pwszUserURLReference = NULL;
    DWORD cwc;

    *ppwszCRLErrorNew = NULL;

    hr = PKCSGetProperty(
		    prow,
		    g_wszPropCRLPublishError,
		    PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_CRL,
		    NULL,
		    (BYTE **) &pwszUserListOld);
    _PrintIfError2(hr, "PKCSGetProperty", CERTSRV_E_PROPERTY_EMPTY);

    pwszURLsOld = NULL;
    if (NULL != pwszUserListOld)
    {
	pwszURLsOld = wcsstr(pwszUserListOld, L"\n\n");
	if (NULL != pwszURLsOld)
	{
	    // truncate user list and point to the URL List
	    
	    *pwszURLsOld++ = L'\0';
	    pwszURLsOld++;
	    if (L'\0' == *pwszURLsOld)
	    {
		pwszURLsOld = NULL;
	    }
	}
    }
    hr = crlMergeURLList(pwszURLsOld, pwszURLsNew, &pwszzURLsMerged);
    _JumpIfError(hr, error, "crlMergeURLList");

    hr = crlBuildUserURLReferenceList(
				pwszUserName,
				pwszURLsNew,
				pwszzURLsMerged,
				&pwszUserURLReference);
    _JumpIfError(hr, error, "crlBuildUserURLReferenceList");

    // convert pwszz string list into newline separated strings

    crlUnsplitStrings(pwszzURLsMerged);

    cwc = 0;
    if (NULL != pwszUserListOld)
    {
	cwc += wcslen(pwszUserListOld) + 1;	// newline separator
    }
    cwc += wcslen(pwszUserURLReference);
    if (NULL != pwszzURLsMerged)
    {
	cwc += 2 + wcslen(pwszzURLsMerged); // double newline separator
    }

    pwszCRLErrorNew = (WCHAR *) LocalAlloc(
				    LMEM_FIXED,
				    (cwc + 1) * sizeof(WCHAR));
    if (NULL == pwszCRLErrorNew)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }

    *pwszCRLErrorNew = L'\0';
    if (NULL != pwszUserListOld && L'\0' != *pwszUserListOld)
    {
	wcscat(pwszCRLErrorNew, pwszUserListOld);
	wcscat(pwszCRLErrorNew, L"\n");
    }
    wcscat(pwszCRLErrorNew, pwszUserURLReference);
    if (NULL != pwszzURLsMerged)
    {
	wcscat(pwszCRLErrorNew, L"\n\n");	// double newline separator
	wcscat(pwszCRLErrorNew, pwszzURLsMerged);
    }
    CSASSERT(wcslen(pwszCRLErrorNew) <= cwc);
    *ppwszCRLErrorNew = pwszCRLErrorNew;
    pwszCRLErrorNew = NULL;
    hr = S_OK;

error:
    if (NULL != pwszUserURLReference)
    {
	LocalFree(pwszUserURLReference);
    }
    if (NULL != pwszzURLsMerged)
    {
	LocalFree(pwszzURLsMerged);
    }
    if (NULL != pwszUserListOld)
    {
	LocalFree(pwszUserListOld);
    }
    if (NULL != pwszCRLErrorNew)
    {
	LocalFree(pwszCRLErrorNew);
    }
    return(hr);
}


HRESULT
crlUpdateCRLPublishStateInDB(
    IN DWORD RowId,
    IN FILETIME const *pftCurrent,
    IN HRESULT hrCRLPublish,
    IN DWORD CRLPublishFlags,
    OPTIONAL IN WCHAR const *pwszUserName, // else timer thread
    OPTIONAL IN WCHAR const *pwszCRLError)
{
    HRESULT hr;
    ICertDBRow *prow = NULL;
    WCHAR *pwszCRLErrorNew = NULL;
    DWORD cb;
    DWORD dw;
    BOOL fCommitted = FALSE;

    hr = g_pCertDB->OpenRow(
			PROPTABLE_CRL,
			RowId,
			NULL,
			&prow);
    _JumpIfError(hr, error, "OpenRow");

    hr = prow->SetProperty(
		    g_wszPropCRLLastPublished,
		    PROPTYPE_DATE | PROPCALLER_SERVER | PROPTABLE_CRL,
                    sizeof(*pftCurrent),
                    (BYTE const *) pftCurrent);
    _JumpIfError(hr, error, "SetProperty");

    cb = sizeof(dw);
    hr = prow->GetProperty(
		    g_wszPropCRLPublishAttempts,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_CRL,
		    NULL,
		    &cb,
		    (BYTE *) &dw);
    if (S_OK != hr)
    {
	dw = 0;
    }
    dw++;

    hr = prow->SetProperty(
		    g_wszPropCRLPublishAttempts,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_CRL,
		    sizeof(dw),
		    (BYTE const *) &dw);
    _JumpIfError(hr, error, "SetProperty");

    cb = sizeof(dw);
    hr = prow->GetProperty(
		    g_wszPropCRLPublishFlags,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_CRL,
		    NULL,
		    &cb,
		    (BYTE *) &dw);
    if (S_OK != hr)
    {
	dw = 0;
    }
    CRLPublishFlags |= (CPF_BASE | CPF_DELTA | CPF_SHADOW | CPF_MANUAL) & dw;
    if (S_OK == hrCRLPublish)
    {
	CRLPublishFlags |= CPF_COMPLETE;
    }
    hr = prow->SetProperty(
		    g_wszPropCRLPublishFlags,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_CRL,
		    sizeof(CRLPublishFlags),
		    (BYTE const *) &CRLPublishFlags);
    _JumpIfError(hr, error, "SetProperty");

    // Always set error string property to clear out previous errors.

    hr = prow->SetProperty(
		    g_wszPropCRLPublishStatusCode,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_CRL,
		    sizeof(hrCRLPublish),
		    (BYTE const *) &hrCRLPublish);
    _JumpIfError(hr, error, "SetProperty");

    hr = crlCombineCRLError(prow, pwszUserName, pwszCRLError, &pwszCRLErrorNew);
    _JumpIfError(hr, error, "crlCombineCRLError");

    if (NULL != pwszCRLErrorNew)
    {
	hr = prow->SetProperty(
			g_wszPropCRLPublishError,
			PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_CRL,
			MAXDWORD,
			(BYTE const *) pwszCRLErrorNew);
	_JumpIfError(hr, error, "SetProperty");
    }
    hr = prow->CommitTransaction(TRUE);
    _JumpIfError(hr, error, "CommitTransaction");

    fCommitted = TRUE;

error:
    if (NULL != prow)
    {
	if (S_OK != hr && !fCommitted)
	{
	    HRESULT hr2 = prow->CommitTransaction(FALSE);
	    _PrintIfError(hr2, "CommitTransaction");
	}
	prow->Release();
    }
    if (NULL != pwszCRLErrorNew)
    {
	LocalFree(pwszCRLErrorNew);
    }
    return(hr);
}


HRESULT
WriteCRLToDSAttribute(
    IN WCHAR const *pwszCRLDN,
    IN BOOL fDelta,
    IN BYTE const *pbCRL,
    IN DWORD cbCRL,
    OUT WCHAR **ppwszError)
{
    HRESULT hr;
    DWORD ldaperr;
    BOOL fRebind = FALSE;

    LDAPMod crlmod;
    struct berval crlberval;
    struct berval *crlVals[2];
    LDAPMod *mods[2];

    for (;;)
    {
	if (NULL == g_pld)
	{
	    hr = myRobustLdapBindEx(
			0,			  // dwFlags1
			RLBF_REQUIRE_SECURE_LDAP, // dwFlags2
			LDAP_VERSION2,		  // uVersion
			NULL,			  // pwszDomainName
			&g_pld,
			NULL);			  // ppwszForestDNSName
	    _JumpIfError(hr, error, "myRobustLdapBindEx");
	}

	mods[0] = &crlmod;
	mods[1] = NULL;

	crlmod.mod_op = LDAP_MOD_BVALUES | LDAP_MOD_REPLACE;
	crlmod.mod_type = fDelta? wszDSDELTACRLATTRIBUTE : wszDSBASECRLATTRIBUTE;
	crlmod.mod_bvalues = crlVals;

	crlVals[0] = &crlberval;
	crlVals[1] = NULL;

	crlberval.bv_len = cbCRL;
	crlberval.bv_val = (char *) pbCRL;

	ldaperr = ldap_modify_ext_s(
			    g_pld,
			    const_cast<WCHAR *>(pwszCRLDN),
			    mods,
			    NULL,
			    NULL);
	hr = myHLdapError(g_pld, ldaperr, ppwszError);
	_PrintIfErrorStr(hr, "ldap_modify_ext_s", pwszCRLDN);
	if (fRebind || S_OK == hr)
	{
	    break;
	}
	if (!myLdapRebindRequired(ldaperr, g_pld))
	{
	    _JumpErrorStr(hr, error, "ldap_modify_ext_s", pwszCRLDN);
	}
	fRebind = TRUE;
	if (NULL != g_pld)
	{
	    ldap_unbind(g_pld);
	    g_pld = NULL;
	}
    }

error:
    return(hr);
}


HRESULT
crlParseURLPrefix(
    IN WCHAR const *pwszIn,
    IN DWORD cwcPrefix,
    OUT WCHAR *pwcPrefix,
    OUT WCHAR const **ppwszOut)
{
    HRESULT hr;
    WCHAR const *pwsz;

    CSASSERT(6 <= cwcPrefix);
    wcscpy(pwcPrefix, L"file:");
    *ppwszOut = pwszIn;

    if (L'\\' != pwszIn[0] || L'\\' != pwszIn[1])
    {
	pwsz = wcschr(pwszIn, L':');
	if (NULL != pwsz)
	{
	    DWORD cwc;

	    pwsz++;
	    cwc = SAFE_SUBTRACT_POINTERS(pwsz, pwszIn);
	    if (2 < cwc && cwc < cwcPrefix)
	    {
		CopyMemory(pwcPrefix, pwszIn, cwc * sizeof(WCHAR));
		pwcPrefix[cwc] = L'\0';
		if (0 == LSTRCMPIS(pwcPrefix, L"file:") &&
		    L'/' == pwsz[0] &&
		    L'/' == pwsz[1])
		{
		    pwsz += 2;
		}
		*ppwszOut = pwsz;
	    }
	}
    }
    hr = S_OK;

//error:
    return(hr);
}


VOID
crlLogError(
    IN BOOL fDelta,
    IN BOOL fLdapURL,
    IN DWORD iKey,
    IN WCHAR const *pwszURL,
    IN WCHAR const *pwszError,
    IN HRESULT hrPublish)
{
    HRESULT hr;
    WCHAR const *apwsz[6];
    WORD cpwsz;
    WCHAR wszKey[cwcDWORDSPRINTF];
    WCHAR awchr[cwcHRESULTSTRING];
    WCHAR const *pwszMessageText = NULL;
    WCHAR *pwszHostName = NULL;
    DWORD LogMsg;

    if (fLdapURL && NULL != g_pld)
    {
	myLdapGetDSHostName(g_pld, &pwszHostName);
    }

    wsprintf(wszKey, L"%u", iKey);
    pwszMessageText = myGetErrorMessageText(hrPublish, TRUE);
    if (NULL == pwszMessageText)
    {
	pwszMessageText = myHResultToStringRaw(awchr, hrPublish);
    }
    cpwsz = 0;
    apwsz[cpwsz++] = wszKey;
    apwsz[cpwsz++] = pwszURL;
    apwsz[cpwsz++] = pwszMessageText;

    LogMsg = fDelta?
	MSG_E_DELTA_CRL_PUBLICATION : MSG_E_BASE_CRL_PUBLICATION;
    if (NULL != pwszHostName)
    {
	LogMsg = fDelta?
	    MSG_E_DELTA_CRL_PUBLICATION_HOST_NAME :
	    MSG_E_BASE_CRL_PUBLICATION_HOST_NAME;
    }
    else
    {
	pwszHostName = L"";
    }
    apwsz[cpwsz++] = pwszHostName;
    apwsz[cpwsz++] = NULL != pwszError? L"\n" : L"";
    apwsz[cpwsz++] = NULL != pwszError? pwszError : L"";
    CSASSERT(ARRAYSIZE(apwsz) >= cpwsz);

    if (CERTLOG_ERROR <= g_dwLogLevel)
    {
	hr = LogEvent(EVENTLOG_ERROR_TYPE, LogMsg, cpwsz, apwsz);
	_PrintIfError(hr, "LogEvent");
    }

//error:
    if (NULL != pwszMessageText && awchr != pwszMessageText)
    {
	LocalFree(const_cast<WCHAR *>(pwszMessageText));
    }
}


HRESULT
crlWriteCRLToURL(
    IN BOOL fDelta,
    IN BOOL iKey,
    IN WCHAR const *pwszURL,
    IN BYTE const *pbCRL,
    IN DWORD cbCRL,
    OUT DWORD *pPublishFlags)
{
    HRESULT hr;
    WCHAR const *pwsz2;
    WCHAR *pwszDup = NULL;
    WCHAR *pwszT;
    WCHAR awcPrefix[6];		// file:/ftp:/http:/ldap: and trailing '\0'
    DWORD ErrorFlags;
    WCHAR *pwszError = NULL;

    *pPublishFlags = 0;

    ErrorFlags = CPF_BADURL_ERROR;
    hr = crlParseURLPrefix(
		    pwszURL,
		    ARRAYSIZE(awcPrefix),
		    awcPrefix,
		    &pwsz2);
    _JumpIfError(hr, error, "crlParseURLPrefix");

    DBGPRINT((
	DBG_SS_CERTSRV,
	"crlWriteCRLToURL: \"%ws\" %ws\n",
	awcPrefix,
	pwsz2));
    if (0 == LSTRCMPIS(awcPrefix, L"file:"))
    {
	ErrorFlags = CPF_FILE_ERROR;

	// tricky

	hr = CRLWriteToLockedFile(pbCRL, cbCRL, FALSE, pwsz2);
	_JumpIfError(hr, error, "CRLWriteToLockedFile");
    }
    else if (0 == LSTRCMPIS(awcPrefix, L"ftp:"))
    {
	ErrorFlags = CPF_FTP_ERROR;
	hr = HRESULT_FROM_WIN32(ERROR_BAD_PATHNAME);
	_JumpError(hr, error, "Publish to ftp:");
    }
    else if (0 == LSTRCMPIS(awcPrefix, L"http:"))
    {
	ErrorFlags = CPF_HTTP_ERROR;
	hr = HRESULT_FROM_WIN32(ERROR_BAD_PATHNAME);
	_JumpError(hr, error, "Publish to http:");
    }
    else if (0 == LSTRCMPIS(awcPrefix, L"ldap:"))
    {
	ErrorFlags = CPF_LDAP_ERROR;
	while (L'/' == *pwsz2)
	{
	    pwsz2++;
	}
	hr = myDupString(pwsz2, &pwszDup);
	_JumpIfError(hr, error, "myDupString");

	pwszT = wcschr(pwszDup, L'?');
	if (NULL != pwszT)
	{
	    *pwszT = L'\0';
	}
	hr = WriteCRLToDSAttribute(pwszDup, fDelta, pbCRL, cbCRL, &pwszError);
	_JumpIfError(hr, error, "WriteCRLToDSAttribute");
    }
    else
    {
	ErrorFlags = CPF_BADURL_ERROR;
	hr = HRESULT_FROM_WIN32(ERROR_BAD_PATHNAME);
	_JumpError(hr, error, "Publish to unknown URL type");
    }
    CSASSERT(S_OK == hr);

error:
    if (S_OK != hr)
    {
	*pPublishFlags = ErrorFlags;
	crlLogError(
		fDelta,
		CPF_LDAP_ERROR == ErrorFlags,
		iKey,
		pwszURL,
		pwszError,
		hr);
    }
    if (NULL != pwszError)
    {
	LocalFree(pwszError);
    }
    if (NULL != pwszDup)
    {
	LocalFree(pwszDup);
    }
    return(hr);
}


HRESULT
crlWriteCRLToURLList(
    IN BOOL fDelta,
    IN DWORD iKey,
    IN WCHAR const * const *papwszURLs,
    IN BYTE const *pbCRL,
    IN DWORD cbCRL,
    IN OUT DWORD *pCRLPublishFlags,
    OUT WCHAR **ppwszCRLError)
{
    HRESULT hr = S_OK;
    HRESULT hr2;
    DWORD PublishFlags;

    *ppwszCRLError = NULL;

    // publish this CRL in multiple places

    if (NULL != papwszURLs)
    {
	WCHAR const * const *ppwsz;

	for (ppwsz = papwszURLs; NULL != *ppwsz; ppwsz++)
	{
	    PublishFlags = 0;

	    hr2 = crlWriteCRLToURL(
			    fDelta,
			    iKey,
			    *ppwsz,
			    pbCRL,
			    cbCRL,
			    &PublishFlags);
	    *pCRLPublishFlags |= PublishFlags;
	    if (S_OK != hr2)
	    {
		if (S_OK == hr)
		{
		    hr = hr2;		// Save first error
		}
		_PrintError(hr2, "crlWriteCRLToURL");

		hr2 = myAppendString(*ppwsz, L"\n", ppwszCRLError);
		_PrintIfError(hr2, "myAppendString");
		if (S_OK == hr)
		{
		    hr = hr2;		// Save first error
		}
	    }
	}
    }

//error:
    return(hr);
}


HRESULT
crlWriteCRLToCAStore(
    IN BOOL fDelta,
    IN DWORD iKey,
    IN BYTE const *pbCRL,
    IN DWORD cbCRL,
    IN CERT_CONTEXT const *pccCA)
{
    HRESULT hr;
    HCERTSTORE hStore = NULL;
    CRL_CONTEXT const *pCRLStore = NULL;
    CRL_CONTEXT const *pCRLNew = NULL;
    BOOL fFound = FALSE;

    hStore = CertOpenStore(
                       CERT_STORE_PROV_SYSTEM_REGISTRY_W,
                       X509_ASN_ENCODING,
                       NULL,			// hProv
                       CERT_SYSTEM_STORE_LOCAL_MACHINE,
		       wszCA_CERTSTORE);
    if (NULL == hStore)
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertOpenStore");
    }

    for (;;)
    {
	DWORD dwCryptFlags;
	BOOL fIsDeltaCRL;
	CRL_CONTEXT const *pCRL;

	dwCryptFlags = CERT_STORE_SIGNATURE_FLAG;
	pCRLStore = CertGetCRLFromStore(
				    hStore,
				    pccCA,
				    pCRLStore,
				    &dwCryptFlags);
	if (NULL == pCRLStore)
	{
	    break;
	}

	// delete this CRL from the store ONLY if the CRL signature matches
	// this CA context's public key

	if (0 != dwCryptFlags)
	{
	    continue;		// no match -- skip
	}

	hr = myIsDeltaCRL(pCRLStore, &fIsDeltaCRL);
	_JumpIfError(hr, error, "myIsDeltaCRL");

	if (fIsDeltaCRL)
	{
	    if (!fDelta)
	    {
		continue;	// no match -- skip Delta CRLs
	    }
	}
	else
	{
	    if (fDelta)
	    {
		continue;	// no match -- skip Base CRLs
	    }
	}

	// See if it has already been published

	if (cbCRL == pCRLStore->cbCrlEncoded &&
	    0 == memcmp(pbCRL, pCRLStore->pbCrlEncoded, cbCRL))
	{
	    fFound = TRUE;
	    continue;		// exact match -- already published
	}

	pCRL = CertDuplicateCRLContext(pCRLStore);
	if (!CertDeleteCRLFromStore(pCRL))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "CertDeleteCRLFromStore");
	}
    }

    if (!fFound)
    {
	pCRLNew = CertCreateCRLContext(X509_ASN_ENCODING, pbCRL, cbCRL);
	if (NULL == pCRLNew)
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "CertCreateCRLContext");
	}

	if (!CertAddCRLContextToStore(
				  hStore,
				  pCRLNew,
				  CERT_STORE_ADD_ALWAYS,
				  NULL))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "CertAddCRLContextToStore");
	}
    }
    hr = S_OK;

error:
    if (S_OK != hr)
    {
	crlLogError(fDelta, FALSE, iKey, g_pwszIntermediateCAStore, NULL, hr);
    }
    if (NULL != pCRLNew)
    {
        CertFreeCRLContext(pCRLNew);
    }
    if (NULL != pCRLStore)
    {
        CertFreeCRLContext(pCRLStore);
    }
    if (NULL != hStore)
    {
        CertCloseStore(hStore, CERT_CLOSE_STORE_CHECK_FLAG);
    }
    return(hr);
}


HRESULT
crlPublishGeneratedCRL(
    IN DWORD RowId,
    IN FILETIME const *pftCurrent,
    OPTIONAL IN WCHAR const *pwszUserName, // else timer thread
    IN BOOL fDelta,
    IN DWORD iKey,
    IN BYTE const *pbCRL,
    IN DWORD cbCRL,
    IN CACTX const *pCAContext,
    OUT BOOL *pfRetryNeeded,
    OUT HRESULT *phrCRLPublish)
{
    HRESULT hr;
    HRESULT hrCRLPublish;
    DWORD CRLPublishFlags;
    WCHAR *pwszCRLError = NULL;

    *pfRetryNeeded = FALSE;
    hrCRLPublish = S_OK;
    CRLPublishFlags = 0;

    // first verify CRL signature with the CA Cert public key (catch bad CSPs)

    if (!CryptVerifyCertificateSignature(
			NULL,
			X509_ASN_ENCODING,
			pbCRL,
			cbCRL,
			&pCAContext->pccCA->pCertInfo->SubjectPublicKeyInfo))
    {
	hr = myHLastError();
	_PrintError(hr, "CryptVerifyCertificateSignature");
	hrCRLPublish = hr;		// save first error
	CRLPublishFlags |= CPF_SIGNATURE_ERROR;
    }
    else
    {
	hr = crlWriteCRLToCAStore(
			    fDelta,
			    iKey,
			    pbCRL,
			    cbCRL,
			    pCAContext->pccCA);
	if (S_OK != hr)
	{
	    _PrintError(hr, "crlWriteCRLToCAStore");
	    hrCRLPublish = hr;
	    CRLPublishFlags |= CPF_CASTORE_ERROR;
	}

	hr = crlWriteCRLToURLList(
			    fDelta,
			    iKey,
			    fDelta?
				pCAContext->papwszDeltaCRLFiles :
				pCAContext->papwszCRLFiles,
			    pbCRL,
			    cbCRL,
			    &CRLPublishFlags,
			    &pwszCRLError);
	if (S_OK != hr)
	{
	    _PrintError(hr, "crlWriteCRLToURLList");
	    if (S_OK == hrCRLPublish)
	    {
		hrCRLPublish = hr;		// save first error
	    }
	}
    }
    if (S_OK != hrCRLPublish)
    {
	*pfRetryNeeded = TRUE;
    }
    hr = crlUpdateCRLPublishStateInDB(
				RowId,
				pftCurrent,
				hrCRLPublish,
				CRLPublishFlags,
				pwszUserName,
				pwszCRLError);
    _JumpIfError(hr, error, "crlUpdateCRLPublishStateInDB");

error:
    *phrCRLPublish = hrCRLPublish;
    if (NULL != pwszCRLError)
    {
        LocalFree(pwszCRLError);
    }
    return(hr);
}


HRESULT
crlSignAndSaveCRL(
    IN DWORD CRLNumber,
    IN DWORD CRLNumberBaseMin,		// 0 implies Base CRL; else Delta CRL
    OPTIONAL IN WCHAR const *pwszUserName, // else timer thread
    IN BOOL fShadowDelta,		// empty delta CRL with new MinBaseCRL
    IN CACTX const *pCAContext,
    IN DWORD cCRL,
    IN CRL_ENTRY *aCRL,
    IN FILETIME const *pftCurrent,
    IN FILETIME const *pftThisUpdate,	// includes skew
    OPTIONAL IN FILETIME const *pftNextUpdate,	// includes skew & overlap
    IN FILETIME const *pftThisPublish,
    OPTIONAL IN FILETIME const *pftNextPublish,
    OPTIONAL IN FILETIME const *pftQuery,
    IN FILETIME const *pftPropagationComplete,
    OUT BOOL *pfRetryNeeded,
    OUT HRESULT *phrCRLPublish)
{
    HRESULT hr;
    CRL_INFO CRLInfo;
    DWORD i;
    DWORD cb;
    DWORD cbCRL;
    BYTE *pbCrlEncoded = NULL;
    BYTE *pbCRL = NULL;
#define CCRLEXT	6
    CERT_EXTENSION aext[CCRLEXT];
    BYTE *apbFree[CCRLEXT];
    DWORD cpbFree = 0;
    DWORD RowId;

    *pfRetryNeeded = FALSE;
    *phrCRLPublish = S_OK;

    ZeroMemory(&CRLInfo, sizeof(CRLInfo));
    CRLInfo.dwVersion = CRL_V2;
    CRLInfo.SignatureAlgorithm.pszObjId = pCAContext->pszObjIdSignatureAlgorithm;
    CRLInfo.Issuer.pbData = pCAContext->pccCA->pCertInfo->Subject.pbData;
    CRLInfo.Issuer.cbData = pCAContext->pccCA->pCertInfo->Subject.cbData;
    CRLInfo.ThisUpdate = *pftThisUpdate;
    if (NULL != pftNextUpdate)
    {
	CRLInfo.NextUpdate = *pftNextUpdate;
    }
    CRLInfo.cCRLEntry = cCRL;
    CRLInfo.rgCRLEntry = aCRL;

    CRLInfo.cExtension = 0;
    CRLInfo.rgExtension = aext;
    ZeroMemory(aext, sizeof(aext));

    if (NULL != pCAContext->KeyAuthority2CRL.pbData)
    {
	aext[CRLInfo.cExtension].pszObjId = szOID_AUTHORITY_KEY_IDENTIFIER2;
	if (EDITF_ENABLEAKICRITICAL & g_CRLEditFlags)
	{
	    aext[CRLInfo.cExtension].fCritical = TRUE;
	}
	aext[CRLInfo.cExtension].Value = pCAContext->KeyAuthority2CRL;
	CRLInfo.cExtension++;
    }

    if (!myEncodeObject(
		    X509_ASN_ENCODING,
		    X509_INTEGER,
		    &pCAContext->NameId,
		    0,
		    CERTLIB_USE_LOCALALLOC,
		    &aext[CRLInfo.cExtension].Value.pbData,
		    &aext[CRLInfo.cExtension].Value.cbData))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myEncodeObject");
    }
    aext[CRLInfo.cExtension].pszObjId = szOID_CERTSRV_CA_VERSION;
    apbFree[cpbFree++] = aext[CRLInfo.cExtension].Value.pbData,
    CRLInfo.cExtension++;

    if (!myEncodeObject(
		    X509_ASN_ENCODING,
		    X509_INTEGER,
		    &CRLNumber,
		    0,
		    CERTLIB_USE_LOCALALLOC,
		    &aext[CRLInfo.cExtension].Value.pbData,
		    &aext[CRLInfo.cExtension].Value.cbData))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myEncodeObject");
    }
    aext[CRLInfo.cExtension].pszObjId = szOID_CRL_NUMBER;
    apbFree[cpbFree++] = aext[CRLInfo.cExtension].Value.pbData;
    if ((CRLF_CRLNUMBER_CRITICAL & g_dwCRLFlags) && 0 == CRLNumberBaseMin)
    {
	aext[CRLInfo.cExtension].fCritical = TRUE;
    }
    CRLInfo.cExtension++;

    // NextPublish is the earliest the client should look for a newer CRL.

    if (NULL != pftNextPublish)
    {
	if (!myEncodeObject(
			X509_ASN_ENCODING,
			X509_CHOICE_OF_TIME,
			pftNextPublish,
			0,
			CERTLIB_USE_LOCALALLOC,
			&aext[CRLInfo.cExtension].Value.pbData,
			&aext[CRLInfo.cExtension].Value.cbData))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "myEncodeObject");
	}
	aext[CRLInfo.cExtension].pszObjId = szOID_CRL_NEXT_PUBLISH;
	apbFree[cpbFree++] = aext[CRLInfo.cExtension].Value.pbData,
	CRLInfo.cExtension++;
    }

    if (0 != CRLNumberBaseMin)		// if Delta CRL
    {
	if (!myEncodeObject(
			X509_ASN_ENCODING,
			X509_INTEGER,
			&CRLNumberBaseMin,
			0,
			CERTLIB_USE_LOCALALLOC,
			&aext[CRLInfo.cExtension].Value.pbData,
			&aext[CRLInfo.cExtension].Value.cbData))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "myEncodeObject");
	}
	aext[CRLInfo.cExtension].pszObjId = szOID_DELTA_CRL_INDICATOR;
	aext[CRLInfo.cExtension].fCritical = TRUE;
	apbFree[cpbFree++] = aext[CRLInfo.cExtension].Value.pbData,
	CRLInfo.cExtension++;

	// Add a CDP to base and delta CRLs to make it easier to manually
	// publish an off-line CA's CRLs to the correct DS location.

	if (NULL != pCAContext->CDPCRLDelta.pbData)
	{
	    aext[CRLInfo.cExtension].pszObjId = szOID_CRL_SELF_CDP;
	    aext[CRLInfo.cExtension].Value = pCAContext->CDPCRLDelta;
	    CRLInfo.cExtension++;
	}
    }
    else
    {
	// else if Base CRL (and if delta CRLs are enabled)

	if (!g_fDeltaCRLPublishDisabled &&
	    NULL != pCAContext->CDPCRLFreshest.pbData)
	{
	    aext[CRLInfo.cExtension].pszObjId = szOID_FRESHEST_CRL;
	    aext[CRLInfo.cExtension].Value = pCAContext->CDPCRLFreshest;
	    CRLInfo.cExtension++;
	}

	// Add a CDP to base and delta CRLs to make it easier to manually
	// publish an off-line CA's CRLs to the correct DS location.

	if (NULL != pCAContext->CDPCRLBase.pbData)
	{
	    aext[CRLInfo.cExtension].pszObjId = szOID_CRL_SELF_CDP;
	    aext[CRLInfo.cExtension].Value = pCAContext->CDPCRLBase;
	    CRLInfo.cExtension++;
	}
    }
    CSASSERT(ARRAYSIZE(aext) >= CRLInfo.cExtension);

    if (!myEncodeObject(
                    X509_ASN_ENCODING,
                    X509_CERT_CRL_TO_BE_SIGNED,
                    &CRLInfo,
                    0,
                    CERTLIB_USE_LOCALALLOC,
                    &pbCrlEncoded,               // pbEncoded
                    &cb))
    {
        hr = myHLastError();
	_JumpError(hr, error, "myEncodeObject");
    }

    hr = myEncodeSignedContent(
			pCAContext->hProvCA,
			X509_ASN_ENCODING,
			pCAContext->pszObjIdSignatureAlgorithm,
			pbCrlEncoded,
			cb,
			CERTLIB_USE_LOCALALLOC,
			&pbCRL,
			&cbCRL); // use LocalAlloc*
    _JumpIfError(hr, error, "myEncodeSignedContent");

    hr = crlWriteCRLToDB(
		    CRLNumber,		 // CRLNumber
		    CRLNumberBaseMin,	 // CRLMinBase: 0 implies Base CRL
		    pwszUserName,
		    fShadowDelta,
		    pCAContext->NameId,  // CRLNameId
		    cCRL,		 // CRLCount
		    &CRLInfo.ThisUpdate, // pftThisUpdate
		    pftNextUpdate,
		    pftThisPublish,	 // pftThisPublish
		    pftNextPublish,	 // pftNextPublish
		    pftQuery,
		    pftPropagationComplete,
		    pbCRL,		 // pbCRL
		    cbCRL,		 // cbCRL
		    &RowId);
    _JumpIfError(hr, error, "crlWriteCRLToDB");

    hr = crlPublishGeneratedCRL(
		    RowId,
		    pftCurrent,
		    pwszUserName,
		    0 != CRLNumberBaseMin,	// fDelta
		    pCAContext->iKey,
		    pbCRL,		 	// pbCRL
		    cbCRL,		 	// cbCRL
		    pCAContext,
		    pfRetryNeeded,
		    phrCRLPublish);
    _JumpIfError(hr, error, "crlPublishGeneratedCRL");

error:
    CSASSERT(ARRAYSIZE(aext) >= CRLInfo.cExtension);
    CSASSERT(ARRAYSIZE(apbFree) >= cpbFree);
    for (i = 0; i < cpbFree; i++)
    {
	CSASSERT(NULL != apbFree[i]);
	LocalFree(apbFree[i]);
    }
    if (NULL != pbCrlEncoded)
    {
        LocalFree(pbCrlEncoded);
    }
    if (NULL != pbCRL)
    {
        LocalFree(pbCRL);
    }
    return(myHError(hr));
}


///////////////////////////////////////////////////
// crlPublishCRLFromCAContext is called to build and save one CRL.
//

HRESULT
crlPublishCRLFromCAContext(
    IN DWORD CRLNumber,
    IN DWORD CRLNumberBaseMin,		// 0 implies Base CRL; else Delta CRL
    OPTIONAL IN WCHAR const *pwszUserName, // else timer thread
    IN BOOL fShadowDelta,		// empty delta CRL with new MinBaseCRL
    IN CACTX const *pCAContext,
    IN FILETIME const *pftCurrent,
    IN FILETIME ftThisUpdate,		// clamped by CA cert
    IN OUT FILETIME *pftNextUpdate,	// clamped by CA cert
    OPTIONAL OUT BOOL *pfClamped,
    OPTIONAL IN FILETIME const *pftQuery,
    IN FILETIME const *pftThisPublish,
    IN FILETIME const *pftNextPublish,
    IN FILETIME const *pftLastPublishBase,
    IN FILETIME const *pftPropagationComplete,
    OUT BOOL *pfRetryNeeded,
    OUT HRESULT *phrPublish)
{
    HRESULT hr;
    DWORD cCRL = 0;
    CRL_ENTRY *aCRL = NULL;
    VOID *pvBlockSerial = NULL;
    CERT_INFO const *pCertInfo = pCAContext->pccCA->pCertInfo;

    *pfRetryNeeded = FALSE;
    *phrPublish = S_OK;
    hr = S_OK;
    __try
    {
	if (!fShadowDelta)
	{
	    hr = crlBuildCRLArray(
			0 != CRLNumberBaseMin,	// fDelta
			pftQuery,
			pftThisPublish,
			pftLastPublishBase,
			pCAContext->iKey,
			&cCRL,
			&aCRL,
			&pvBlockSerial);
	    _JumpIfError(hr, error, "crlBuildCRLArray");
	}

	// Ensure it is not before the CA certificate's start date.

	if (0 > CompareFileTime(&ftThisUpdate, &pCertInfo->NotBefore))
	{
	    // clamp
	    ftThisUpdate = pCertInfo->NotBefore;
	}

	// Ensure it is not after the CA certificate's end date.

        if (NULL != pfClamped)
        {
            //init to FALSE
            *pfClamped = FALSE;
        }

	if (0 == (CRLF_PUBLISH_EXPIRED_CERT_CRLS & g_dwCRLFlags) &&
	    0 < CompareFileTime(pftNextUpdate, &pCertInfo->NotAfter))
	{
	    // clamp
	    *pftNextUpdate = pCertInfo->NotAfter;
            if (NULL != pfClamped)
            {
                *pfClamped = TRUE;
            }
	    if (pCAContext->iKey < g_pCAContextCurrent->iKey)
	    {
		pftNextUpdate = NULL;
		pftNextPublish = NULL;
	    }
	}
#ifdef DBG_CERTSRV_DEBUG_PRINT
	{
	    WCHAR *pwszNow = NULL;
	    WCHAR *pwszQuery = NULL;
	    WCHAR *pwszThisUpdate = NULL;
	    WCHAR *pwszNextUpdate = NULL;
	    WCHAR const *pwszCRLType = 0 == CRLNumberBaseMin? L"Base" : L"Delta";

	    myGMTFileTimeToWszLocalTime(pftThisPublish, TRUE, &pwszNow);
	    if (NULL != pftQuery)
	    {
		myGMTFileTimeToWszLocalTime(pftQuery, TRUE, &pwszQuery);
	    }
	    myGMTFileTimeToWszLocalTime(&ftThisUpdate, TRUE, &pwszThisUpdate);
	    if (NULL != pftNextUpdate)
	    {
		myGMTFileTimeToWszLocalTime(pftNextUpdate, TRUE, &pwszNextUpdate);
	    }

	    DBGPRINT((
		DBG_SS_ERROR | DBG_SS_CERTSRV,
		"crlPublishCRLFromCAContext(tid=%d, CA Version=%u.%u): %ws CRL %u,%hs %u\n"
		    "        %ws CRL Publishing now(%ws)\n"
		    "        %ws CRL Query(%ws)\n"
		    "        %ws CRL ThisUpdate(%ws)\n"
		    "        %ws CRL NextUpdate(%ws)\n",
		GetCurrentThreadId(),
		pCAContext->iCert,
		pCAContext->iKey,
		pwszCRLType,
		CRLNumber,
		0 == CRLNumberBaseMin? "" : " Min Base",
		CRLNumberBaseMin,

		pwszCRLType,
		pwszNow,

		pwszCRLType,
		NULL != pftQuery? pwszQuery : L"None",

		pwszCRLType,
		pwszThisUpdate,

		pwszCRLType,
		pwszNextUpdate));
	    if (NULL != pwszNow)
	    {
		LocalFree(pwszNow);
	    }
	    if (NULL != pwszQuery)
	    {
		LocalFree(pwszQuery);
	    }
	    if (NULL != pwszThisUpdate)
	    {
		LocalFree(pwszThisUpdate);
	    }
	    if (NULL != pwszNextUpdate)
	    {
		LocalFree(pwszNextUpdate);
	    }
	}
#endif //DBG_CERTSRV_DEBUG_PRINT

	hr = CertSrvTestServerState();
	_JumpIfError(hr, error, "CertSrvTestServerState");

	hr = crlSignAndSaveCRL(
		    CRLNumber,
		    CRLNumberBaseMin,
		    pwszUserName,
		    fShadowDelta,
		    pCAContext,
		    cCRL,
		    aCRL,
		    pftCurrent,
		    &ftThisUpdate,
		    pftNextUpdate,
		    pftThisPublish,	// - no skew or overlap
		    pftNextPublish,	// no skew
		    pftQuery,
		    pftPropagationComplete,
		    pfRetryNeeded,
		    phrPublish);
	_JumpIfError(hr, error, "crlSignAndSaveCRL");

	CONSOLEPRINT4((
		DBG_SS_CERTSRV,
		"Published %hs CRL #%u for key %u.%u\n",
		0 == CRLNumberBaseMin? "Base" : "Delta",
		CRLNumber,
		pCAContext->iCert,
		pCAContext->iKey));

	CSASSERT(S_OK == hr);
    }
    __except(hr = myHEXCEPTIONCODE(), EXCEPTION_EXECUTE_HANDLER)
    {
    }

error:
    crlFreeCRLArray(pvBlockSerial, aCRL);
    CSASSERT(S_OK == hr || FAILED(hr));
    return(hr);
}


DWORD g_aColCRLNumber[] = {

#define ICOL_CRLNUMBER		0
    DTI_CRLTABLE | DTL_NUMBER,
};


HRESULT
crlGetNextCRLNumber(
    OUT DWORD *pdwCRLNumber)
{
    HRESULT hr;
    CERTVIEWRESTRICTION acvr[1];
    CERTVIEWRESTRICTION *pcvr;
    IEnumCERTDBRESULTROW *pView = NULL;
    DWORD Zero = 0;
    CERTDBRESULTROW aResult[1];
    CERTDBRESULTROW *pResult;
    DWORD celtFetched;
    BOOL fResultActive = FALSE;

    *pdwCRLNumber = 1;

    // Set up restrictions as follows:

    pcvr = acvr;

    // CRLNumber > 0 (indexed column)

    pcvr->ColumnIndex = DTI_CRLTABLE | DTL_NUMBER;
    pcvr->SeekOperator = CVR_SEEK_GT;
    pcvr->SortOrder = CVR_SORT_DESCEND;		// highest CRL Number first
    pcvr->pbValue = (BYTE *) &Zero;
    pcvr->cbValue = sizeof(Zero);
    pcvr++;

    CSASSERT(ARRAYSIZE(acvr) == SAFE_SUBTRACT_POINTERS(pcvr, acvr));

    celtFetched = 0;
    hr = g_pCertDB->OpenView(
			ARRAYSIZE(acvr),
			acvr,
			ARRAYSIZE(g_aColCRLNumber),
			g_aColCRLNumber,
			0,		// no worker thread
			&pView);
    _JumpIfError(hr, error, "OpenView");

    hr = pView->Next(NULL, ARRAYSIZE(aResult), aResult, &celtFetched);
    if (S_FALSE == hr)
    {
	if (0 == celtFetched)
	{
	    hr = S_OK;
	    goto error;
	}
    }
    _JumpIfError(hr, error, "Next");

    fResultActive = TRUE;

    CSASSERT(ARRAYSIZE(aResult) == celtFetched);

    pResult = &aResult[0];

    CSASSERT(ARRAYSIZE(g_aColCRLNumber) == pResult->ccol);
    CSASSERT(NULL != pResult->acol[ICOL_CRLNUMBER].pbValue);
    CSASSERT(PROPTYPE_LONG == (PROPTYPE_MASK & pResult->acol[ICOL_CRLNUMBER].Type));
    CSASSERT(sizeof(*pdwCRLNumber) == pResult->acol[ICOL_CRLNUMBER].cbValue);

    *pdwCRLNumber = 1 + *(DWORD *) pResult->acol[ICOL_CRLNUMBER].pbValue;
    hr = S_OK;

error:
    if (NULL != pView)
    {
	if (fResultActive)
	{
	    pView->ReleaseResultRow(celtFetched, aResult);
	}
	pView->Release();
    }
    DBGPRINT((
	DBG_SS_CERTSRVI,
	"crlGetNextCRLNumber -> %u\n",
	*pdwCRLNumber));
    return(hr);
}
#undef ICOL_CRLNUMBER


//+--------------------------------------------------------------------------
// crlGetBaseCRLInfo -- get database column data for the most recent Base CRL
//
//---------------------------------------------------------------------------

DWORD g_aColBaseCRLInfo[] = {

#define ICOLBI_CRLNUMBER		0
    DTI_CRLTABLE | DTL_NUMBER,

#define ICOLBI_CRLTHISUPDATE		1
    DTI_CRLTABLE | DTL_THISUPDATEDATE,

#define ICOLBI_CRLNEXTUPDATE		2
    DTI_CRLTABLE | DTL_NEXTUPDATEDATE,

#define ICOLBI_CRLNAMEID		3
    DTI_CRLTABLE | DTL_NAMEID,
};

HRESULT
crlGetBaseCRLInfo(
    IN FILETIME const *pftCurrent,
    IN BOOL fOldestUnexpiredBase,	// else newest propagated CRL
    OUT DWORD *pdwRowId,
    OUT DWORD *pdwCRLNumber,
    OUT FILETIME *pftThisUpdate)
{
    HRESULT hr;
    CERTVIEWRESTRICTION acvr[2];
    CERTVIEWRESTRICTION *pcvr;
    IEnumCERTDBRESULTROW *pView = NULL;
    DWORD Zero = 0;
    CERTDBRESULTROW aResult[1];
    CERTDBRESULTROW *pResult;
    DWORD celtFetched;
    BOOL fResultActive = FALSE;
    BOOL fSaveCRLInfo;

    DWORD RowId = 0;
    DWORD CRLNumber;
    FILETIME ftThisUpdate;
    FILETIME ftNextUpdate;
    FILETIME ftNextUpdateT;

    *pdwRowId = 0;
    *pdwCRLNumber = 0;
    CRLNumber = 0;
    pftThisUpdate->dwHighDateTime = 0;
    pftThisUpdate->dwLowDateTime = 0;

    if (CRLF_DELTA_USE_OLDEST_UNEXPIRED_BASE & g_dwCRLFlags)
    {
	fOldestUnexpiredBase = TRUE;
    }

    // Set up restrictions as follows:

    pcvr = acvr;
    if (fOldestUnexpiredBase)
    {
	// NextUpdate >= now

	pcvr->ColumnIndex = DTI_CRLTABLE | DTL_NEXTUPDATEDATE;
	pcvr->SeekOperator = CVR_SEEK_GE;
    }
    else	// else newest propagated CRL
    {
	// PropagationComplete < now

	pcvr->ColumnIndex = DTI_CRLTABLE | DTL_PROPAGATIONCOMPLETEDATE;
	pcvr->SeekOperator = CVR_SEEK_LT;
    }
    pcvr->SortOrder = CVR_SORT_DESCEND;		// Newest CRL first
    pcvr->pbValue = (BYTE *) pftCurrent;
    pcvr->cbValue = sizeof(*pftCurrent);
    pcvr++;

    // CRL Minimum Base == 0 (to eliminate delta CRLs)

    pcvr->ColumnIndex = DTI_CRLTABLE | DTL_MINBASE;
    pcvr->SeekOperator = CVR_SEEK_EQ;
    pcvr->SortOrder = CVR_SORT_NONE;
    pcvr->pbValue = (BYTE *) &Zero;
    pcvr->cbValue = sizeof(Zero);
    pcvr++;

    CSASSERT(ARRAYSIZE(acvr) == SAFE_SUBTRACT_POINTERS(pcvr, acvr));

    celtFetched = 0;
    ZeroMemory(&ftThisUpdate, sizeof(ftThisUpdate));
    ZeroMemory(&ftNextUpdate, sizeof(ftNextUpdate));
    hr = g_pCertDB->OpenView(
			ARRAYSIZE(acvr),
			acvr,
			ARRAYSIZE(g_aColBaseCRLInfo),
			g_aColBaseCRLInfo,
			0,		// no worker thread
			&pView);
    _JumpIfError(hr, error, "OpenView");

    while (0 == RowId || fOldestUnexpiredBase)
    {
	hr = pView->Next(NULL, ARRAYSIZE(aResult), aResult, &celtFetched);
	if (S_FALSE == hr)
	{
	    CSASSERT(0 == celtFetched);
	    if (0 != RowId)
	    {
		break;
	    }
	    hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
	}
	_JumpIfError(hr, error, "Next: no matching base CRL");

	fResultActive = TRUE;

	CSASSERT(ARRAYSIZE(aResult) == celtFetched);

	pResult = &aResult[0];

	CSASSERT(ARRAYSIZE(g_aColBaseCRLInfo) == pResult->ccol);

	CSASSERT(NULL != pResult->acol[ICOLBI_CRLNUMBER].pbValue);
	CSASSERT(PROPTYPE_LONG == (PROPTYPE_MASK & pResult->acol[ICOLBI_CRLNUMBER].Type));
	CSASSERT(sizeof(DWORD) == pResult->acol[ICOLBI_CRLNUMBER].cbValue);

	CSASSERT(NULL != pResult->acol[ICOLBI_CRLTHISUPDATE].pbValue);
	CSASSERT(PROPTYPE_DATE == (PROPTYPE_MASK & pResult->acol[ICOLBI_CRLTHISUPDATE].Type));
	CSASSERT(sizeof(FILETIME) == pResult->acol[ICOLBI_CRLTHISUPDATE].cbValue);

	if (NULL != pResult->acol[ICOLBI_CRLNEXTUPDATE].pbValue)
	{
	    CSASSERT(PROPTYPE_DATE == (PROPTYPE_MASK & pResult->acol[ICOLBI_CRLNEXTUPDATE].Type));
	    CSASSERT(sizeof(FILETIME) == pResult->acol[ICOLBI_CRLNEXTUPDATE].cbValue);
	    ftNextUpdateT = *(FILETIME *) pResult->acol[ICOLBI_CRLNEXTUPDATE].pbValue;
	}
	else
	{
	    ftNextUpdateT.dwHighDateTime = MAXDWORD;
	    ftNextUpdateT.dwLowDateTime = MAXDWORD;
	}

	DBGPRINT((DBG_SS_CERTSRVI, "Query:RowId: %u\n", pResult->rowid));
	DBGPRINT((DBG_SS_CERTSRVI, "Query:CRLNumber: %u\n", *(DWORD *) pResult->acol[ICOLBI_CRLNUMBER].pbValue));
	DBGPRINT((DBG_SS_CERTSRVI, "Query:NameId: 0x%x\n", *(DWORD *) pResult->acol[ICOLBI_CRLNAMEID].pbValue));
	DBGPRINTTIME(NULL, "Query:ThisUpdate", DPT_DATE, *(FILETIME *) pResult->acol[ICOLBI_CRLTHISUPDATE].pbValue);
	DBGPRINTTIME(NULL, "Query:NextUpdate", DPT_DATE, ftNextUpdateT);

	if (0 == RowId)
	{
	    // save first matching row info
	    
	    fSaveCRLInfo = TRUE;
	}
	else
	{
	    // save row info, if looking for
	    // oldest unexpired base & this CRL expires before the saved CRL
	    //     +1 if first > second -- saved > this
	    
	    CSASSERT(fOldestUnexpiredBase);

	    fSaveCRLInfo = 0 < CompareFileTime(&ftNextUpdate, &ftNextUpdateT);
	}
	if (fSaveCRLInfo)
	{
	    CRLNumber = *(DWORD *) pResult->acol[ICOLBI_CRLNUMBER].pbValue;
	    ftThisUpdate = *(FILETIME *) pResult->acol[ICOLBI_CRLTHISUPDATE].pbValue;
	    ftNextUpdate = ftNextUpdateT;
	    RowId = pResult->rowid;
	    DBGPRINT((
		DBG_SS_CERTSRVI,
		"Query: SAVED RowId=%u CRLNumber=%u\n",
		pResult->rowid,
		CRLNumber));
	    DBGPRINTTIME(NULL, "ftThisUpdate", DPT_DATE, ftThisUpdate);
	}
	pView->ReleaseResultRow(celtFetched, aResult);
	fResultActive = FALSE;
    }

    *pdwRowId = RowId;
    *pdwCRLNumber = CRLNumber;
    *pftThisUpdate = ftThisUpdate;
    DBGPRINTTIME(NULL, "*pftThisUpdate", DPT_DATE, *pftThisUpdate);
    DBGPRINTTIME(NULL, "ftNextUpdate", DPT_DATE, ftNextUpdate);
    hr = S_OK;

error:
    if (NULL != pView)
    {
	if (fResultActive)
	{
	    pView->ReleaseResultRow(celtFetched, aResult);
	}
	pView->Release();
    }
    DBGPRINT((
	DBG_SS_CERTSRV,
	"crlGetBaseCRLInfo -> RowId=%u, CRL=%u\n",
	*pdwRowId,
	*pdwCRLNumber));
    return(hr);
}
#undef ICOLBI_CRLNUMBER
#undef ICOLBI_CRLTHISUPDATE
#undef ICOLBI_CRLNEXTUPDATE
#undef ICOLBI_CRLNAMEID


DWORD g_aColRepublishCRLInfo[] = {

#define ICOLRI_CRLNUMBER		0
    DTI_CRLTABLE | DTL_NUMBER,

#define ICOLRI_CRLNAMEID		1
    DTI_CRLTABLE | DTL_NAMEID,

#define ICOLRI_CRLPUBLISHFLAGS		2
    DTI_CRLTABLE | DTL_PUBLISHFLAGS,

#define ICOLRI_CRLTHISUPDATE		3
    DTI_CRLTABLE | DTL_THISUPDATEDATE,

#define ICOLRI_CRLNEXTUPDATE		4
    DTI_CRLTABLE | DTL_NEXTUPDATEDATE,

#define ICOLRI_CRLRAWCRL		5
    DTI_CRLTABLE | DTL_RAWCRL,
};

HRESULT
crlGetRowIdAndCRL(
    IN BOOL fDelta,
    IN CACTX *pCAContext,
    OUT DWORD *pdwRowId,
    OUT DWORD *pcbCRL,
    OPTIONAL OUT BYTE **ppbCRL,
    OPTIONAL OUT DWORD *pdwCRLPublishFlags)
{
    HRESULT hr;
    CERTVIEWRESTRICTION acvr[4];
    CERTVIEWRESTRICTION *pcvr;
    IEnumCERTDBRESULTROW *pView = NULL;
    DWORD Zero = 0;
    DWORD NameIdMin;
    DWORD NameIdMax;
    CERTDBRESULTROW aResult[1];
    CERTDBRESULTROW *pResult;
    DWORD celtFetched;
    BOOL fResultActive = FALSE;
    FILETIME ftCurrent;
    DWORD RowId = 0;
    BYTE *pbCRL = NULL;
    DWORD cbCRL;

    *pdwRowId = 0;
    *pcbCRL = 0;
    if (NULL != ppbCRL)
    {
	*ppbCRL = NULL;
    }

    if (NULL != pdwCRLPublishFlags)
    {
	*pdwCRLPublishFlags = 0;
    }
    GetSystemTimeAsFileTime(&ftCurrent);

    DBGPRINT((
	DBG_SS_CERTSRVI,
	"crlGetRowIdAndCRL(%ws, NameId=%x)\n",
	fDelta? L"Delta" : L"Base",
	pCAContext->NameId));

    // Set up restrictions as follows:

    pcvr = acvr;

    // RowId > 0

    pcvr->ColumnIndex = DTI_CRLTABLE | DTL_ROWID;
    pcvr->SeekOperator = CVR_SEEK_GE;
    pcvr->SortOrder = CVR_SORT_DESCEND;		// Newest CRL first
    pcvr->pbValue = (BYTE *) &Zero;
    pcvr->cbValue = sizeof(Zero);
    pcvr++;

    if (fDelta)
    {
	// CRL Minimum Base > 0 (to eliminate base CRLs)

	pcvr->SeekOperator = CVR_SEEK_GT;
    }
    else
    {
	// CRL Minimum Base == 0 (to eliminate delta CRLs)

	pcvr->SeekOperator = CVR_SEEK_EQ;
    }
    pcvr->ColumnIndex = DTI_CRLTABLE | DTL_MINBASE;
    pcvr->SortOrder = CVR_SORT_NONE;
    pcvr->pbValue = (BYTE *) &Zero;
    pcvr->cbValue = sizeof(Zero);
    pcvr++;

    // NameId >= MAKECANAMEID(iCert == 0, pCAContext->iKey)

    NameIdMin = MAKECANAMEID(0, pCAContext->iKey);
    pcvr->ColumnIndex = DTI_CRLTABLE | DTL_NAMEID;
    pcvr->SeekOperator = CVR_SEEK_GE;
    pcvr->SortOrder = CVR_SORT_NONE;
    pcvr->pbValue = (BYTE *) &NameIdMin;
    pcvr->cbValue = sizeof(NameIdMin);
    pcvr++;

    // NameId <= MAKECANAMEID(iCert == _16BITMASK, pCAContext->iKey)

    NameIdMax = MAKECANAMEID(_16BITMASK, pCAContext->iKey);
    pcvr->ColumnIndex = DTI_CRLTABLE | DTL_NAMEID;
    pcvr->SeekOperator = CVR_SEEK_LE;
    pcvr->SortOrder = CVR_SORT_NONE;
    pcvr->pbValue = (BYTE *) &NameIdMax;
    pcvr->cbValue = sizeof(NameIdMax);
    pcvr++;

    CSASSERT(ARRAYSIZE(acvr) == SAFE_SUBTRACT_POINTERS(pcvr, acvr));

    celtFetched = 0;
    cbCRL = 0;
    hr = g_pCertDB->OpenView(
			ARRAYSIZE(acvr),
			acvr,
			((NULL != ppbCRL) ? 
				(DWORD) ARRAYSIZE(g_aColRepublishCRLInfo) : 
				(DWORD) ARRAYSIZE(g_aColRepublishCRLInfo) - 1 ),	// explicitly describe expected return value
			g_aColRepublishCRLInfo,
			0,		// no worker thread
			&pView);
    _JumpIfError(hr, error, "OpenView");

    while (0 == RowId)
    {
	hr = pView->Next(NULL, ARRAYSIZE(aResult), aResult, &celtFetched);
	if (S_FALSE == hr)
	{
	    CSASSERT(0 == celtFetched);
	    hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
	}
	_JumpIfErrorStr2(
		hr,
		error,
		"Next: no matching CRL",
		fDelta? L"delta" : L"base",
		fDelta? hr : S_OK);

	fResultActive = TRUE;

	CSASSERT(ARRAYSIZE(aResult) == celtFetched);

	pResult = &aResult[0];

	CSASSERT(ARRAYSIZE(g_aColRepublishCRLInfo) == pResult->ccol);

	// verify CRLNumber data & schema

	CSASSERT(NULL != pResult->acol[ICOLRI_CRLNUMBER].pbValue);

	CSASSERT(
	    PROPTYPE_LONG ==
	    (PROPTYPE_MASK & pResult->acol[ICOLRI_CRLNUMBER].Type));

	CSASSERT(sizeof(DWORD) == pResult->acol[ICOLRI_CRLNUMBER].cbValue);

	// verify ThisUpdate data & schema

	CSASSERT(NULL != pResult->acol[ICOLRI_CRLTHISUPDATE].pbValue);

	CSASSERT(
	    PROPTYPE_DATE ==
	    (PROPTYPE_MASK & pResult->acol[ICOLRI_CRLTHISUPDATE].Type));

	CSASSERT(
	    sizeof(FILETIME) ==
	    pResult->acol[ICOLRI_CRLTHISUPDATE].cbValue);

	// verify NextUpdate data & schema

	if (NULL != pResult->acol[ICOLRI_CRLNEXTUPDATE].pbValue)
	{
	    CSASSERT(
		PROPTYPE_DATE ==
		(PROPTYPE_MASK & pResult->acol[ICOLRI_CRLNEXTUPDATE].Type));

	    CSASSERT(
		sizeof(FILETIME) ==
		pResult->acol[ICOLRI_CRLNEXTUPDATE].cbValue);
	}

	// verify RawCRL data & schema

	if (NULL != ppbCRL)
	{
	    CSASSERT(NULL != pResult->acol[ICOLRI_CRLRAWCRL].pbValue);
	    CSASSERT(PROPTYPE_BINARY == (PROPTYPE_MASK & pResult->acol[ICOLRI_CRLRAWCRL].Type));
	}

	// DBGPRINT query results

	DBGPRINT((DBG_SS_CERTSRVI, "Query:RowId: %u\n", pResult->rowid));
	DBGPRINT((
		DBG_SS_CERTSRVI,
		"Query:CRLNumber: %u\n",
		*(DWORD *) pResult->acol[ICOLRI_CRLNUMBER].pbValue));

	DBGPRINT((
		DBG_SS_CERTSRVI,
		"Query:NameId: 0x%x\n",
		*(DWORD *) pResult->acol[ICOLRI_CRLNAMEID].pbValue));

	DBGPRINTTIME(
		NULL,
		"Query:ThisUpdate",
		DPT_DATE,
		*(FILETIME *) pResult->acol[ICOLRI_CRLTHISUPDATE].pbValue);

	if (NULL != pResult->acol[ICOLRI_CRLNEXTUPDATE].pbValue)
	{
	    DBGPRINTTIME(
		    NULL,
		    "Query:NextUpdate",
		    DPT_DATE,
		    *(FILETIME *) pResult->acol[ICOLRI_CRLNEXTUPDATE].pbValue);
	}
	if (NULL != ppbCRL)
	{
	    DBGPRINT((
		    DBG_SS_CERTSRVI,
		    "Query:RawCRL: cb=%x\n",
		    pResult->acol[ICOLRI_CRLRAWCRL].cbValue));
	}
	if (NULL != pResult->acol[ICOLRI_CRLPUBLISHFLAGS].pbValue)
	{
	    DBGPRINT((
		DBG_SS_CERTSRVI,
		"Query:PublishFlags: f=%x\n",
		*(DWORD *) pResult->acol[ICOLRI_CRLPUBLISHFLAGS].pbValue));
	}
	if (0 < CompareFileTime(
		    (FILETIME *) pResult->acol[ICOLRI_CRLTHISUPDATE].pbValue,
		    &ftCurrent))
	{
	    _PrintError(E_INVALIDARG, "ThisUpdate in future");
	}
	if (NULL != pResult->acol[ICOLRI_CRLNEXTUPDATE].pbValue &&
	    0 > CompareFileTime(
		    (FILETIME *) pResult->acol[ICOLRI_CRLNEXTUPDATE].pbValue,
		    &ftCurrent))
	{
	    hr = E_INVALIDARG;
	    _JumpError(hr, error, "NextUpdate in past");
	}

	CSASSERT(0 != pResult->rowid);
	CSASSERT(NULL == pbCRL);
	
	RowId = pResult->rowid;
	if (NULL != ppbCRL)
	{
	    cbCRL = pResult->acol[ICOLRI_CRLRAWCRL].cbValue;
	    pbCRL = (BYTE *) LocalAlloc(LMEM_FIXED, cbCRL);
	    if (NULL == pbCRL)
	    {
		hr = E_OUTOFMEMORY;
		_JumpError(hr, error, "LocalAlloc");
	    }
	    CopyMemory(
		    pbCRL,
		    pResult->acol[ICOLRI_CRLRAWCRL].pbValue,
		    cbCRL);
	}
	if (NULL != pdwCRLPublishFlags &&
	    NULL != pResult->acol[ICOLRI_CRLPUBLISHFLAGS].pbValue)
	{
	    *pdwCRLPublishFlags =
		*(DWORD *) pResult->acol[ICOLRI_CRLPUBLISHFLAGS].pbValue;
	}
	DBGPRINT((DBG_SS_CERTSRVI, "Query:RowId: SAVED %u\n", pResult->rowid));

	pView->ReleaseResultRow(celtFetched, aResult);
	fResultActive = FALSE;
    }
    *pdwRowId = RowId;
    if (NULL != ppbCRL)
    {
	*pcbCRL = cbCRL;
	*ppbCRL = pbCRL;
	pbCRL = NULL;
    }
    hr = S_OK;

error:
    if (NULL != pbCRL)
    {
        LocalFree(pbCRL);
    }
    if (NULL != pView)
    {
	if (fResultActive)
	{
	    pView->ReleaseResultRow(celtFetched, aResult);
	}
	pView->Release();
    }
    DBGPRINT((
	DBG_SS_CERTSRVI,
	"crlGetRowIdAndCRL(%ws) -> RowId=%u, cbCRL=%x, hr=%x\n",
	fDelta? L"Delta" : L"Base",
	*pdwRowId,
	*pcbCRL,
	hr));
    return(hr);
}
#undef ICOLRI_CRLNUMBER
#undef ICOLRI_CRLNAMEID
#undef ICOLRI_CRLRAWCRL
#undef ICOLRI_CRLPUBLISHFLAGS
#undef ICOLRI_CRLTHISUPDATEDATE
#undef ICOLRI_CRLNEXTUPDATEDATE


HRESULT
crlRepublishCRLFromCAContext(
    IN FILETIME const *pftCurrent,
    OPTIONAL IN WCHAR const *pwszUserName, // else timer thread
    IN BOOL fDelta,
    IN CACTX *pCAContext,
    OUT BOOL *pfRetryNeeded,
    OUT HRESULT *phrPublish)
{
    HRESULT hr;
    DWORD cbCRL;
    BYTE *pbCRL = NULL;
    DWORD RowId;

    *pfRetryNeeded = FALSE;
    *phrPublish = S_OK;

    hr = crlGetRowIdAndCRL(fDelta, pCAContext, &RowId, &cbCRL, &pbCRL, NULL);
    _JumpIfError(hr, error, "crlGetRowIdAndCRL");

    hr = crlPublishGeneratedCRL(
		    RowId,
		    pftCurrent,
		    pwszUserName,
		    fDelta,
		    pCAContext->iKey,
		    pbCRL,
		    cbCRL,
		    pCAContext,
		    pfRetryNeeded,
		    phrPublish);
    _JumpIfError(hr, error, "crlPublishGeneratedCRL");

error:
    if (NULL != pbCRL)
    {
        LocalFree(pbCRL);
    }
    return(hr);
}


HRESULT
crlRepublishExistingCRLs(
    OPTIONAL IN WCHAR const *pwszUserName, // else timer thread
    IN BOOL fDeltaOnly,
    IN BOOL fShadowDelta,
    IN FILETIME const *pftCurrent,
    OUT BOOL *pfRetryNeeded,
    OUT HRESULT *phrPublish)
{
    HRESULT hr;
    HRESULT hrPublish;
    BOOL fRetryNeeded;
    DWORD i;

    *pfRetryNeeded = FALSE;
    *phrPublish = S_OK;

    // Walk global CA Context array from the back, and republish CRLs for
    // each unique CA key.  This causes the most current CRL to be published
    // first, and the most current CA Cert context to be used to publish a CRL
    // that covers multiple CA Certs due to key reuse.

    for (i = g_cCACerts; i > 0; i--)
    {
	CACTX *pCAContext = &g_aCAContext[i - 1];

	hr = PKCSVerifyCAState(pCAContext);
	_PrintIfError(hr, "PKCSVerifyCAState");
	if (CTXF_SKIPCRL & pCAContext->Flags)
	{
	    continue;
	}
	if (!fDeltaOnly)
	{
	    // Publish the most recent existing Base CRL

	    hr = CertSrvTestServerState();
	    _JumpIfError(hr, error, "CertSrvTestServerState");

	    hr = crlRepublishCRLFromCAContext(
				    pftCurrent,
				    pwszUserName,
				    FALSE,	// fDelta
				    pCAContext,
				    &fRetryNeeded,
				    &hrPublish);
	    _JumpIfError(hr, error, "crlRepublishCRLFromCAContext");

	    if (fRetryNeeded)
	    {
		*pfRetryNeeded = TRUE;
	    }
	    if (S_OK == *phrPublish)
	    {
		*phrPublish = hrPublish;
	    }
	}

	if (!g_fDeltaCRLPublishDisabled || fShadowDelta)
	{
	    // Publish the most recent existing Delta CRL

	    hr = CertSrvTestServerState();
	    _JumpIfError(hr, error, "CertSrvTestServerState");

	    hr = crlRepublishCRLFromCAContext(
				    pftCurrent,
				    pwszUserName,
				    TRUE,	// fDelta
				    pCAContext,
				    &fRetryNeeded,
				    &hrPublish);
	    _JumpIfError(hr, error, "crlRepublishCRLFromCAContext");

	    if (fRetryNeeded)
	    {
		*pfRetryNeeded = TRUE;
	    }
	    if (S_OK == *phrPublish)
	    {
		*phrPublish = hrPublish;
	    }
	}
    }
    hr = S_OK;

error:
    return(hr);
}


HRESULT
crlComputeCRLTimes(
    IN BOOL DBGPARMREFERENCED(fDelta),
    IN CSCRLPERIOD const *pccp,
    IN FILETIME const *pftCurrent,
    OUT FILETIME *pftThisUpdate,	 // ftCurrent - clock skew
    IN OUT FILETIME *pftNextUpdate,	 // ftCurrent + period + overlap + skew
    OUT FILETIME *pftNextPublish,	 // ftCurrent + CRL period
    OUT FILETIME *pftPropagationComplete) // ftCurrent + overlap
{
    HRESULT hr;
    LONGLONG lldelta;

    if (0 == pftNextUpdate->dwHighDateTime &&
	0 == pftNextUpdate->dwLowDateTime)
    {
	// Calculate expiration date for this CRL:
	// ftCurrent + CRL period

	DBGPRINTTIME(&fDelta, "*pftCurrent", DPT_DATE, *pftCurrent);
	*pftNextUpdate = *pftCurrent;
	DBGPRINT((
	    DBG_SS_CERTSRVI,
	    "+ count=%d, enum=%d\n",
	    pccp->lCRLPeriodCount,
	    pccp->enumCRLPeriod));

	myMakeExprDateTime(
		    pftNextUpdate,
		    pccp->lCRLPeriodCount,
		    pccp->enumCRLPeriod);
	DBGPRINTTIME(&fDelta, "*pftNextUpdate", DPT_DATE, *pftNextUpdate);
    }
    if (0 > CompareFileTime(pftNextUpdate, pftCurrent))
    {
	hr = E_INVALIDARG;
	_JumpError(hr, error, "*pftNextUpdate in past");
    }

    *pftThisUpdate = *pftCurrent;
    *pftNextPublish = *pftNextUpdate;	// unmodified expiration time

    // Subtract clock skew from the current time for ftThisUpdate time.

    lldelta = g_dwClockSkewMinutes * CVT_MINUTES;
    myAddToFileTime(pftThisUpdate, -lldelta * CVT_BASE);

    // Add clock skew to ftNextUpdate,
    // Add propogation overlap to ftNextUpdate.

    lldelta += pccp->dwCRLOverlapMinutes * CVT_MINUTES;
    myAddToFileTime(pftNextUpdate, lldelta * CVT_BASE);

    *pftPropagationComplete = *pftCurrent;
    lldelta = pccp->dwCRLOverlapMinutes * CVT_MINUTES;
    myAddToFileTime(pftPropagationComplete, lldelta * CVT_BASE);

    DBGPRINTTIME(&fDelta, "*pftCurrent", DPT_DATE, *pftCurrent);
    DBGPRINTTIME(&fDelta, "*pftThisUpdate", DPT_DATE, *pftThisUpdate);
    DBGPRINTTIME(&fDelta, "*pftNextUpdate", DPT_DATE, *pftNextUpdate);
    DBGPRINTTIME(&fDelta, "*pftNextPublish", DPT_DATE, *pftNextPublish);
    DBGPRINTTIME(&fDelta, "*pftPropagationComplete", DPT_DATE, *pftPropagationComplete);

    hr = S_OK;

error:
    return(hr);
}


// crlGenerateAndPublishCRLs
//
// The algorithm for computing base and delta CRL overlap periods is:
// Base:
//    If Base registry overlap period specified:
//    {
//	  Start with Base registry setting rounded down to nearest minute
//	  multiple
//    }
//    else
//    {
//	  Start with 10% of Base CRL period (1/10 period) rounded down to
//	  nearest minute multiple
//	  Maximum 12 hours
//    }
//    Minimum 1.5 times clock skew (usually 1.5 * 10 minutes)
//    Maximum 100% of Base CRL period
//
// Delta:
//    If Delta registry overlap period specified:
//    {
//	  Start with Delta registry setting rounded down to nearest minute
//	  multiple
//    }
//    else
//    {
//	  Start with 100% of Delta CRL period (full period) rounded down to
//	  nearest minute multiple
//	  Maximum 12 hours
//    }
//    Minimum 1.5 times clock skew (usually 1.5 * 10 minutes)
//    Maximum 100% of Delta CRL period

HRESULT
crlGenerateAndPublishCRLs(
    OPTIONAL IN WCHAR const *pwszUserName, // else timer thread
    IN BOOL fDeltaOnly,			// else base (and delta, if enabled)
    IN BOOL fShadowDelta,		// empty delta CRL with new MinBaseCRL
    IN FILETIME const *pftCurrent,
    IN FILETIME ftNextUpdateBase,
    OUT DWORD *pdwRowIdBase,
    OUT FILETIME *pftQueryDeltaDelete,
    OUT BOOL *pfRetryNeeded,
    OUT HRESULT *phrPublish)
{
    HRESULT hr;
    HRESULT hrPublish;
    HKEY hkeyBase = NULL;
    HKEY hkeyCA = NULL;
    BOOL fClamped = FALSE;
    DWORD CRLNumber;
    DWORD CRLNumberDelta;
    DWORD CRLNumberBaseMin = 0;
    DWORD i;
    BOOL fRetryNeeded;
    FILETIME ftNextUpdateDelta;
    FILETIME ftThisUpdate;
    FILETIME ftQueryDelta;
    FILETIME *pftQueryDelta = &ftQueryDelta;
    FILETIME ftLastPublishBase;
    FILETIME ftNextPublishBase;
    FILETIME ftNextUpdateBaseClamped = ftNextUpdateBase; // if clamped
    FILETIME ftNextPublishDelta;
    FILETIME ftPropagationCompleteBase;
    FILETIME ftPropagationCompleteDelta;
    CSCRLPERIOD ccpBase;
    CSCRLPERIOD ccpDelta;

    *pfRetryNeeded = FALSE;
    pftQueryDeltaDelete->dwHighDateTime = 0;
    pftQueryDeltaDelete->dwLowDateTime = 0;
    *phrPublish = S_OK;

    hr = crlGetNextCRLNumber(&CRLNumber);
    _JumpIfError(hr, error, "crlGetNextCRLNumber");

    hr = crlGetRegCRLPublishParams(
			    g_wszSanitizedName,
			    &ccpBase,
			    &ccpDelta);
    _JumpIfError(hr, error, "crlGetRegCRLPublishParams");

    // in manual publish case, 0 implies use default publish period

    CRLNumberDelta = CRLNumber;
    if (fDeltaOnly)
    {
	ftNextUpdateDelta = ftNextUpdateBase;
	ZeroMemory(&ftNextUpdateBase, sizeof(ftNextUpdateBase));
    }
    else
    {
	// son of RFC 2459: Trevor says don't do this (yet):
	// CRLNumberDelta++;
	ZeroMemory(&ftNextUpdateDelta, sizeof(ftNextUpdateDelta));
    }

    hr = crlComputeCRLTimes(
		FALSE,				// fDelta
		&ccpBase,			// IN
		pftCurrent,			// IN
		&ftThisUpdate,			// OUT includes skew
		&ftNextUpdateBase,		// INOUT includes overlap, skew
		&ftNextPublishBase,		// OUT unmodified expire time
		&ftPropagationCompleteBase);	// OUT includes overlap
    _JumpIfError(hr, error, "crlComputeCRLTimes");

    hr = crlComputeCRLTimes(
		TRUE,				// fDelta
		fShadowDelta? &ccpBase : &ccpDelta, // IN
		pftCurrent,			// IN
		&ftThisUpdate,			// OUT includes skew
		&ftNextUpdateDelta,		// INOUT includes overlap, skew
		&ftNextPublishDelta,		// OUT unmodified expire time
		&ftPropagationCompleteDelta);	// OUT includes overlap
    _JumpIfError(hr, error, "crlComputeCRLTimes");

    // Set ftLastPublishBase to *pftCurrent minus lifetime of this base CRL,
    // which is an educated guess for the ftThisPublish value for the last
    // CRL issued.

    ftLastPublishBase = *pftCurrent;
    myAddToFileTime(
	    &ftLastPublishBase,
	    -mySubtractFileTimes(&ftNextPublishBase, pftCurrent));

    // Clamp delta CRL to not end after base CRL.

    if (0 < CompareFileTime(&ftNextPublishDelta, &ftNextPublishBase))
    {
	ftNextPublishDelta = ftNextPublishBase;
	DBGPRINTTIME(NULL, "ftNextPublishDelta", DPT_DATE, ftNextPublishDelta);
    }
    if (0 < CompareFileTime(&ftNextUpdateDelta, &ftNextUpdateBase))
    {
	ftNextUpdateDelta = ftNextUpdateBase;
	DBGPRINTTIME(NULL, "ftNextUpdateDelta", DPT_DATE, ftNextUpdateDelta);
    }
    if (0 < CompareFileTime(&ftPropagationCompleteDelta, &ftPropagationCompleteBase))
    {
	ftPropagationCompleteDelta = ftPropagationCompleteBase;
	DBGPRINTTIME(NULL, "ftPropagationCompleteDelta", DPT_DATE, ftPropagationCompleteDelta);
    }
    if (!g_fDeltaCRLPublishDisabled || fShadowDelta)
    {
	hr = crlGetBaseCRLInfo(
			    pftCurrent,
			    FALSE,		// try newest propagated CRL
			    pdwRowIdBase,
			    &CRLNumberBaseMin,
			    &ftQueryDelta);
	_PrintIfError(hr, "crlGetBaseCRLInfo");
	if (S_OK != hr)
	{
	    hr = crlGetBaseCRLInfo(
				pftCurrent,
				TRUE,		// try oldest unexpired CRL
				pdwRowIdBase,
				&CRLNumberBaseMin,
				&ftQueryDelta);
	    _PrintIfError(hr, "crlGetBaseCRLInfo");
	    if (S_OK != hr)
	    {
		CRLNumberBaseMin = 1;
		if (!fDeltaOnly && 1 == CRLNumber)
		{
		    ftQueryDelta = *pftCurrent;		// empty CRL
		}
		else
		{
		    pftQueryDelta = NULL;		// full CRL
		}
	    }
	}
	if (S_OK == hr)
	{
	    // Delete old CRLs that expired at least one base CRL period prior
	    // to the "minimum" base crl ThisUpdate date found in the database.
	    
	    *pftQueryDeltaDelete = ftQueryDelta;
	    myAddToFileTime(
		    pftQueryDeltaDelete,
		    -mySubtractFileTimes(&ftNextUpdateBase, &ftThisUpdate));
	}
	if (fShadowDelta)
	{
	    CRLNumberBaseMin = CRLNumber;
	}
	CSASSERT(0 != CRLNumberBaseMin);
    }

    // Walk global CA Context array from the back, and generate a CRL for
    // each unique CA key.  This causes the most current CRL to be built
    // first, and the most current CA Cert to be used to build a CRL that
    // covers multiple CA Certs due to key reuse.

    for (i = g_cCACerts; i > 0; i--)
    {
	CACTX *pCAContext = &g_aCAContext[i - 1];

	hr = PKCSVerifyCAState(pCAContext);
	_PrintIfError(hr, "PKCSVerifyCAState");
	if (CTXF_SKIPCRL & pCAContext->Flags)
	{
	    continue;
	}
	if (!fDeltaOnly)
	{
	    // Publish a new Base CRL

	    // make a local copy in case clamped
	    FILETIME ftNextUpdateBaseTemp = ftNextUpdateBase;
	    fClamped = FALSE;

	    hr = CertSrvTestServerState();
	    _JumpIfError(hr, error, "CertSrvTestServerState");

	    hr = crlPublishCRLFromCAContext(
				    CRLNumber,
				    0,		// CRLNumberBaseMin
				    pwszUserName,
				    FALSE,	// fShadowDelta
				    pCAContext,
				    pftCurrent,
				    ftThisUpdate,
				    &ftNextUpdateBaseTemp,
				    &fClamped,
				    NULL,
				    pftCurrent,
				    &ftNextPublishBase,
				    &ftLastPublishBase,
				    &ftPropagationCompleteBase,
				    &fRetryNeeded,
				    &hrPublish);
	    _JumpIfError(hr, error, "crlPublishCRLFromCAContext");

	    if (fRetryNeeded)
	    {
		*pfRetryNeeded = TRUE;
	    }
	    if (S_OK == *phrPublish)
	    {
		*phrPublish = hrPublish;
	    }

	    {
		CertSrv::CAuditEvent event(SE_AUDITID_CERTSRV_AUTOPUBLISHCRL, g_dwAuditFilter);

		hr = event.AddData(true); // %1 base crl?
		_JumpIfError(hr, error, "CAuditEvent::AddData");

		hr = event.AddData(CRLNumber); // %2 CRL#
		_JumpIfError(hr, error, "CAuditEvent::AddData");

		hr = event.AddData(pCAContext->pwszKeyContainerName); // %3 key container
		_JumpIfError(hr, error, "CAuditEvent::AddData");

		hr = event.AddData(ftNextPublishBase); // %4 next publish
		_JumpIfError(hr, error, "CAuditEvent::AddData");

		hr = event.AddData((LPCWSTR*)pCAContext->papwszCRLFiles); //%5 URLs
		_JumpIfError(hr, error, "CAuditEvent::AddData");

		hr = event.Report();
		_JumpIfError(hr, error, "CAuditEvent::Report");
	    }
	    if (i == g_cCACerts && fClamped)
	    {
		// new next publish clamps with CA expiration, only update
		// the current crl with new one for later reg save

		ftNextUpdateBaseClamped = ftNextUpdateBaseTemp;
	    }
	}

	if (!g_fDeltaCRLPublishDisabled || fShadowDelta)
	{
	    // Publish a new Delta CRL

	    FILETIME ftNextUpdateDeltaTemp = ftNextUpdateDelta;

	    hr = CertSrvTestServerState();
	    _JumpIfError(hr, error, "CertSrvTestServerState");

	    hr = crlPublishCRLFromCAContext(
					CRLNumberDelta,
					CRLNumberBaseMin,
					pwszUserName,
					fShadowDelta,
					pCAContext,
					pftCurrent,
					ftThisUpdate,
					&ftNextUpdateDeltaTemp,
					NULL,
					pftQueryDelta,
					pftCurrent,
					&ftNextPublishDelta,
					&ftLastPublishBase,	// Base!
					&ftPropagationCompleteDelta,
					&fRetryNeeded,
					&hrPublish);
	    _JumpIfError(hr, error, "crlPublishCRLFromCAContext");

	    if (fRetryNeeded)
	    {
		*pfRetryNeeded = TRUE;
	    }
	    if (S_OK == *phrPublish)
	    {
		*phrPublish = hrPublish;
	    }

	    {
		CertSrv::CAuditEvent event(SE_AUDITID_CERTSRV_AUTOPUBLISHCRL, g_dwAuditFilter);

		hr = event.AddData(false); // %1 base crl?
		_JumpIfError(hr, error, "CAuditEvent::AddData");

		hr = event.AddData(CRLNumberDelta); // %2 CRL#
		_JumpIfError(hr, error, "CAuditEvent::AddData");

		hr = event.AddData(pCAContext->pwszKeyContainerName); // %3 key container
		_JumpIfError(hr, error, "CAuditEvent::AddData");

		hr = event.AddData(ftNextPublishDelta); // %4 next publish
		_JumpIfError(hr, error, "CAuditEvent::AddData");

		hr = event.AddData((LPCWSTR*)pCAContext->papwszDeltaCRLFiles); // %5 URLs
		_JumpIfError(hr, error, "CAuditEvent::AddData");

		hr = event.Report();
		_JumpIfError(hr, error, "CAuditEvent::Report");
	    }
	}
    }

    // update the registry and global variables

    if (!fDeltaOnly)
    {
	if (!fClamped)
	{
	    g_ftCRLNextPublish = ftNextPublishBase;
	}
	else
	{
	    g_ftCRLNextPublish = ftNextUpdateBaseClamped;
	}
	hr = crlSetRegCRLNextPublish(
			FALSE,
			g_wszSanitizedName,
			wszREGCRLNEXTPUBLISH,
			&g_ftCRLNextPublish);
	_JumpIfError(hr, error, "crlSetRegCRLNextPublish");
    }

    g_ftDeltaCRLNextPublish = ftNextPublishDelta;

    if (!g_fDeltaCRLPublishDisabled)
    {
	hr = crlSetRegCRLNextPublish(
			TRUE,
			g_wszSanitizedName,
			wszREGCRLDELTANEXTPUBLISH,
			&g_ftDeltaCRLNextPublish);
	_JumpIfError(hr, error, "crlSetRegCRLNextPublish");
    }
    hr = S_OK;

error:
    if (NULL != hkeyCA)
    {
	RegCloseKey(hkeyCA);
    }
    if (NULL != hkeyBase)
    {
	RegCloseKey(hkeyBase);
    }
    return(hr);
}


///////////////////////////////////////////////////
// CRLPublishCRLs is called to publish a set of CRLs.
//
// if fRebuildCRL is TRUE, the CRLs are rebuilt from the database.
// otherwise, the exit module is re-notified of the CRLs.
// For consistency, if the exit module returns ERROR_RETRY, this
// function will write the retry bit into the registry which will
// trigger the Wakeup function, which then recalculates when the
// next publish should happen.
//
// pfRetryNeeded is an OUT param that notifies the autopublish routine if
// a retry is immediately necessary following a rebuilt CRL. In this
// case the registry would not be changed and the registry trigger
// would not fire.
//
// (Current_time - skew) is used as ThisUpdate
// (ftNextUpdate+skew+Overlap) is used as NextUpdate
// (ftNextUpdate) is next wakeup/publish time
//
// There are registry values to specify the overlap.
// HLKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA Name>:
// CRLOverlapPeriod         REG_SZ = Hours (or Minutes)
// CRLOverlapUnits          REG_DWORD = 0 (0) -- DISABLED
//
// If the above registry values are set and valid, the registry overlap period
// is calculated as:
//   max(Registry CRL Overlap Period, 1.5 * Registry clock skew minutes)
//
// If they are not present or invalid, the overlap period is calculated as:
//   max(
//	min(Registry CRL Period / 10, 12 hours),
//	1.5 * Registry clock skew minutes) +
//   Registry clock skew minutes
//
// ThisUpdate is calculated as:
// max(Current Time - Registry clock skew minutes, CA cert NotBefore date)
//
// NextUpdate is calculated as:
//   min(
//	Current Time +
//	    Registry CRL period +
//	    calculated overlap period +
//	    Registry clock skew minutes,
//	CA cert NotAfter date)
//
// The Next CRL publication time is calculated as:
//   Current Time + Registry CRL period
//
// This function sets g_hCRLManualPublishEvent. Automatic publishing
// is personally responsible for clearing this event if it calls us.

HRESULT
CRLPublishCRLs(
    IN BOOL fRebuildCRL,		// else republish only
    IN BOOL fForceRepublish,		// else check registry retry count
    OPTIONAL IN WCHAR const *pwszUserName, // else timer thread
    IN BOOL fDeltaOnly,			// else base (and delta, if enabled)
    IN BOOL fShadowDelta,		// empty delta CRL with new MinBaseCRL
    IN FILETIME ftNextUpdateBase,
    OUT BOOL *pfRetryNeeded,
    OUT HRESULT *phrPublish)
{
    HRESULT hr;
    BOOL fRetryNeeded = FALSE;
    BOOL fExitNotify = FALSE;
    BOOL fCoInitialized = FALSE;
    DWORD RowIdBase = 0;
    FILETIME ftQueryDeltaDelete = { 0, 0 };
    DWORD dwPreviousAttempts;
    DWORD dwCurrentAttempts;
    static BOOL s_fSkipRetry = FALSE;

    *pfRetryNeeded = FALSE;
    *phrPublish = S_OK;

    if (fDeltaOnly && g_fDeltaCRLPublishDisabled && !fShadowDelta)
    {
	hr = HRESULT_FROM_WIN32(ERROR_RESOURCE_DISABLED);
	_JumpError(hr, error, "g_fDeltaCRLPublishDisabled");
    }

    // retrieve initial retry value (optional registry value)

    hr = myGetCertRegDWValue(
			g_wszSanitizedName,
			NULL,
			NULL,
			wszREGCRLATTEMPTREPUBLISH,
			&dwPreviousAttempts);
    if (HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND) == hr)
    {
	dwPreviousAttempts = 0;	// assume no previous failed publish attempts
	hr = S_OK;
    }
    _JumpIfErrorStr(
		hr,
		error,
		"myGetCertRegDWValue",
		wszREGCRLATTEMPTREPUBLISH);

    dwCurrentAttempts = dwPreviousAttempts;
    DBGPRINT((
	DBG_SS_CERTSRV,
	"CRLPublishCRLs(fRebuildCRL=%u, fForceRepublish=%u, User=%ws)\n",
	fRebuildCRL,
	fForceRepublish,
	pwszUserName));
    DBGPRINT((
	DBG_SS_CERTSRV,
	"CRLPublishCRLs(fDeltaOnly=%u, fShadowDelta=%u, dwPreviousAttempts=%u)\n",
	fDeltaOnly,
	fShadowDelta,
	dwPreviousAttempts));

    if (0 != dwPreviousAttempts && NULL == pwszUserName && s_fSkipRetry)
    {
	fRetryNeeded = TRUE;
    }
    else
    {
	FILETIME ftCurrent;

	GetSystemTimeAsFileTime(&ftCurrent);

	// generate CRLs if necessary

	if (fRebuildCRL)
	{
	    hr = crlGenerateAndPublishCRLs(
				    pwszUserName,
				    fDeltaOnly,
				    fShadowDelta,
				    &ftCurrent,
				    ftNextUpdateBase,
				    &RowIdBase,
				    &ftQueryDeltaDelete,
				    &fRetryNeeded,
				    phrPublish);
	    _JumpIfError(hr, error, "crlGenerateAndPublishCRLs");

	    fExitNotify = TRUE;
	    dwCurrentAttempts = 1;
	}
	else
	if (fForceRepublish ||
	    (0 < dwPreviousAttempts &&
	     CERTSRV_CRLPUB_RETRY_COUNT_DEFAULT > dwPreviousAttempts))
	{
	    // If the timer thread is auto-republishing due to previously
	    // failed publish attempts, retry base CRLs, too, because we
	    // can't tell if the retry is due to a base or delta CRL error.

	    if (NULL == pwszUserName)
	    {
		fDeltaOnly = FALSE;
	    }

	    hr = crlRepublishExistingCRLs(
			    pwszUserName,
			    fDeltaOnly,
			    fShadowDelta,
			    &ftCurrent,
			    &fRetryNeeded,
			    phrPublish);
	    _JumpIfError(hr, error, "crlRepublishCRLs");

	    fExitNotify = TRUE;
	    dwCurrentAttempts++;
	}

	if (fExitNotify && g_fEnableExit)
	{
	    hr = CoInitializeEx(NULL, GetCertsrvComThreadingModel());
	    if (S_OK != hr && S_FALSE != hr)
	    {
		_JumpError(hr, error, "CoInitializeEx");
	    }
	    fCoInitialized = TRUE;

	    // make sure exit module(s) get notified for publish and republish
	    // in case of earlier exit module publish failure.

	    hr = ExitNotify(EXITEVENT_CRLISSUED, 0, NULL, MAXDWORD);
	    _PrintIfError(hr, "ExitNotify");
	    if ((HRESULT) ERROR_RETRY == hr ||
		HRESULT_FROM_WIN32(ERROR_RETRY) == hr)
	    {
		fRetryNeeded = TRUE;
		if (S_OK == *phrPublish)
		{
		    *phrPublish = HRESULT_FROM_WIN32(ERROR_RETRY);
		}
	    }
	    CONSOLEPRINT0((DBG_SS_CERTSRV, "Issued CRL Exit Event\n"));
	}

	// If new or existing CRLs successfully published, reset count to 0

	if (fExitNotify && !fRetryNeeded)
	{
	    dwCurrentAttempts = 0;
	    if (CERTLOG_VERBOSE <= g_dwLogLevel)
	    {
		WCHAR *pwszHostName = NULL;
		DWORD LogMsg;

		if (NULL != g_pld)
		{
		    myLdapGetDSHostName(g_pld, &pwszHostName);
		}
		LogMsg = fDeltaOnly?
			    MSG_DELTA_CRLS_PUBLISHED :
			    (g_fDeltaCRLPublishDisabled?
				MSG_BASE_CRLS_PUBLISHED :
				MSG_BASE_AND_DELTA_CRLS_PUBLISHED);
		if (NULL != pwszHostName)
		{
		    LogMsg = fDeltaOnly?
			MSG_DELTA_CRLS_PUBLISHED_HOST_NAME :
			(g_fDeltaCRLPublishDisabled?
			    MSG_BASE_CRLS_PUBLISHED_HOST_NAME :
			    MSG_BASE_AND_DELTA_CRLS_PUBLISHED_HOST_NAME);
		}
		hr = LogEvent(
			EVENTLOG_INFORMATION_TYPE,
			LogMsg,
			(WORD) (NULL == pwszHostName? 0 : 1),	// cStrings
			(WCHAR const **) &pwszHostName);	// apwszStrings
		_PrintIfError(hr, "LogEvent");
	    }
	}

	// If the retry count has changed, update the registry.

	if (dwCurrentAttempts != dwPreviousAttempts)
	{
	    DBGPRINT((
		DBG_SS_CERTSRV,
		"CRLPublishCRLs(Attempts: %u --> %u)\n",
		dwPreviousAttempts,
		dwCurrentAttempts));

	    hr = mySetCertRegDWValue(
			    g_wszSanitizedName,
			    NULL,
			    NULL,
			    wszREGCRLATTEMPTREPUBLISH,
			    dwCurrentAttempts);
	    _JumpIfErrorStr(
			hr,
			error,
			"mySetCertRegDWValue",
			wszREGCRLATTEMPTREPUBLISH);

	    // If we tried unsuccessfully too many times to publish these CRLs,
	    // and we're about to give up until a new set is generated, log an
	    // event saying so.

	    if (fExitNotify &&
		CERTSRV_CRLPUB_RETRY_COUNT_DEFAULT == dwCurrentAttempts &&
		CERTLOG_ERROR <= g_dwLogLevel)
	    {
		WCHAR wszAttempts[cwcDWORDSPRINTF];
		WCHAR const *pwsz = wszAttempts;

		wsprintf(wszAttempts, L"%u", dwCurrentAttempts);
		
		hr = LogEvent(
			EVENTLOG_ERROR_TYPE,
			MSG_E_CRL_PUBLICATION_TOO_MANY_RETRIES,
			1,		// cStrings
			&pwsz);	// apwszStrings
		_PrintIfError(hr, "LogEvent");
	    }
	}
	if (fRebuildCRL)
	{
	    // Delete old CRLs only if new CRLs built & published successfully.

	    if (!fRetryNeeded)
	    {
		hr = CertSrvTestServerState();
		_JumpIfError(hr, error, "CertSrvTestServerState");

		hr = crlDeleteExpiredCRLs(
				    &ftCurrent,
				    &ftQueryDeltaDelete,
				    RowIdBase);
		_PrintIfError(hr, "crlDeleteExpiredCRLs");
	    }

	    // Clear force CRL flag only when we build new CRLs.

	    hr = SetSetupStatus(g_wszSanitizedName, SETUP_FORCECRL_FLAG, FALSE);
	    _PrintIfError(hr, "SetSetupStatus");
	}
    }
    s_fSkipRetry = NULL != pwszUserName;

    if (fRebuildCRL || fRetryNeeded)
    {
	// If we are doing ANYTHING that will affect automatic wakeup, trigger
	// our publish event.
	// NOTE: do this last or else state might not be updated

	SetEvent(g_hCRLManualPublishEvent);
    }
    hr = S_OK;

error:
    *pfRetryNeeded = fRetryNeeded;
    if (fCoInitialized)
    {
        CoUninitialize();
    }
    return(hr);
}


HRESULT
CRLGetCRL(
    IN DWORD iCertArg,
    IN BOOL fDelta,
    OPTIONAL OUT CRL_CONTEXT const **ppCRL,
    OPTIONAL OUT DWORD *pdwCRLPublishFlags)
{
    HRESULT hr;
    DWORD State;
    DWORD iCert;
    DWORD iCRL;
    DWORD dwRowId;
    BYTE *pbCRL = NULL;
    DWORD cbCRL;

    if (NULL != ppCRL)
    {
	*ppCRL = NULL;
    }

    hr = PKCSMapCRLIndex(iCertArg, &iCert, &iCRL, &State);
    _JumpIfError(hr, error, "PKCSMapCRLIndex");

    if (MAXDWORD != iCertArg &&
	CA_DISP_VALID != State &&
	CA_DISP_INVALID != State)
    {
	hr = E_INVALIDARG;
	_JumpError(hr, error, "No CRL for this Cert");
    }

    // Now we know iCert is a valid Cert Index:

    hr = crlGetRowIdAndCRL(
		    fDelta,
		    &g_aCAContext[iCert],
		    &dwRowId,
		    &cbCRL,
		    &pbCRL,
		    pdwCRLPublishFlags);
    if (S_OK != hr)
    {
	_PrintError2(
		hr,
		"crlGetRowIdAndCRL",
		fDelta? HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND) : S_OK);
	if (MAXDWORD != iCertArg && CA_DISP_INVALID == State)
	{
	    hr = E_INVALIDARG;
	    _JumpError(hr, error, "No CRL for this expired Cert");
	}
	_JumpError2(
		hr,
		error,
		"crlGetRowIdAndCRL",
		fDelta? HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND) : S_OK);
    }

    if (NULL != ppCRL)
    {
	*ppCRL = CertCreateCRLContext(X509_ASN_ENCODING, pbCRL, cbCRL);
        if (NULL == *ppCRL)
        {
	    hr = myHLastError();
            _JumpError(hr, error, "CertCreateCRLContext");
        }
    }
    hr = S_OK;

error:
    if (NULL != pbCRL)
    {
        LocalFree(pbCRL);
    }
    return(hr);
}