windows-xp/Source/XPSP1/NT/ds/security/services/ca/certsrv/pkcs.cpp

//+--------------------------------------------------------------------------
//
// Microsoft Windows
// Copyright (C) Microsoft Corporation, 1996 - 1999
//
// File:        pkcs.cpp
//
// Contents:    Cert Server Extension interfaces -- PKCS implementation
//
//---------------------------------------------------------------------------

#include <pch.cpp>

#pragma hdrstop

#include <stdio.h>
#include <time.h>

#define SECURITY_WIN32
#include <security.h>

#include "resource.h"
#include "cscom.h"
#include "csprop.h"
#include "elog.h"
#include "certlog.h"
#include "csdisp.h"
#include "cscsp.h"
#include <certca.h>
#include <esent.h>

#include <winldap.h>
#include "csldap.h"
#include "cainfop.h"

#define __dwFILE__	__dwFILE_CERTSRV_PKCS_CPP_

CSURLTEMPLATE *g_paRevURL = NULL;
DWORD g_caRevURL = 0;

CSURLTEMPLATE *g_paCACertURL = NULL;
DWORD g_caCACertURL = 0;

BSTR g_strDomainDN = NULL;
BSTR g_strConfigDN = NULL;

WCHAR *g_pwszKRAPublishURL = NULL;
WCHAR *g_pwszAIACrossCertPublishURL = NULL;
WCHAR *g_pwszRootTrustCrossCertPublishURL = NULL;


// Note on Renewal and Key reuse:
//
// Cert Indexes, Key Indexes and CRL Name Indexes are all zero based.
//
// One CRL is issued by this CA for each unique key.  Each CRL covers all of
// the certs issued by this CA for one key, even though the key may have been
// used by multiple renewal certs.
//
// The database IssuerNameID PROPTYPE_LONG column holds the Key Index in the
// top 16 bits and the Cert Index in the bottom 16 bits.  This allows a pair of
// query restrictions to reduce the result row set to those revoked certs
// that will be placed into a single CRL.
//
// When Cert File, Key Container, CRL File or DS Object name templates include
// an Index Suffix, an empty string suffix, "", is used when the index is zero.
// Otherwise the Suffix is "(%u)", where the index itself is passed to wsprintf
// to construct the %u field.
//
// Cert Indexes increment each time the CA cert is renewed.  Because 16 bit
// Cert Indexes are stored in the database, a CA may have up to 64k certs,
// and be renewed a maximum of 64k-1 times.
//
// The Cert File Name Suffix is built from the Cert Index.
//
// Key Indexes:  The original installed CA cert uses a Key Index of 0.
// If a renewal cert uses the same key as any previous cert used by this CA,
// the Key Index for the new CA cert is taken from the previous CA cert.
// If a renewal cert uses a new Key, the Cert Index is used for the Key Index.
// The primary reason sequential Key Indexes are not used for new keys is that
// too much context information is required to determine the next Key Index --
// which is particularly difficult to obtain when performing PFX restore.
//
// The Key Container Name Suffix is built from the Key Index.
//
//
// CRL Indexes:  same as Key Index.
// CRL File Name Suffix:  same as Key Container Name Suffix.
//
// Example:		Cert   CertName	Key	KeyName	CRL	CRLName
//			Index	Suffix	Index	Suffix	Index	Suffix
// Original Install	0	""	0	""	0	""
//
// Renew, new Key	1	"(1)"	1	"(1)"	1	"(1)"
// *Renew, reuse Key	2	"(2)"	1	"(1)"	1	"(1)"
// *Renew, reuse Key	3	"(3)"	1	"(1)"	1	"(1)"
//
// Renew, new Key	4	"(4)"	4	"(4)"	4	"(4)"
// *Renew, reuse Key	5	"(5)"	4	"(4)"	4	"(4)"
//
// Renew, new Key	6	"(6)"	6	"(6)"	6	"(6)"
// *Renew, reuse Key	7	"(7)"	6	"(6)"	6	"(6)"
//
//
// CCertRequest::GetCACertificate can be used to fetch Certs and CRLs by Index.
// This API always accepts a Cert Index.
//
// When fetching a certificate:  If the Cert Index is valid, the appropriate
// certificate or chain is returned, even if it is expired or revoked.
//
// When fetching a CRL:  If the Cert Index is valid AND if the Cert Index
// MATCHES the Key Index for the indexed Cert, the appropriate CRL is returned.
// This means that an error will be returned when requesting CRLs associated
// with entries in the above table that reused keys (marked with an asterisk
// in the first column).  The nearest previous unmarked entry's CRL covers
// revocations for the marked entries.
//
//
// CCertServer{Policy,Exit}::GetCertificateProperty can be used to fetch
// information about Certs and CRLs.  This API allows an optional numeric
// suffix on the property name, as in "RawCRL.3".  The suffix is always
// interpreted as a Cert Index.
//
// wszPROPCERTCOUNT:  Returns total CA Cert count, including expired and
// revoked certs.  No numeric Cert Index suffix is allowed.
//
// wszPROPRAWCACERTIFICATE:  Returns the Cert for the passed Cert Index.
// Returns the Cert for the most recent Cert Index if no Cert Index is
// specified.  Expired and revoked certs are still retrievable.
//
// wszPROPCERTSTATE:  Returns the Cert State for the passed Cert Index.
// Returns the Cert State for the most recent Cert Index if no Cert Index is
// specified.
// Values for wszPROPCERTSTATE (see certadm.h):
//   CA_DISP_REVOKED    // This Cert has been revoked.
//   CA_DISP_VALID      // This Cert is still valid
//   CA_DISP_INVALID    // This Cert has expired.
//   CA_DISP_ERROR      // Cert unavailable (placehholder in registry?)
//
// wszPROPCERTSUFFIX: Returns the Cert FileName Suffix for the passed Cert
// Index.  Returns the Cert FileName Suffix for the most recent Cert Index if
// no Cert Index is specified.
//
// wszPROPRAWCRL:  Returns the CRL for the passed Cert Index.  As with
// CCertRequest::GetCACertificate, it is an error to fetch a CRL for a Cert
// that reused keys.  In the above table, only "RawCRL.0", "RawCRL.1",
// "RawCRL.4", "RawCRL.6" & "RawCRL" are allowed.  "RawCRL" will fetch the most
// recent CRL.  Use the wszPROPCRLSTATE with a numeric Cert Index suffix to
// determine which CRLs are valid to fetch.  CA_DISP_ERROR indicates the
// CRL cannot be fetched.  CA_DISP_REVOKED and CA_DISP_INVALID CRLs are still
// retrievable via this method call.
//
// All of the other CRL-related property fetches are supported for all valid
// Cert Index values:
//
// wszPROPCRLINDEX:  Returns the CRL Index value for the passed Cert Index.
// Returns the CRL Index value for the most recent Cert Index if no Cert Index
// is specified.
//
// wszPROPCRLSTATE:  Returns the CRL State for the passed Cert Index.
// Returns the CRL State for the most recent Cert Index if no Cert Index is
// specified.
// Values for wszPROPCRLSTATE (see certadm.h):
//   CA_DISP_REVOKED    // All unexpired certs using this Cert's CRL have been
//                      // revoked.
//   CA_DISP_VALID      // This Cert is still publishing CRLs as needed.
//   CA_DISP_INVALID    // All certs using this Cert's CRL are expired.
//   CA_DISP_ERROR      // This Cert's CRL is managed by another Cert.
//
// wszPROPCRLSUFFIX: Returns the CRL FileName Suffix for the passed Cert Index.
// Returns the CRL FileName Suffix for the most recent Cert Index if no Cert
// Index is specified.


CACTX *g_aCAContext;		// allocated array of CACTXs
CACTX *g_pCAContextCurrent;	// current CACTX is last g_aCAContext element
CERT_CONTEXT const **g_rgKRACerts = NULL;
BSTR *g_rgstrKRAHashes = NULL;
DWORD g_cKRAHashes = 0;
DWORD g_cKRACertsRoundRobin = 0;
DWORD g_iKRACerts;  // Next KRA cert to be used by this CA
HRESULT g_hrKRALoad = S_OK;

DWORD g_cCAKeys;    // Total number of unique CA keys managed by this CA
DWORD g_cCACerts;   // Total number of CA certs managed by this CA
DWORD g_cKRACerts;  // Total number of KRA certs used by this CA

CAXCHGCTX *g_aCAXchgContext;	// allocated array of CAXCHGCTXs
CAXCHGCTX *g_pCAXchgContextCurrent;	// current CAXCHGCTX is last element
DWORD g_cCAXchgCerts;		// number of CA Xchg certs managed by this CA
HCERTSTORE g_hStoreCAXchg = NULL;
DWORD g_dwXchgProvType;
WCHAR *g_pwszXchgProvName = NULL;
ALG_ID g_XchgidAlg;
BOOL g_fXchgMachineKeyset;
DWORD g_dwXchgKeySize;

LONG g_lValidityPeriodCount = dwVALIDITYPERIODCOUNTDEFAULT_STANDALONE;
enum ENUM_PERIOD g_enumValidityPeriod = dwVALIDITYPERIODENUMDEFAULT;

enum ENUM_PERIOD g_enumCAXchgValidityPeriod = dwCAXCHGVALIDITYPERIODENUMDEFAULT;
LONG g_lCAXchgValidityPeriodCount = dwCAXCHGVALIDITYPERIODCOUNTDEFAULT;

enum ENUM_PERIOD g_enumCAXchgOverlapPeriod = dwCAXCHGOVERLAPPERIODENUMDEFAULT;
LONG g_lCAXchgOverlapPeriodCount = dwCAXCHGOVERLAPPERIODCOUNTDEFAULT;

typedef enum {
    ST_COUNTRY = 0,
    ST_ORGANIZATION,
    ST_ORGANIZATIONALUNIT,
    ST_COMMONNAME,
    ST_LOCALITY,
    ST_STATEORPROVINCE,
    ST_TITLE,
    ST_GIVENNAME,
    ST_INITIALS,
    ST_SURNAME,
    ST_DOMAINCOMPONENT,
    ST_EMAIL,
    ST_STREETADDRESS,
    ST_UNSTRUCTUREDNAME,
    ST_UNSTRUCTUREDADDRESS,
    ST_DEVICESERIALNUMBER,
    ST_NULL
};

typedef struct _SUBJECTTABLE
{
    WCHAR const         *pwszPropName;
    CHAR const          *pszObjId;
    WCHAR const * const *apwszAttributeName;
    DWORD                cchMax;
    DWORD                dwValueType;
    DWORD                dwSubjectTableValue;
} SUBJECTTABLE;


WCHAR const *apwszAttrCountry[] = {
    wszATTRCOUNTRY1,
    wszATTRCOUNTRY2,
    TEXT(szOID_COUNTRY_NAME),
    NULL
};

WCHAR const *apwszAttrOrg[] = {
    wszATTRORG1,
    wszATTRORG2,
    wszATTRORG3,
    TEXT(szOID_ORGANIZATION_NAME),
    NULL
};

WCHAR const *apwszAttrOrgUnit[] = {
    wszATTRORGUNIT1,
    wszATTRORGUNIT2,
    wszATTRORGUNIT3,
    wszATTRORGUNIT4,
    TEXT(szOID_ORGANIZATIONAL_UNIT_NAME),
    NULL
};

WCHAR const *apwszAttrCommonName[] = {
    wszATTRCOMMONNAME1,
    wszATTRCOMMONNAME2,
    TEXT(szOID_COMMON_NAME),
    NULL
};

WCHAR const *apwszAttrLocality[] = {
    wszATTRLOCALITY1,
    wszATTRLOCALITY2,
    TEXT(szOID_LOCALITY_NAME),
    NULL
};

WCHAR const *apwszAttrState[] = {
    wszATTRSTATE1,
    wszATTRSTATE2,
    wszATTRSTATE3,
    TEXT(szOID_STATE_OR_PROVINCE_NAME),
    NULL
};

WCHAR const *apwszAttrTitle[] = {
    wszATTRTITLE1,
    wszATTRTITLE2,
    TEXT(szOID_TITLE),
    NULL
};

WCHAR const *apwszAttrGivenName[] = {
    wszATTRGIVENNAME1,
    wszATTRGIVENNAME2,
    TEXT(szOID_GIVEN_NAME),
    NULL
};

WCHAR const *apwszAttrInitials[] = {
    wszATTRINITIALS1,
    wszATTRINITIALS2,
    TEXT(szOID_INITIALS),
    NULL
};

WCHAR const *apwszAttrSurName[] = {
    wszATTRSURNAME1,
    wszATTRSURNAME2,
    TEXT(szOID_SUR_NAME),
    NULL
};

WCHAR const *apwszAttrDomComp[] = {
    wszATTRDOMAINCOMPONENT1,
    wszATTRDOMAINCOMPONENT2,
    TEXT(szOID_DOMAIN_COMPONENT),
    NULL
};

WCHAR const *apwszAttrEMail[] = {
    wszATTREMAIL1,
    wszATTREMAIL2,
    TEXT(szOID_RSA_emailAddr),
    NULL
};

WCHAR const *apwszAttrStreetAddr[] = {
    wszATTRSTREETADDRESS1,
    wszATTRSTREETADDRESS2,
    TEXT(szOID_STREET_ADDRESS),
    NULL
};

WCHAR const *apwszAttrUnstructName[] = {
    wszATTRUNSTRUCTUREDNAME1,
    TEXT(szOID_RSA_unstructName),
    NULL
};

WCHAR const *apwszAttrUnstructAddr[] = {
    wszATTRUNSTRUCTUREDADDRESS1,
    TEXT(szOID_RSA_unstructAddr),
    NULL
};

WCHAR const *apwszAttrDeviceSerialNumber[] = {
    wszATTRDEVICESERIALNUMBER1,
    TEXT(szOID_DEVICE_SERIAL_NUMBER),
    NULL
};


SUBJECTTABLE const pkcs_subject[] =
{
    {
        // "Country",
	g_wszPropSubjectCountry,
        szOID_COUNTRY_NAME,
	apwszAttrCountry,
	cchCOUNTRYNAMEMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_COUNTRY,
    },
    {
        // "Organization",
	g_wszPropSubjectOrganization,
        szOID_ORGANIZATION_NAME,
	apwszAttrOrg,
	cchORGANIZATIONNAMEMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_ORGANIZATION,
    },
    {
        // "OrganizationalUnit",
	g_wszPropSubjectOrgUnit,
        szOID_ORGANIZATIONAL_UNIT_NAME,
	apwszAttrOrgUnit,
	cchORGANIZATIONALUNITNAMEMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_ORGANIZATIONALUNIT,
    },
    {
        // "CommonName",
	g_wszPropSubjectCommonName,
        szOID_COMMON_NAME,
	apwszAttrCommonName,
	cchCOMMONNAMEMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_COMMONNAME,
    },
    {
        // "Locality",
	g_wszPropSubjectLocality,
        szOID_LOCALITY_NAME,
	apwszAttrLocality,
	cchLOCALITYMANAMEMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_LOCALITY,
    },
    {
        // "StateOrProvince",
	g_wszPropSubjectState,
        szOID_STATE_OR_PROVINCE_NAME,
	apwszAttrState,
	cchSTATEORPROVINCENAMEMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_STATEORPROVINCE,
    },
    {
        // "Title",
        g_wszPropSubjectTitle,
        szOID_TITLE,
	apwszAttrTitle,
	cchTITLEMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_TITLE,
    },
    {
        // "GivenName",
        g_wszPropSubjectGivenName,
        szOID_GIVEN_NAME,
	apwszAttrGivenName,
	cchGIVENNAMEMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_GIVENNAME,
    },
    {
        // "Initials",
        g_wszPropSubjectInitials,
        szOID_INITIALS,
	apwszAttrInitials,
	cchINITIALSMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_INITIALS,
    },
    {
        // "SurName",
        g_wszPropSubjectSurName,
        szOID_SUR_NAME,
	apwszAttrSurName,
	cchSURNAMEMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_SURNAME,
    },
    {
        // "DomainComponent",
	g_wszPropSubjectDomainComponent,
        szOID_DOMAIN_COMPONENT,
	apwszAttrDomComp,
	cchDOMAINCOMPONENTMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_DOMAINCOMPONENT,
    },
    {
        // "EMail",
	g_wszPropSubjectEMail,
        szOID_RSA_emailAddr,
	apwszAttrEMail,
	cchEMAILMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_EMAIL,
    },
    {
        // "StreetAddress",
	g_wszPropSubjectStreetAddress,
        szOID_STREET_ADDRESS,
	apwszAttrStreetAddr,
	cchSTREETADDRESSMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_STREETADDRESS,
    },
    {
        // "UnstructuredName",
	g_wszPropSubjectUnstructuredName,
        szOID_RSA_unstructName,
	apwszAttrUnstructName,
	cchUNSTRUCTUREDNAMEMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_UNSTRUCTUREDNAME,
    },
    {
        // "UnstructuredAddress",
	g_wszPropSubjectUnstructuredAddress,
        szOID_RSA_unstructAddr,
	apwszAttrUnstructAddr,
	cchUNSTRUCTUREDADDRESSMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_UNSTRUCTUREDADDRESS,
    },
    {
        // "DeviceSerialNumber",
	g_wszPropSubjectDeviceSerialNumber,
        szOID_DEVICE_SERIAL_NUMBER,
	apwszAttrDeviceSerialNumber,
	cchDEVICESERIALNUMBERMAX,
        CERT_RDN_PRINTABLE_STRING,
        ST_DEVICESERIALNUMBER,
    },
    {
	NULL,
        NULL,
        NULL,
        0,
        0,
        ST_NULL,
    },
};

#define CSUBJECTTABLE (sizeof(pkcs_subject) / sizeof(pkcs_subject[0]))

SUBJECTTABLE const *pkcs_apSubject[CSUBJECTTABLE];
SUBJECTTABLE const **pkcs_ppSubjectLast;
BOOL pkcsfSubjectTemplate = FALSE;

WCHAR const g_wszCNXchgSuffix[] = wszCNXCHGSUFFIX;

WCHAR const g_wszNTAuth[]=L"ldap:///CN=Public Key Services,CN=Services,%s?cACertificate?one?cn=NTAuthCertificates";

#define SHA1_HASH_LENGTH    20

VOID
pkcsSetDistinguishedName(
    IN ICertDBRow *prow,
    IN DWORD dwTable,
    IN CERT_NAME_BLOB const *pSubject)
{
    DWORD cwc;
    WCHAR awcName[CCH_DBMAXTEXT_DN + 1];
    HRESULT hr;

    CSASSERT(PROPTABLE_REQUEST == dwTable || PROPTABLE_CERTIFICATE == dwTable);

    cwc = CertNameToStr(
		    X509_ASN_ENCODING,
		    const_cast<CERT_NAME_BLOB *>(pSubject),
		    CERT_X500_NAME_STR | CERT_NAME_STR_REVERSE_FLAG,
		    awcName,
		    ARRAYSIZE(awcName));
    if (0 != cwc && L'\0' != awcName[0])
    {
#if DBG_CERTSRV
	DWORD ReqId;

	prow->GetRowId(&ReqId);
	DBGPRINT((
            DBG_SS_CERTSRVI,
	    "%ws DN(%u): '%ws'\n",
	    PROPTABLE_REQUEST == dwTable? L"Request" : L"Certificate",
	    ReqId,
	    awcName));
#endif
	if (wcslen(awcName) == ARRAYSIZE(awcName) - 1)
	{
	    DBGPRINT((
		DBG_SS_CERTSRV,
		"pkcsSetDistinguishedName: possible DN truncation: %u chars: '%ws'\n",
		ARRAYSIZE(awcName) - 1,
		awcName));
	}
	hr = prow->SetProperty(
		g_wszPropSubjectDistinguishedName,
		PROPTYPE_STRING | PROPCALLER_SERVER | dwTable,
		MAXDWORD,
		(BYTE const *) awcName);
	_PrintIfError(hr, "SetProperty(DN)");
    }
}


WCHAR const *
PKCSMapAttributeName(
    OPTIONAL IN WCHAR const *pwszAttributeName,
    OPTIONAL IN CHAR const *pszObjId,
    OUT DWORD *pdwIndex,
    OUT DWORD *pcchMax)
{
    SUBJECTTABLE const *pSubjectTable;
    WCHAR const *pwszPropName = NULL;

    for (pSubjectTable = pkcs_subject; ; pSubjectTable++)
    {
	WCHAR const * const *ppwsz;

	if (NULL == pSubjectTable->pwszPropName)
	{
	    goto error;
	}
	if (NULL != pwszAttributeName)
	{
	    for (ppwsz = pSubjectTable->apwszAttributeName;
		 NULL != *ppwsz;
		 ppwsz++)
	    {
		if (0 == lstrcmpi(pwszAttributeName, *ppwsz))
		{
		    break;
		}
	    }
	    if (NULL != *ppwsz ||
		0 == lstrcmpi(pwszAttributeName, pSubjectTable->pwszPropName))
	    {
		break;
	    }
	}
	if (NULL != pszObjId &&
	    0 == strcmp(pszObjId, pSubjectTable->pszObjId))
	{
	    break;
	}
    }
    CSASSERT(NULL != pSubjectTable->pwszPropName);
    pwszPropName = pSubjectTable->pwszPropName;
    *pdwIndex = pSubjectTable->dwSubjectTableValue;
    *pcchMax = pSubjectTable->cchMax;

error:
    return(pwszPropName);
}


HRESULT
pkcsFindCAContext(
    IN DWORD iCert,		// MAXDWORD -> use current
    IN DWORD iKey,		// MAXDWORD -> use current
    OUT CACTX **ppCAContext)
{
    HRESULT hr = E_INVALIDARG;
    DWORD i;
    CACTX *pCAContext;

    *ppCAContext = NULL;

    // Lookup is either by cert index OR by key index, but not both or neither

    CSASSERT((MAXDWORD == iCert) ^ (MAXDWORD == iKey));

    if (MAXDWORD != iCert)
    {
	if ((~_16BITMASK & iCert) || iCert >= g_cCACerts)
	{
	    _JumpError(hr, error, "bad cert index");
	}
	*ppCAContext = &g_aCAContext[iCert];
	CSASSERT(iCert == (*ppCAContext)->iCert);
    }
    else
    {
	CSASSERT(MAXDWORD != iKey);

	if ((~_16BITMASK & iKey) || iKey >= g_cCAKeys)
	{
	    _JumpError(hr, error, "bad key index");
	}
	for (i = g_cCACerts; ; i--)
	{
	    if (0 == i)
	    {
		_JumpError(hr, error, "key index not found");
	    }
	    pCAContext = &g_aCAContext[i - 1];
	    if (iKey == pCAContext->iKey)
	    {
		*ppCAContext = pCAContext;
		break;
	    }
	}
    }
    hr = S_OK;		// found it!

error:
    return(hr);
}


// Returns Cert Index in *piCert on success.
//
// returned in *piCert:
//  If iCert input value is not MAXDWORD, validate & return iCert.
//  If iCert input value is MAXDWORD, return the most current Cert Index.

HRESULT
PKCSMapCertIndex(
    IN DWORD iCert,
    OUT DWORD *piCert,
    OUT DWORD *pState)
{
    HRESULT hr;
    CACTX *pCAContext;
    DBGCODE(DWORD iCertSave = iCert);

    *pState = CA_DISP_ERROR;
    if (MAXDWORD == iCert)
    {
	iCert = g_cCACerts - 1;
    }
    if (iCert >= g_cCACerts)
    {
	hr = E_INVALIDARG;
	_JumpError(hr, error, "bad CertIndex");
    }
    pCAContext = &g_aCAContext[iCert];
    PKCSVerifyCAState(pCAContext);

    *pState = CA_DISP_VALID;
    if (CTXF_CERTMISSING & pCAContext->Flags)
    {
	*pState = CA_DISP_ERROR;
    }
    else
    if (CTXF_REVOKED & pCAContext->Flags)
    {
	*pState = CA_DISP_REVOKED;
    }
    else
    if (CTXF_EXPIRED & pCAContext->Flags)
    {
	*pState = CA_DISP_INVALID;
    }
    *piCert = iCert;
    hr = S_OK;

error:
    DBGPRINT((
            DBG_SS_CERTSRVI,
	    "PKCSMapCertIndex(%u) --> %u, s=%u, hr=%x\n",
	    iCertSave,
	    *piCert,
	    *pState,
	    hr));
    return(hr);
}


// Returns Cert Index in *piCert and CRL Index in *piCRL on success.
//
// returned in *piCert:
//  If iCert input value is not MAXDWORD, validate iCert.  Look up the newest
//  Cert Index that uses the same key as the passed iCert.
//  If iCert input value is MAXDWORD, return the most current Cert Index.
//
// returned in *piCRL:
//  CRL index (same as Key Index)
//

HRESULT
PKCSMapCRLIndex(
    IN DWORD iCert,
    OUT DWORD *piCert,	// returns newest iCert w/matching iKey for passed iCert
    OUT DWORD *piCRL,
    OUT DWORD *pState)
{
    HRESULT hr;
    CACTX *pCAContext;
    CACTX *pCAContextNewest;
    DWORD i;
    DBGCODE(DWORD iCertSave = iCert);

    hr = PKCSMapCertIndex(iCert, piCert, pState);
    _JumpIfError(hr, error, "PKCSMapCertIndex");

    // Now we know *piCert is a valid Cert Index:

    pCAContext = &g_aCAContext[*piCert];
    *piCRL = pCAContext->iKey;

    // find the newest iCert with matching iKey

    for (i = *piCert + 1; i < g_cCACerts; i++)
    {
	if (*piCRL == g_aCAContext[i].iKey)
	{
	    *piCert = i;
	}
    }
    pCAContextNewest = &g_aCAContext[*piCert];

    if (CTXF_CRLZOMBIE & pCAContext->Flags)
    {
	*pState = CA_DISP_VALID;
    }
    else
    if (pCAContext->iCert != pCAContext->iKey)
    {
	*pState = CA_DISP_ERROR;
    }
    else
    if (CTXF_EXPIRED == ((CTXF_EXPIRED | CTXF_SKIPCRL) & pCAContextNewest->Flags))
    {
	*pState = CA_DISP_VALID;
    }
    hr = S_OK;

error:
    DBGPRINT((
            DBG_SS_CERTSRVI,
	    "PKCSMapCRLIndex(%u) --> %u, iCRL=%u, s=%u, hr=%x\n",
	    iCertSave,
	    *piCert,
	    *piCRL,
	    *pState,
	    hr));
    return(hr);
}


HRESULT
PKCSGetCACertStatusCode(
    IN DWORD iCert,
    OUT HRESULT *phrCAStatusCode)
{
    HRESULT hr;
    DWORD State;
    
    *phrCAStatusCode = E_FAIL;

    hr = PKCSMapCertIndex(iCert, &iCert, &State);
    _JumpIfError(hr, error, "PKCSMapCertIndex");

    *phrCAStatusCode = g_aCAContext[iCert].hrVerifyStatus;
    hr = S_OK;

error:
    return(hr);
}


HRESULT
PKCSGetCAState(
    IN BOOL fCertState,
    OUT BYTE *pb)
{
    HRESULT hr;
    DWORD i;

    for (i = 0; i < g_cCACerts; i++)
    {
	DWORD iCert;
	DWORD iCRL;
	DWORD State;

	if (fCertState)
	{
	    hr = PKCSMapCertIndex(i, &iCert, &State);
	    _JumpIfError(hr, error, "PKCSMapCertIndex");
	}
	else
	{
	    hr = PKCSMapCRLIndex(i, &iCert, &iCRL, &State);
	    _JumpIfError(hr, error, "PKCSMapCRLIndex");
	}
	CSASSERT(0 == (~0xff & State));
	*pb++ = (BYTE) State;
    }

error:
    return(hr);
}

inline DWORD MapHRESULTToKRADisposition(HRESULT hr)
{
    switch(hr)
    {

    case CERT_E_EXPIRED:    return KRA_DISP_EXPIRED;

    case CRYPT_E_NOT_FOUND: return KRA_DISP_NOTFOUND;

    case CRYPT_E_REVOKED:   return KRA_DISP_REVOKED;

    case S_OK:              return KRA_DISP_VALID;

    case CERT_E_UNTRUSTEDROOT:
    case CERT_E_CHAINING:   return KRA_DISP_UNTRUSTED;

    case ERROR_NOT_FOUND:   return KRA_DISP_NOTLOADED;

    default:                return KRA_DISP_INVALID;
    }
}


HRESULT
PKCSGetKRAState(
    IN DWORD cKRA,
    OUT BYTE *pb)
{
    HRESULT hr = S_OK;
    DWORD dwCount = 0, dwUsedCount;
    HCERTSTORE hKRAStore = NULL;
    CERT_CONTEXT const *pCertContext = NULL;

    hKRAStore = CertOpenStore(
        CERT_STORE_PROV_SYSTEM_W,
        X509_ASN_ENCODING,
        NULL,                   // hProv
        CERT_SYSTEM_STORE_LOCAL_MACHINE,
        wszKRA_CERTSTORE);
    _JumpIfError(hr, error, "CertOpenStore KRA");

    for (dwCount = 0, dwUsedCount = 0; dwCount < cKRA; dwCount++)
    {
        hr = myFindCACertByHashIndex(
			hKRAStore,
			g_wszSanitizedName,
			CSRH_CAKRACERT,
			dwCount,
			NULL,
			&pCertContext);
        if (S_OK == hr)
        {
            hr = myVerifyKRACertContext(
			    pCertContext,
			    (CRLF_REVCHECK_IGNORE_OFFLINE & g_dwCRLFlags)?
				CA_VERIFY_FLAGS_IGNORE_OFFLINE : 0);
            
            // check if the CA is using this cert (was able to 
            // load it last time it started)
            if(S_OK==hr)
            {
                hr = ERROR_NOT_FOUND;
                for(dwUsedCount=0; dwUsedCount< g_cKRACerts; dwUsedCount++)
                {
                    if(CertCompareCertificate(
                        X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
                        pCertContext->pCertInfo,
                        g_rgKRACerts[dwUsedCount]->pCertInfo))
                    {
                        // the CA is using this KRA cert
                        hr = S_OK;
                        break;
                    }
                }
            }
        }

        CSASSERT(0 == (~0xff & MapHRESULTToKRADisposition(hr)));
        pb[dwCount] = (BYTE)MapHRESULTToKRADisposition(hr);
        hr = S_OK;
        CertFreeCertificateContext(pCertContext);
        pCertContext = NULL;
    }

error:

    if(NULL != pCertContext)
    {
        CertFreeCertificateContext(pCertContext);
    }

    if (NULL != hKRAStore)
    {
        CertCloseStore(hKRAStore, CERT_CLOSE_STORE_CHECK_FLAG);
    }

    return hr;
}


HRESULT
pkcsSetRequestNameInfo(
    IN ICertDBRow *prow,
    IN CERT_NAME_BLOB const *pSubject,
    OPTIONAL IN WCHAR const *pwszCNSuffix,
    IN OUT DWORD *pdwRequestFlags,
    OUT BOOL *pfSubjectNameSet)
{
    HRESULT hr;
    CERT_RDN *prdn;
    CERT_RDN *prdnEnd;
    CERT_NAME_INFO *pNameInfo = NULL;
    WCHAR const *pwszPropName;
    DWORD cbNameInfo;
    DWORD dwIndex;
    DWORD cchMax;
    BYTE afSubjectTable[CSUBJECTTABLE];	// see PKCSParseAttributes note
    SUBJECTTABLE const *pSubjectTable;

    *pfSubjectNameSet = FALSE;
    ZeroMemory(&afSubjectTable, sizeof(afSubjectTable));
    CSASSERT(0 == FALSE);

    hr = prow->SetProperty(
		    g_wszPropSubjectRawName,
		    PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		    pSubject->cbData,
		    pSubject->pbData);
    _JumpIfError(hr, error, "SetProperty");

    pkcsSetDistinguishedName(prow, PROPTABLE_REQUEST, pSubject);

    if (!myDecodeName(
                X509_ASN_ENCODING,
		X509_UNICODE_NAME,
                pSubject->pbData,
                pSubject->cbData,
                CERTLIB_USE_LOCALALLOC,
                &pNameInfo,
                &cbNameInfo))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myDecodeName");
    }

    if (ENUM_TELETEX_ON == (ENUM_TELETEX_MASK & g_fForceTeletex))
    {
        *pdwRequestFlags |= CR_FLG_FORCETELETEX;
    }
    if (ENUM_TELETEX_UTF8 & g_fForceTeletex)
    {
        *pdwRequestFlags |= CR_FLG_FORCEUTF8;
    }

    for (
	prdn = pNameInfo->rgRDN, prdnEnd = &prdn[pNameInfo->cRDN];
	prdn < prdnEnd;
	prdn++)
    {
	CERT_RDN_ATTR *prdna;
	CERT_RDN_ATTR *prdnaEnd;

	for (
	    prdna = prdn->rgRDNAttr, prdnaEnd = &prdna[prdn->cRDNAttr];
	    prdna < prdnaEnd;
	    prdna++)
	{
	    CSASSERT(
		prdna->dwValueType == CERT_RDN_PRINTABLE_STRING ||
		prdna->dwValueType == CERT_RDN_UNICODE_STRING ||
		prdna->dwValueType == CERT_RDN_TELETEX_STRING ||
		prdna->dwValueType == CERT_RDN_IA5_STRING ||
		prdna->dwValueType == CERT_RDN_UTF8_STRING);

	    if (NULL == prdna->Value.pbData ||
		sizeof(WCHAR) > prdna->Value.cbData ||
		L'\0' == *(WCHAR *) prdna->Value.pbData)
	    {
		continue;
	    }

            if (CERT_RDN_TELETEX_STRING == prdna->dwValueType &&
                ENUM_TELETEX_AUTO == (ENUM_TELETEX_MASK & g_fForceTeletex))
            {
                *pdwRequestFlags |= CR_FLG_FORCETELETEX;
            }

	    pwszPropName = PKCSMapAttributeName(
					NULL,
					prdna->pszObjId,
					&dwIndex,
					&cchMax);
	    if (NULL != pwszPropName)
            {
                BOOL fCN;

		// CAPI null-terminates strings

                CSASSERT(
		 sizeof(WCHAR) * wcslen((WCHAR const *) prdna->Value.pbData) ==
		 prdna->Value.cbData);

		fCN = 0 == strcmp(szOID_COMMON_NAME, prdna->pszObjId);

		hr = PropSetAttributeProperty(
				prow,
				afSubjectTable[dwIndex], // fConcatenateRDNs
				PROPTABLE_REQUEST,
				cchMax,
				fCN? pwszCNSuffix : NULL,
				pwszPropName,
				(WCHAR const *) prdna->Value.pbData);
		if (HRESULT_FROM_WIN32(ERROR_BUFFER_OVERFLOW) == hr)
		{
		    hr = CERTSRV_E_BAD_REQUESTSUBJECT;
		}
		_JumpIfError(hr, error, "PropSetAttributeProperty");

		afSubjectTable[dwIndex] = TRUE;
		*pfSubjectNameSet = TRUE;

		if (fCN)
		{
		    pwszCNSuffix = NULL;
		}
            }
        }
    }
    hr = S_OK;

error:
    if (NULL != pNameInfo)
    {
	LocalFree(pNameInfo);
    }
    return(hr);
}


HRESULT
PKCSSetRequestFlags(
    IN ICertDBRow *prow,
    IN BOOL fSet,
    IN DWORD dwChange)
{
    HRESULT hr;
    DWORD dwOld;
    DWORD dwNew;
    DWORD cb;
    
    cb = sizeof(dwOld);
    hr = prow->GetProperty(
		g_wszPropRequestFlags,
		PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		&cb,
		(BYTE *) &dwOld);
    _JumpIfError(hr, error, "GetProperty");

    if (fSet)
    {
	dwNew = dwOld | dwChange;
    }
    else
    {
	dwNew = dwOld & ~dwChange;
    }

    if (dwOld != dwNew)
    {
	hr = prow->SetProperty(
		    g_wszPropRequestFlags,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		    sizeof(dwNew),
		    (BYTE const *) &dwNew);
	_JumpIfError(hr, error, "SetProperty(RequestFlags)");
    }

error:
    return(hr);
}


HRESULT
pkcsSetAttributeProperty(
    IN ICertDBRow *prow,
    IN WCHAR const *pwszName,
    IN WCHAR const *pwszValue,
    IN DWORD dwTable,
    IN BYTE afSubjectTable[],
    OUT BOOL *pfSubjectModified,
    OPTIONAL OUT BOOL *pfEnrollOnBehalfOf)
{
    HRESULT hr;
    WCHAR const *pwszPropName;
    DWORD dwIndex;
    DWORD cwcMax;
    BOOL fConcatenateRDNs;

    *pfSubjectModified = FALSE;
    if (NULL != pfEnrollOnBehalfOf)
    {
	*pfEnrollOnBehalfOf = FALSE;
    }

    // See if the attribute name can be mapped to a standard property.

    pwszPropName = PKCSMapAttributeName(pwszName, NULL, &dwIndex, &cwcMax);
    if (NULL != pwszPropName)
    {
	fConcatenateRDNs = afSubjectTable[dwIndex];
	afSubjectTable[dwIndex] = TRUE;
	*pfSubjectModified = TRUE;
    }
    else
    {
	pwszPropName = pwszName;
	cwcMax = MAXDWORD;
	fConcatenateRDNs = FALSE;
	dwTable = PROPTABLE_ATTRIBUTE;

	if (0 == lstrcmpi(g_wszPropRequesterName, pwszPropName))
	{
	    if (NULL == pfEnrollOnBehalfOf)
	    {
		hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
		_JumpError(hr, error, "NULL pfEnrollOnBehalfOf");
	    }
	    *pfEnrollOnBehalfOf = TRUE;
	    dwTable = PROPTABLE_REQUEST;
	}
    }
    hr = PropSetAttributeProperty(
			    prow,
			    fConcatenateRDNs,
			    dwTable,
			    cwcMax,
			    NULL,	// pwszSuffix
			    pwszPropName,
			    pwszValue);
    _JumpIfError(hr, error, "PropSetAttributeProperty");

error:
    return(hr);
}


// Note on Request Attribute and Subject RDN processing:
//
// Subject RDN strings and Request Attributes may be set several ways, in
// the following order.  Subsequent changes overwrite earlier changes, so the
// order implies precedence:
//
// - Subject in the inner PKCS10 (if no PKCS10 subject, then use the Subject
//	in the PKCS7 renewal cert)
// - the next outer PKCS7 or CMC Attributes 
// - ...
// - the most outer PKCS7 or CMC Attributes 
// - Request Attribute string passed with the request when first submitted
// - Policy Module may set subject RDNs in the certificate table
// - ICertAdmin::SetAttributes' Request Attribute string (if request pending)
//
// "PKCS7 or CMC Attributes" means either of the following:
// 1) Authenticated Attributes associated with a (non-CMC) PKCS7 signer info.
// 2) Tagged Attributes and/or RegInfo Control Attributes in a CMC request.
//
// None of the secured attributes listed in the registry (which is set to
// wszzDEFAULTSIGNEDATTRIBUTES by default) may be set unless the source is
// PKCS7 or CMC Attributes.
//
// The original request attribute string is stored in the RequestAttributes
// column in the request table.  It is never modified after that.  Individual
// request attribute values are parsed out of this string (when the request is
// submitted and when ICertAdmin::SetAttributes is called) and stored in a
// Subject RDN column of the request or certificate table if the attribute
// name matches an alias for a Subject RDN, or in a unique row in the
// attribute table otherwise.
//
// Individual Subject RDNs may be specified multiple times (multiple "OU",
// "CN", strings).  If all of the RDNs were set from the same source,
// they must be concatenated, but if some RDNs were specified from one source,
// then modified by another source, the previous set of RDNs should be
// overwritten by the new ones.  If the original Request Attribute string
// specified "CN:foo\nOU:ou2\nCN:bar", the two CN strings should be
// concatenated.  If one or more CN values are also specified later by a
// single call to ICertAdmin::SetAttributes, the original CN values should be
// overwritten by the new value(s).
//
// It is possible to have the CN strings specified by one source and the OU
// strings specified by another.
//
// Before the policy module gets control, all Subject RDN changes are written
// to the Request table.  Just before dispatching to the policy module, the
// Request Subject RDNs are copied to the Certificate Table RDNs.  The policy
// module may modify the Certificate Table RDNs only.
//
// If the request is made pending, ICertAdmin::SetAttributes may be used to
// modify request attributes and Certificate Table RDNs.
//
// The certificate Subject is constructed from the Certificate Table RDNs.

HRESULT
PKCSParseAttributes(
    IN ICertDBRow *prow,
    IN WCHAR const *pwszAttributes,
    IN BOOL fRegInfo,
    IN DWORD dwRDNTable,
    OPTIONAL OUT BOOL *pfEnrollOnBehalfOf)
{
    HRESULT hr;
    WCHAR *pwszDup = NULL;
    WCHAR *pwszBuf;
    WCHAR const *pwszName;
    WCHAR const *pwszValue;
    WCHAR const *pwszSecuredAttr;
    BYTE afSubjectTable[CSUBJECTTABLE];	// see PKCSParseAttributes note
    WCHAR *pwszNameAlloc = NULL;
    WCHAR *pwszValueAlloc = NULL;
    BOOL fSubjectModified = FALSE;

    if (NULL != pfEnrollOnBehalfOf)
    {
	*pfEnrollOnBehalfOf = FALSE;
    }
    if (NULL == pwszAttributes)
    {
	hr = S_OK;
        goto error;		// silently ignore empty string
    }

    hr = myDupString(pwszAttributes, &pwszDup);
    _JumpIfError(hr, error, "myDupString");

    pwszBuf = pwszDup;

    ZeroMemory(&afSubjectTable, sizeof(afSubjectTable));
    CSASSERT(0 == FALSE);

    while (TRUE)
    {
	hr = myParseNextAttribute(&pwszBuf, fRegInfo, &pwszName, &pwszValue);
	if (S_FALSE == hr)
	{
	    break;
	}
	_JumpIfError(hr, error, "myParseNextAttribute");

	if (fRegInfo)
	{
	    if (NULL != pwszNameAlloc)
	    {
		LocalFree(pwszNameAlloc);
		pwszNameAlloc = NULL;
	    }
	    if (NULL != pwszValueAlloc)
	    {
		LocalFree(pwszValueAlloc);
		pwszValueAlloc = NULL;
	    }
	    hr = myUncanonicalizeURLParm(pwszName, &pwszNameAlloc);
	    _JumpIfError(hr, error, "myUncanonicalizeURLParm");

	    hr = myUncanonicalizeURLParm(pwszValue, &pwszValueAlloc);
	    _JumpIfError(hr, error, "myUncanonicalizeURLParm");

	    pwszName = pwszNameAlloc;
	    pwszValue = pwszValueAlloc;
	}

	if (!fRegInfo)
	{
	    // Only set the attribute if it's not one of the attributes
	    // that is required to be secure.

	    for (pwszSecuredAttr = g_wszzSecuredAttributes;
		 NULL != pwszSecuredAttr && L'\0' != *pwszSecuredAttr;
		 pwszSecuredAttr += wcslen(pwszSecuredAttr) + 1)
	    {
		if (0 == lstrcmpi(pwszSecuredAttr, pwszName))
		{
		    break;
		}
	    }
	}

        if (fRegInfo || NULL == pwszSecuredAttr || L'\0' == *pwszSecuredAttr)
        {
	    BOOL fEnrollOnBehalfOf = FALSE;
	    BOOL fSubjectModifiedT = FALSE;

	    hr = pkcsSetAttributeProperty(
			prow,
			pwszName,
			pwszValue,
			dwRDNTable,
			afSubjectTable,
			&fSubjectModified,
			NULL != pfEnrollOnBehalfOf? &fEnrollOnBehalfOf : NULL);
	    _JumpIfError(hr, error, "PKCSSetRequestFlags");

	    if (fSubjectModifiedT)
	    {
		fSubjectModified = TRUE;
	    }
	    if (fEnrollOnBehalfOf)
	    {
		*pfEnrollOnBehalfOf = TRUE;
	    }
        }
    }
    if (fSubjectModified)
    {
	hr = PKCSSetRequestFlags(prow, FALSE, CR_FLG_SUBJECTUNMODIFIED);
	_JumpIfError(hr, error, "PKCSSetRequestFlags");
    }
    hr = S_OK;

error:
    if (NULL != pwszNameAlloc)
    {
	LocalFree(pwszNameAlloc);
    }
    if (NULL != pwszValueAlloc)
    {
	LocalFree(pwszValueAlloc);
    }
    if (NULL != pwszDup)
    {
        LocalFree(pwszDup);
    }
    return(hr);
}


HRESULT
pkcsSetAltSubjectNameExtension(
    IN ICertDBRow *prow,
    IN DWORD ExtFlags,
    IN CERT_EXTENSION const *rgExtension,
    IN DWORD cExtension,
    IN DWORD cAltSubjectExtension)
{
    HRESULT hr = S_OK;
    CERT_ALT_NAME_INFO **apInfo = NULL;
    DWORD i;
    DWORD j;
    DWORD cInfo = 0;
    DWORD cb;
    CERT_ALT_NAME_INFO ResultInfo;
    DWORD cbResult;
    BYTE *pbResult = NULL;

    ResultInfo.cAltEntry = 0;
    ResultInfo.rgAltEntry = NULL;

    apInfo = (CERT_ALT_NAME_INFO **) LocalAlloc(
			LMEM_FIXED,
			sizeof(CERT_ALT_NAME_INFO *) * cAltSubjectExtension);
    if (NULL == apInfo)
    {
        hr = E_OUTOFMEMORY;
        _JumpError(hr, error, "LocalAlloc");
    }

    // Decode all AltNames

    for (i = 0; i < cExtension; i++)
    {
        // This is an OID, generated by capi2, so we don't need to
        // do a case-insensitive comparison

        if (0 == strcmp(rgExtension[i].pszObjId, szOID_SUBJECT_ALT_NAME2))
        {
	    CSASSERT(cInfo < cAltSubjectExtension);

            // Decode to plain text

            if (!myDecodeObject(
		            X509_ASN_ENCODING,
		            X509_ALTERNATE_NAME,
		            rgExtension[i].Value.pbData,
		            rgExtension[i].Value.cbData,
		            CERTLIB_USE_LOCALALLOC,
		            (VOID **) &apInfo[cInfo],
		            &cb))
            {
		hr = myHLastError();
                _JumpError(hr, error, "myDecodeObject");
            }
            if (rgExtension[i].fCritical)
            {
                ExtFlags |= EXTENSION_CRITICAL_FLAG;
            }
            ResultInfo.cAltEntry += apInfo[cInfo]->cAltEntry;
            cInfo++;
        }
    }
    CSASSERT(cInfo == cAltSubjectExtension);

    ResultInfo.rgAltEntry = (CERT_ALT_NAME_ENTRY *) LocalAlloc(
			LMEM_FIXED,
			ResultInfo.cAltEntry * sizeof(CERT_ALT_NAME_ENTRY));
    if (NULL == ResultInfo.rgAltEntry)
    {
        hr = E_OUTOFMEMORY;
        _JumpIfError(hr, error, "LocalAlloc");
    }

    j = 0;
    for (i = 0; i < cInfo; i++)
    {
        CopyMemory(
		&ResultInfo.rgAltEntry[j],
		apInfo[i]->rgAltEntry,
		apInfo[i]->cAltEntry * sizeof(CERT_ALT_NAME_ENTRY));
        j += apInfo[i]->cAltEntry;
    }

    if (!myEncodeObject(
		    X509_ASN_ENCODING,
		    X509_ALTERNATE_NAME,
		    &ResultInfo,
		    0,
		    CERTLIB_USE_LOCALALLOC,
		    &pbResult,
		    &cbResult))
    {
	hr = myHLastError();
        _JumpError(hr, error, "myEncodeObject");
    }

    hr = PropSetExtension(
		    prow,
		    PROPTYPE_BINARY | PROPCALLER_REQUEST,
		    TEXT(szOID_SUBJECT_ALT_NAME2),
		    ExtFlags,
		    cbResult,
		    pbResult);
    _JumpIfError(hr, error, "PropSetExtension");

error:
    if (NULL != apInfo)
    {
        for (i = 0; i < cInfo; i++)
        {
            if (NULL != apInfo[i])
            {
                LocalFree(apInfo[i]);
            }
        }
        LocalFree(apInfo);
    }
    if (NULL != ResultInfo.rgAltEntry)
    {
        LocalFree(ResultInfo.rgAltEntry);
    }
    if (NULL != pbResult)
    {
        LocalFree(pbResult);
    }
    return(hr);
}


// Scan extension array, and merge all the AltSubjectName Extensions into one.

HRESULT
pkcsSetExtensions(
    IN ICertDBRow *prow,
    IN DWORD ExtFlags,
    IN CERT_EXTENSION const *rgExtension,
    IN DWORD cExtension)
{
    HRESULT hr;
    WCHAR *pwszObjId = NULL;
    CERT_EXTENSION const *pExt;
    CERT_EXTENSION const *pExtEnd;
    DWORD cAltSubjectExtension = 0;

    pExtEnd = &rgExtension[cExtension];
    for (pExt = rgExtension; pExt < pExtEnd; pExt++)
    {
	DWORD ExtFlagsT;

	if (EXTENSION_ORIGIN_RENEWALCERT == (EXTENSION_ORIGIN_MASK & ExtFlags))
	{
	    char const * const *ppszObjId;
	    static char const * const apszObjIdFilter[] = {
		szOID_CERTSRV_CA_VERSION,
		szOID_AUTHORITY_INFO_ACCESS,
		szOID_CRL_DIST_POINTS,
		szOID_AUTHORITY_KEY_IDENTIFIER2,
		szOID_SUBJECT_KEY_IDENTIFIER,
		NULL
	    };
	    for (ppszObjId = apszObjIdFilter; NULL != *ppszObjId; ppszObjId++)
	    {
		if (0 == strcmp(*ppszObjId, pExt->pszObjId))
		{
		    break;
		}
	    }
	    if (NULL != *ppszObjId)
	    {
		continue;		// skip this extension
	    }
	}

	if (NULL != pwszObjId)
	{
	    LocalFree(pwszObjId);
	    pwszObjId = NULL;
	}
	if (!ConvertSzToWsz(&pwszObjId, pExt->pszObjId, -1))
	{
	    hr = E_OUTOFMEMORY;
	    _JumpError(hr, error, "ConvertSzToWsz(ObjId)");
	}
	ExtFlagsT = ExtFlags;
	if (pExt->fCritical)
	{
	    ExtFlagsT |= EXTENSION_CRITICAL_FLAG;
	}

        // AltSubjectName needs to be merged, so we do that later.
        // This is an OID, generated by capi2, so we don't need to
        // do a case-insensitive comparison.

        if (0 == lstrcmp(pwszObjId, TEXT(szOID_SUBJECT_ALT_NAME2)))
        {
	    cAltSubjectExtension++;
            continue;
        }

	hr = PropSetExtension(
			prow,
			PROPTYPE_BINARY | PROPCALLER_REQUEST,
			pwszObjId,
			ExtFlagsT,
			pExt->Value.cbData,
			pExt->Value.pbData);
	_JumpIfError(hr, error, "PropSetExtension");

	DBGPRINT((
		DBG_SS_CERTSRVI,
		"PropSetExtension(%ws, f=%x, cb=%x, pb=%x)\n",
		pwszObjId,
		ExtFlagsT,
		pExt->Value.cbData,
		pExt->Value.pbData));
    }

    if (0 != cAltSubjectExtension)
    {
	hr = pkcsSetAltSubjectNameExtension(
					prow,
					ExtFlags,
					rgExtension,
					cExtension,
					cAltSubjectExtension);
	_JumpIfError(hr, error, "pkcsSetAltSubjectNameExtension");
    }
    hr = S_OK;

error:
    if (NULL != pwszObjId)
    {
	LocalFree(pwszObjId);
    }
    return(hr);
}


HRESULT
pkcsSetOSVersion(
    IN ICertDBRow *prow,
    IN CRYPT_ATTR_BLOB *pAttrBlob)
{
    HRESULT hr;
    CERT_NAME_VALUE *pOSVersionString = NULL;
    BSTR strVersion = NULL;
    DWORD cb;

    if (!myDecodeObject(
		    X509_ASN_ENCODING,
		    X509_ANY_STRING,
		    pAttrBlob->pbData,
		    pAttrBlob->cbData,
		    CERTLIB_USE_LOCALALLOC,
		    (VOID **) &pOSVersionString,
		    &cb))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myDecodeObject");
    }
    if (NULL != pOSVersionString)
    {
	if (!IS_CERT_RDN_CHAR_STRING(pOSVersionString->dwValueType))
	{
	    hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	    _JumpError(hr, error, "version string is numeric data");
	}

	// If it's an 8 bit string, convert it to UNICODE

	if (CERT_RDN_UNIVERSAL_STRING > pOSVersionString->dwValueType)
	{
	    // Pass byte count in to allocate enough characters for
	    // the converted Unicode string

	    strVersion = SysAllocStringLen(
					NULL,
					pOSVersionString->Value.cbData);

	    // This is expected to be only numbers and '.'s,

	    if (NULL == strVersion)
	    {
		hr = E_OUTOFMEMORY;
		_JumpError(hr, error, "SysAllocStringLen");
	    }
	    mbstowcs(
		strVersion,
		(char const *) pOSVersionString->Value.pbData,
		pOSVersionString->Value.cbData);
	}
	else if (CERT_RDN_BMP_STRING == pOSVersionString->dwValueType ||
		 CERT_RDN_UNICODE_STRING == pOSVersionString->dwValueType)
	{
	    strVersion = SysAllocStringLen(
		    (WCHAR *) pOSVersionString->Value.pbData,
		    pOSVersionString->Value.cbData/sizeof(WCHAR));
	    if (NULL == strVersion)
	    {
		hr = E_OUTOFMEMORY;
		_JumpError(hr, error, "SysAllocStringLen");
	    }
	}
	else
	{
	    hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	    _JumpError(hr, error, "unknown string type");
	}

	hr = prow->SetProperty(
			g_wszPropRequestOSVersion,
			PROPTYPE_STRING |
			    PROPCALLER_SERVER |
			    PROPTABLE_ATTRIBUTE,
			SysStringByteLen(strVersion),
			(BYTE *) strVersion);
	_JumpIfError(hr, error, "SetProperty");
    }
    hr = S_OK;

error:
    if (NULL != strVersion)
    {
	SysFreeString(strVersion);
    }
    if (NULL != pOSVersionString)
    {
	LocalFree(pOSVersionString);
    }
    return(hr);
}


HRESULT
pkcsSetCSPProvider(
    IN ICertDBRow *prow,
    IN CRYPT_ATTR_BLOB *pAttrBlob)
{
    HRESULT hr;
    CRYPT_CSP_PROVIDER *pccp = NULL;

    hr = myDecodeCSPProviderAttribute(
			    pAttrBlob->pbData,
			    pAttrBlob->cbData,
			    &pccp);
    _JumpIfError(hr, error, "myDecodeCSPProviderAttribute");

    if (NULL != pccp->pwszProviderName && L'\0' != *pccp->pwszProviderName)
    {
	hr = prow->SetProperty(
			g_wszPropRequestCSPProvider,
			PROPTYPE_STRING |
			    PROPCALLER_SERVER |
			    PROPTABLE_ATTRIBUTE,
			MAXDWORD,
			(BYTE const *) pccp->pwszProviderName);
	_JumpIfError(hr, error, "SetProperty");
    }
    hr = S_OK;

error:
    if (NULL != pccp)
    {
	LocalFree(pccp);
    }
    return(hr);
}


HRESULT
pkcsSetExtensionsFromAttributeBlob(
    IN ICertDBRow *prow,
    IN DWORD ExtFlags,
    IN CRYPT_ATTRIBUTE const *pAttrib)
{
    HRESULT hr;
    CRYPT_ATTR_BLOB *pAttrBlob;
    CERT_NAME_VALUE *pNameInfo = NULL;
    CERT_EXTENSIONS *pCertExtensions = NULL;
    DWORD cb;

    pAttrBlob = pAttrib->rgValue;
    while (TRUE)
    {
	if (NULL != pCertExtensions)
	{
	    LocalFree(pCertExtensions);
	    pCertExtensions = NULL;
	}
	if (myDecodeObject(
			X509_ASN_ENCODING,
			X509_EXTENSIONS,
			pAttrBlob->pbData,
			pAttrBlob->cbData,
			CERTLIB_USE_LOCALALLOC,
			(VOID **) &pCertExtensions,
			&cb))
	{
	    break;	// success
	}
	hr = myHLastError();

	// if we already decoded the attribute as a T61 string, or if it is
	// not a PKCS 9.14 attribute, fail -- we don't know what it contains.

	if (NULL != pNameInfo ||
	    0 != strcmp(pAttrib->pszObjId, szOID_RSA_certExtensions))
	{
	    _JumpError(hr, error, "myDecodeObject");
	}

	// Decode the attribute as a T61 string.  Some implementations wrap the
	// PKCS 9.14 extension array in an extra level of encoding as a Teletex
	// string.

	if (!myDecodeObject(
			X509_ASN_ENCODING,
			X509_ANY_STRING,
			pAttrBlob->pbData,
			pAttrBlob->cbData,
			CERTLIB_USE_LOCALALLOC,
			(VOID **) &pNameInfo,
			&cb))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "myDecodeObject");
	}

	// Loop again and try to decode the raw name blob as X509_EXTENSIONS.

	pAttrBlob = &pNameInfo->Value;
    }
    hr = pkcsSetExtensions(
		    prow,
		    EXTENSION_DISABLE_FLAG | ExtFlags,
		    pCertExtensions->rgExtension,
		    pCertExtensions->cExtension);
    _JumpIfError(hr, error, "pkcsSetExtensions(attributes)");

error:
    if (NULL != pNameInfo)
    {
	LocalFree(pNameInfo);
    }
    if (NULL != pCertExtensions)
    {
	LocalFree(pCertExtensions);
    }
    return(hr);
}


HRESULT
PKCSGetProperty(
    IN ICertDBRow *prow,
    IN WCHAR const *pwszPropName,
    IN DWORD Flags,
    OPTIONAL OUT DWORD *pcbData,
    OUT BYTE **ppbData)
{
    HRESULT hr;
    BYTE *pbData = NULL;
    DWORD cbData;

    if (NULL != pcbData)
    {
	*pcbData = 0;
    }
    *ppbData = NULL;

    cbData = 0;
    hr = prow->GetProperty(pwszPropName, Flags, &cbData, pbData);
    _JumpIfError2(hr, error, "GetProperty", CERTSRV_E_PROPERTY_EMPTY);

    pbData = (BYTE *) LocalAlloc(LMEM_FIXED, cbData);
    if (NULL == pbData)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }
    hr = prow->GetProperty(pwszPropName, Flags, &cbData, pbData);
    _JumpIfError(hr, error, "GetProperty");

    if (NULL != pcbData)
    {
	*pcbData = cbData;
    }
    *ppbData = pbData;
    pbData = NULL;

error:
    if (NULL != pbData)
    {
	LocalFree(pbData);
    }
    return(hr);
}


VOID
pkcsFreePublicKeyInfo(
    IN OUT CERT_PUBLIC_KEY_INFO *pPublicKeyInfo)
{
    if (NULL != pPublicKeyInfo->Algorithm.pszObjId)
    {
	LocalFree(pPublicKeyInfo->Algorithm.pszObjId);
    }
    if (NULL != pPublicKeyInfo->Algorithm.Parameters.pbData)
    {
	LocalFree(pPublicKeyInfo->Algorithm.Parameters.pbData);
    }
    if (NULL != pPublicKeyInfo->PublicKey.pbData)
    {
	LocalFree(pPublicKeyInfo->PublicKey.pbData);
    }
    ZeroMemory(pPublicKeyInfo, sizeof(*pPublicKeyInfo));
}


HRESULT
pkcsGetPublicKeyInfo(
    IN ICertDBRow *prow,
    OUT CERT_PUBLIC_KEY_INFO *pPublicKeyInfo)
{
    HRESULT hr;
    WCHAR *pwszObjId = NULL;

    ZeroMemory(pPublicKeyInfo, sizeof(*pPublicKeyInfo));
    hr = PKCSGetProperty(
		    prow,
		    g_wszPropCertificatePublicKeyAlgorithm,
		    PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		    NULL,
		    (BYTE **) &pwszObjId);
    _JumpIfError(hr, error, "PKCSGetProperty");

    if (!ConvertWszToSz(&pPublicKeyInfo->Algorithm.pszObjId, pwszObjId, -1))
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "ConvertWszToSz(AlgObjId)");
    }

    hr = PKCSGetProperty(
		prow,
		g_wszPropCertificateRawPublicKeyAlgorithmParameters,
		PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		&pPublicKeyInfo->Algorithm.Parameters.cbData,
		&pPublicKeyInfo->Algorithm.Parameters.pbData);
    if (CERTSRV_E_PROPERTY_EMPTY != hr)
    {
	_JumpIfError(hr, error, "PKCSGetProperty");
    }

    hr = PKCSGetProperty(
		prow,
		g_wszPropCertificateRawPublicKey,
		PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		&pPublicKeyInfo->PublicKey.cbData,
		&pPublicKeyInfo->PublicKey.pbData);
    _JumpIfError(hr, error, "PKCSGetProperty");

error:
    if (S_OK != hr)
    {
	pkcsFreePublicKeyInfo(pPublicKeyInfo);
    }
    if (NULL != pwszObjId)
    {
	LocalFree(pwszObjId);
    }
    return(hr);
}


HRESULT
pkcsEncryptPrivateKey(
    IN BYTE *pbDecrypted,
    IN DWORD cbDecrypted,
    OUT BYTE **ppbEncrypted,
    OUT DWORD *pcbEncrypted,
    OUT WCHAR **ppwszKRAHashes)
{
    HRESULT hr;
    DWORD i;
    DWORD iKRACert;
    DWORD cwc;
    WCHAR *pwszKRAHashes = NULL;
    CERT_CONTEXT const **rgKRACerts = NULL;
    static bool fUseCAProv = true;

    *ppbEncrypted = NULL;
    *ppwszKRAHashes = NULL;

    CSASSERT(
	NULL != g_rgKRACerts &&
	0 != g_cKRACerts &&
	0 != g_cKRACertsRoundRobin &&
	NULL != g_rgstrKRAHashes);

    for (cwc = 0, i = 0; i < g_cKRACertsRoundRobin; i++)
    {
	iKRACert = (g_iKRACerts + i) % g_cKRACerts;
	cwc += wcslen(g_rgstrKRAHashes[iKRACert]) + 1;
    }
    pwszKRAHashes = (WCHAR *) LocalAlloc(LMEM_FIXED, cwc * sizeof(WCHAR));
    if (NULL == pwszKRAHashes)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }

    rgKRACerts = (CERT_CONTEXT const **) LocalAlloc(
				LMEM_FIXED,
				g_cKRACertsRoundRobin * sizeof(rgKRACerts[0]));
    if (NULL == rgKRACerts)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }

    pwszKRAHashes[0] = L'\0';
    for (i = 0; i < g_cKRACertsRoundRobin; i++)
    {
	iKRACert = (g_iKRACerts + i) % g_cKRACerts;
	rgKRACerts[i] = g_rgKRACerts[iKRACert];
	if (0 != i)
	{
	    wcscat(pwszKRAHashes, L"\n");
	}
	wcscat(pwszKRAHashes, g_rgstrKRAHashes[iKRACert]);
    }
    CSASSERT(wcslen(pwszKRAHashes) + 1 == cwc);

    hr = myCryptEncryptMessage(
			CALG_3DES,
			g_cKRACertsRoundRobin,	// cCertRecipient
			rgKRACerts,		// rgCertRecipient
			pbDecrypted,
			cbDecrypted,
			fUseCAProv? g_pCAContextCurrent->hProvCA : NULL,
			ppbEncrypted,
			pcbEncrypted);
    if (FAILED(hr) && fUseCAProv)
    {
        // Failed to use the CA HCRYPTPROV, fall back to
        // default
        fUseCAProv = false;
        hr = myCryptEncryptMessage(
			    CALG_3DES,
			    g_cKRACertsRoundRobin,	// cCertRecipient
			    rgKRACerts,			// rgCertRecipient
			    pbDecrypted,
			    cbDecrypted,
			    NULL,
			    ppbEncrypted,
			    pcbEncrypted);
    }
    _JumpIfError(hr, error, "myCryptEncryptMessage");

    *ppwszKRAHashes = pwszKRAHashes;
    pwszKRAHashes = NULL;

error:
    if (NULL != pwszKRAHashes)
    {
	LocalFree(pwszKRAHashes);
    }
    if (NULL != rgKRACerts)
    {
	LocalFree(rgKRACerts);
    }
    return(hr);
}


HRESULT
PKCSArchivePrivateKey(
    IN ICertDBRow *prow,
    IN BOOL fV1Cert,
    IN BOOL fOverwrite,
    IN CRYPT_ATTR_BLOB const *pBlobEncrypted,
    OPTIONAL IN OUT CERTSRV_RESULT_CONTEXT *pResult)
{
    HRESULT hr;
    BYTE *pbDecrypted = NULL;
    DWORD cbDecrypted;
    BYTE *pbEncrypted = NULL;
    DWORD cbEncrypted;
    DWORD iCertSig;
    BYTE *pbCert;	// do not free!
    DWORD cbCert;
    WCHAR *pwszKRAHashes = NULL;
    CERT_PUBLIC_KEY_INFO PublicKeyInfo;
    WCHAR *pwszUserName = NULL;
    DWORD cb;
    BYTE *pbKeyHash = NULL;
    DWORD cbKeyHash;

    ZeroMemory(&PublicKeyInfo, sizeof(PublicKeyInfo));

    if (0 == g_cKRACerts)
    {
	if (0 == g_cKRAHashes)
	{
	    hr = CERTSRV_E_KEY_ARCHIVAL_NOT_CONFIGURED;
	}
	else
	{
	    hr = CERTSRV_E_NO_VALID_KRA;
	}
	_JumpError(hr, error, "no KRA encryption certs");
    }

    if (NULL != pResult)
    {
	if (NULL == pResult->pbKeyHashIn)
	{
	    if (0 == (CRLF_ACCEPT_OLDRFC_CMC & g_dwCRLFlags))
	    {
                hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
                _JumpError(hr, error, "missing encrypted key hash");
	    }
	}
	else
	{
	    hr = myCalculateKeyArchivalHash(
				pBlobEncrypted->pbData,
				pBlobEncrypted->cbData,
				&pbKeyHash,
				&cbKeyHash);
	    _JumpIfError(hr, error, "myCalculateKeyArchivalHash");

	    if (pResult->cbKeyHashIn != cbKeyHash ||
		0 != memcmp(pResult->pbKeyHashIn, pbKeyHash, cbKeyHash))
	    {
		hr = S_OK;
		_JumpError(S_FALSE, error, "Ignoring key: hash mismatch");
	    }
	}
    }
    hr = prow->GetProperty(
		    g_wszPropRequestRawArchivedKey,
		    PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		    &cb,
		    NULL);
    if (CERTSRV_E_PROPERTY_EMPTY != hr)
    {
	if (S_OK == hr && !fOverwrite)
	{
	    hr = HRESULT_FROM_WIN32(ERROR_OBJECT_ALREADY_EXISTS);
	}
	_JumpIfError2(
		hr,
		error,
		"GetProperty",
		HRESULT_FROM_WIN32(ERROR_OBJECT_ALREADY_EXISTS));
    }

    hr = PKCSGetProperty(
		prow,
		g_wszPropRequesterName,
		PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		NULL,
		(BYTE **) &pwszUserName);
    _JumpIfError(hr, error, "PKCSGetProperty");

    if (NULL == g_hStoreCAXchg)
    {
	hr = PKCSGetCAXchgCert(0, pwszUserName, &iCertSig, &pbCert, &cbCert);
	_JumpIfError(hr, error, "PKCSGetCAXchgCert");
    }
    CSASSERT(NULL != g_hStoreCAXchg);
    hr = myCryptDecryptMessage(
		    g_hStoreCAXchg,
		    pBlobEncrypted->pbData,
		    pBlobEncrypted->cbData,
		    CERTLIB_USE_LOCALALLOC,
		    &pbDecrypted,
		    &cbDecrypted);
    _JumpIfError(hr, error, "myCryptDecryptMessage");

    DBGDUMPHEX((DBG_SS_CERTSRVI, 0, pbDecrypted, cbDecrypted));

    hr = pkcsGetPublicKeyInfo(prow, &PublicKeyInfo);
    _JumpIfError(hr, error, "pkcsGetPublicKeyInfo");

    hr = myValidateKeyBlob(
			pbDecrypted,
			cbDecrypted,
			&PublicKeyInfo,
			fV1Cert,
			NULL);
    _JumpIfError(hr, error, "myValidateKeyBlob");

    hr = pkcsEncryptPrivateKey(
			pbDecrypted,
			cbDecrypted,
			&pbEncrypted,
			&cbEncrypted,
			&pwszKRAHashes);
    _JumpIfError(hr, error, "pkcsEncryptPrivateKey");

    hr = prow->SetProperty(
		    g_wszPropRequestRawArchivedKey,
		    PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		    cbEncrypted,
		    pbEncrypted);
    _JumpIfError(hr, error, "PKCSArchivePrivateKey:SetProperty");

    hr = prow->SetProperty(
		    g_wszPropRequestKeyRecoveryHashes,
		    PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		    MAXDWORD,
		    (BYTE const *) pwszKRAHashes);
    _JumpIfError(hr, error, "SetProperty");

    if (NULL != pResult && NULL == pResult->pbKeyHashOut)
    {
	pResult->pbKeyHashOut = pbKeyHash;
	pResult->cbKeyHashOut = cbKeyHash;
	pbKeyHash = NULL;
    }

    {
	CertSrv::CAuditEvent audit(SE_AUDITID_CERTSRV_KEYARCHIVED, g_dwAuditFilter);
	DWORD dwRequestID = 0;
	DWORD cb = sizeof(DWORD);

	if (audit.IsEventEnabled())
	{
	    hr = prow->GetProperty(
			g_wszPropRequestRequestID,
			PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
			&cb,
			(BYTE *)&dwRequestID);
	    _JumpIfError(hr, error, "Report");

	    hr = audit.AddData(dwRequestID); // %1 request ID
	    _JumpIfError(hr, error, "CAuditEvent::AddData");

	    hr = audit.AddData(pwszUserName); // %2 requester
	    _JumpIfError(hr, error, "CAuditEvent::AddData");

	    hr = audit.AddData(pwszKRAHashes);// %3 KRA hashes
	    _JumpIfError(hr, error, "CAuditEvent::AddData");

	    hr = audit.Report();
	    _JumpIfError(hr, error, "Report");
	}
    }

error:
    pkcsFreePublicKeyInfo(&PublicKeyInfo);
    if (NULL != pbDecrypted)
    {
	ZeroMemory(pbDecrypted, cbDecrypted);	// Private Key Material!
	LocalFree(pbDecrypted);
    }
    if (NULL != pbEncrypted)
    {
	LocalFree(pbEncrypted);
    }
    if (NULL != pwszKRAHashes)
    {
	LocalFree(pwszKRAHashes);
    }
    if (NULL != pwszUserName)
    {
	LocalFree(pwszUserName);
    }
    if (NULL != pbKeyHash)
    {
	LocalFree(pbKeyHash);
    }
    return(hr);
}


HRESULT
pkcsSaveRequestWithoutArchivedKey(
    IN ICertDBRow *prow,
    IN DWORD cbIn,
    IN BYTE const *pbIn)
{
    HRESULT hr;
    HCRYPTMSG hMsg = NULL;
    DWORD cSigner;
    DWORD iSigner;
    DWORD i;
    DWORD cb;
    BYTE *pbWithoutKey = NULL;
    DWORD cbWithoutKey;
    CRYPT_ATTRIBUTES *pAttrib = NULL;
    BOOL fKeyDeleted = FALSE;

    hMsg = CryptMsgOpenToDecode(
			    PKCS_7_ASN_ENCODING | X509_ASN_ENCODING,
			    0,			// dwFlags
			    0,			// dwMsgType
			    NULL,		// hCryptProv
			    NULL,		// pRecipientInfo
			    NULL);		// pStreamInfo
    if (NULL == hMsg)
    {
	hr = myHLastError();
	_JumpError(hr, error, "CryptMsgOpenToDecode");
    }

    if (!CryptMsgUpdate(hMsg, pbIn, cbIn, TRUE))
    {
	hr = myHLastError();
	_JumpError(hr, error, "CryptMsgUpdate");
    }

    cb = sizeof(cSigner);
    if (!CryptMsgGetParam(
		    hMsg,
		    CMSG_SIGNER_COUNT_PARAM,
		    0,
		    &cSigner,
		    &cb))
    {
	hr = myHLastError();
	_JumpError(hr, error, "CryptMsgGetParam(signer count)");
    }

    DBGPRINT((DBG_SS_CERTSRV, "cSigner=%u\n", cSigner));

    for (iSigner = 0; iSigner < cSigner; iSigner++)
    {
	hr = myCryptMsgGetParam(
			    hMsg,
			    CMSG_SIGNER_UNAUTH_ATTR_PARAM,
			    iSigner,		// dwIndex
                            CERTLIB_USE_LOCALALLOC,
			    (VOID **) &pAttrib,
			    &cb);
	_PrintIfError2(hr, "myCryptMsgGetParam(content)", hr);
	if (S_FALSE == hr)
	{
	    continue;
	}
	_JumpIfError(hr, error, "myCryptMsgGetParam(content)");

	DBGPRINT((
	    DBG_SS_CERTSRV,
	    "iSigner=%u, cAttr=%u\n",
	    iSigner,
	    pAttrib->cAttr));

	// Loop through deleting attributes from the end to avoid invalidated
	// indexes, which may result from deleting earlier attributes.

	for (i = 0; i < pAttrib->cAttr; i++)
	{
	    CMSG_CTRL_DEL_SIGNER_UNAUTH_ATTR_PARA DelPara;
	    DWORD iAttr = pAttrib->cAttr - i - 1;

	    DBGPRINT((
		DBG_SS_CERTSRV,
		"iSigner=%u, iAttr=%u %hs\n",
		iSigner,
		iAttr,
		pAttrib->rgAttr[iAttr].pszObjId));
	    if (0 == strcmp(
			pAttrib->rgAttr[iAttr].pszObjId,
			szOID_ARCHIVED_KEY_ATTR))
	    {
		ZeroMemory(&DelPara, sizeof(DelPara));
		DelPara.cbSize = sizeof(DelPara);
		DelPara.dwSignerIndex = iSigner;
		DelPara.dwUnauthAttrIndex = iAttr;

		DBGPRINT((
		    DBG_SS_CERTSRV,
		    "Delete Key(signer=%u, attrib=%u)\n",
		    DelPara.dwSignerIndex,
		    DelPara.dwUnauthAttrIndex));

		if (!CryptMsgControl(
				hMsg,
				0,
				CMSG_CTRL_DEL_SIGNER_UNAUTH_ATTR,
				&DelPara))
		{
		    hr = myHLastError();
		    _PrintError(hr, "CryptMsgControl");
		}
		fKeyDeleted = TRUE;
	    }
	}
	LocalFree(pAttrib);
	pAttrib = NULL;
    }
    if (!fKeyDeleted)
    {
	hr = S_FALSE;
	_JumpError(hr, error, "no Encrypted Key attribute");
    }

    hr = myCryptMsgGetParam(
			hMsg,
			CMSG_ENCODED_MESSAGE,
			0,		// dwIndex
                        CERTLIB_USE_LOCALALLOC,
			(VOID **) &pbWithoutKey,
			&cbWithoutKey);
    _JumpIfError(hr, error, "myCryptMsgGetParam(content)");

    hr = prow->SetProperty(
		    g_wszPropRequestRawRequest,
		    PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		    cbWithoutKey,
		    pbWithoutKey);
    _JumpIfError(hr, error, "SetProperty(request)");

error:
    if (NULL != pAttrib)
    {
	LocalFree(pAttrib);
    }
    if (NULL != pbWithoutKey)
    {
	LocalFree(pbWithoutKey);
    }
    if (NULL != hMsg)
    {
	CryptMsgClose(hMsg);
    }
    return(hr);
}


#define PSA_DISALLOW_EXTENSIONS		0x00000001
#define PSA_DISALLOW_NAMEVALUEPAIRS	0x00000002
#define PSA_DISALLOW_ARCHIVEDKEY	0x00000004

HRESULT
pkcsSetAttributes(
    IN ICertDBRow *prow,
    IN DWORD ExtFlags,
    IN DWORD dwDisallowFlags,
    IN CRYPT_ATTRIBUTE const *rgAttrib,
    IN DWORD cAttrib,
    IN DWORD cbRequest,
    OPTIONAL IN BYTE const *pbRequest,
    OPTIONAL OUT BOOL *pfEnrollOnBehalfOf,
    IN OUT CERTSRV_RESULT_CONTEXT *pResult)
{
    HRESULT hr;
    CRYPT_ATTRIBUTE const *pAttrib;
    CRYPT_ATTRIBUTE const *pAttribEnd;
    DWORD i;
    BYTE afSubjectTable[CSUBJECTTABLE];	// see PKCSParseAttributes note
    CRYPT_DATA_BLOB *pBlob = NULL;
    BOOL fSubjectModified = FALSE;

    ZeroMemory(&afSubjectTable, sizeof(afSubjectTable));
    CSASSERT(0 == FALSE);

    if (NULL != pfEnrollOnBehalfOf)
    {
	*pfEnrollOnBehalfOf = FALSE;
    }

    pAttribEnd = &rgAttrib[cAttrib];
    for (pAttrib = rgAttrib; pAttrib < pAttribEnd; pAttrib++)
    {
        if (0 == strcmp(pAttrib->pszObjId, szOID_OS_VERSION))
        {
            if (1 != pAttrib->cValue)
            {
                hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
                _JumpError(hr, error, "Attribute Value count != 1");
            }
	    hr = pkcsSetOSVersion(prow, pAttrib->rgValue);
	    _JumpIfError(hr, error, "pkcsSetOSVersion");
        }
        else
	if (0 == strcmp(pAttrib->pszObjId, szOID_ENROLLMENT_CSP_PROVIDER))
        {
            // Check to see if we have a CSPPROVIDER attribute.  We use this in
            // the policy module to determine if xenroll generated the request,
	    // so we can behave differently for old xenroll requests (put the
	    // UPN in the subject to avoid enrollment loops)

            if (1 != pAttrib->cValue)
            {
                hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
                _JumpError(hr, error, "Attribute Value count != 1");
            }
	    hr = pkcsSetCSPProvider(prow, pAttrib->rgValue);
	    _JumpIfError(hr, error, "pkcsSetCSPProvider");
        }
        else
	if (0 == strcmp(pAttrib->pszObjId, szOID_ENCRYPTED_KEY_HASH))
        {
	    DWORD cb;
	    
	    if (NULL != pResult->pbKeyHashIn || NULL != pBlob)
	    {
		hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
                _JumpError(hr, error, "Multiple key hashes");
	    }
            if (1 != pAttrib->cValue)
            {
                _JumpError(hr, error, "Attribute Value count != 1");
            }
	    if (!myDecodeObject(
			    X509_ASN_ENCODING,
			    X509_OCTET_STRING,
			    pAttrib->rgValue[0].pbData,
			    pAttrib->rgValue[0].cbData,
			    CERTLIB_USE_LOCALALLOC,
			    (VOID **) &pBlob,
			    &cb))
	    {
		hr = myHLastError();
		_JumpError(hr, error, "myDecodeObject");
	    }
	    pResult->pbKeyHashIn = (BYTE *) LocalAlloc(
						LMEM_FIXED,
						pBlob->cbData);
	    if (NULL == pResult->pbKeyHashIn)
	    {
		hr = E_OUTOFMEMORY;
		_JumpError(hr, error, "LocalAlloc");
	    }
	    CopyMemory(pResult->pbKeyHashIn, pBlob->pbData, pBlob->cbData);
	    pResult->cbKeyHashIn = pBlob->cbData;
	}
        else
	if (0 == strcmp(pAttrib->pszObjId, szOID_ARCHIVED_KEY_ATTR))
        {
	    // Pull encrypted private key out of the attribute for archival.
	    //
	    // Save request in database without private key now, to keep the
	    // error path from saving the request later *with* the key.

	    if (NULL != pbRequest)
	    {
		hr = pkcsSaveRequestWithoutArchivedKey(
						prow,
						cbRequest,
						pbRequest);
		_PrintIfError(hr, "pkcsSaveRequestWithoutArchivedKey");
		if (S_OK == hr)
		{
		    pResult->fKeyArchived = TRUE;
		}
	    }

	    hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	    if (PSA_DISALLOW_ARCHIVEDKEY & dwDisallowFlags)
	    {
		hr = CERTSRV_E_BAD_REQUEST_KEY_ARCHIVAL;
		_JumpError(hr, error, "archived key disallowed");
	    }
            if (1 != pAttrib->cValue)
            {
                _JumpError(hr, error, "Attribute Value count != 1");
            }
	    hr = PKCSArchivePrivateKey(
				prow,
				FALSE,
				FALSE,
				&pAttrib->rgValue[0],
				pResult);
	    _JumpIfError(hr, error, "PKCSArchivePrivateKey");
        }
	else
	if (0 == strcmp(pAttrib->pszObjId, szOID_CERT_EXTENSIONS) ||
	    0 == strcmp(pAttrib->pszObjId, szOID_RSA_certExtensions))
        {
	    hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	    if (PSA_DISALLOW_EXTENSIONS & dwDisallowFlags)
            {
                _JumpError(hr, error, "extensions disallowed");
            }
            if (1 != pAttrib->cValue)
            {
                _JumpError(hr, error, "Attribute Value count != 1");
            }
	    hr = pkcsSetExtensionsFromAttributeBlob(
						prow,
						ExtFlags,
						pAttrib);
	    _JumpIfError(hr, error, "pkcsSetExtensionsFromAttributeBlob");
	}
	else
	if (0 == strcmp(pAttrib->pszObjId, szOID_ENROLLMENT_NAME_VALUE_PAIR))
	{
	    // Can't apply name value pair attributes to a renewal or CMC

	    if (PSA_DISALLOW_NAMEVALUEPAIRS & dwDisallowFlags)
	    {
		hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
		_JumpError(hr, error, "name/value pairs disallowed");
	    }

	    for (i = 0; i < pAttrib->cValue; i++)
	    {
		CRYPT_ENROLLMENT_NAME_VALUE_PAIR *pInfo = NULL;
		DWORD cbInfo = 0;
		CRYPT_ATTR_BLOB const *pvalue = &pAttrib->rgValue[i];

		WCHAR const *pwszPropName;
		BOOL fConcatenateRDNs;
		DWORD dwIndex;
		DWORD cchMax;
		DWORD dwTable;

		if (!myDecodeNameValuePair(
					X509_ASN_ENCODING,
					pvalue->pbData,
					pvalue->cbData,
					CERTLIB_USE_LOCALALLOC,
					&pInfo,
					&cbInfo))
		{
		    hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
		    _JumpError(hr, error, "myDecodeNameValuePair");

		    // if the attribute name & value are both non-empty ...
		}

		BOOL fEnrollOnBehalfOf = FALSE;
		BOOL fSubjectModifiedT = FALSE;

		hr = pkcsSetAttributeProperty(
			prow,
			pInfo->pwszName,
			pInfo->pwszValue,
			PROPTABLE_REQUEST,
			afSubjectTable,
			&fSubjectModified,
			NULL != pfEnrollOnBehalfOf? &fEnrollOnBehalfOf : NULL);
		if (fSubjectModifiedT)
		{
		    fSubjectModified = TRUE;
		}
		if (fEnrollOnBehalfOf)
		{
		    *pfEnrollOnBehalfOf = TRUE;
		}
		if (NULL != pInfo)
		{
		    LocalFree(pInfo);
		}
		_JumpIfError(hr, error, "pkcsSetAttributeProperty");
	    }
	}
	else
	{
	    DBGPRINT((
		DBG_SS_CERTSRVI,
		"Skipping authenticated attribute %hs\n",
		pAttrib->pszObjId));
	}
    }
    if (fSubjectModified)
    {
	hr = PKCSSetRequestFlags(prow, FALSE, CR_FLG_SUBJECTUNMODIFIED);
	_JumpIfError(hr, error, "PKCSSetRequestFlags");
    }
    hr = S_OK;

error:
    if (NULL != pBlob)
    {
	LocalFree(pBlob);
    }
    return(hr);
}


HRESULT
pkcsVerifyCertContext(
    OPTIONAL IN FILETIME const *pft,
    IN BOOL fTimeOnly,
    IN CERT_CONTEXT const *pcc)
{
    HRESULT hr;
    FILETIME ft;

    if (NULL == pft)
    {
	GetSystemTimeAsFileTime(&ft);
	pft = &ft;
    }
    if (0 > CompareFileTime(pft, &pcc->pCertInfo->NotBefore))
    {
	hr = CERT_E_EXPIRED;
	_JumpError(hr, error, "cert not yet valid");
    }
    if (0 < CompareFileTime(pft, &pcc->pCertInfo->NotAfter))
    {
	hr = CERT_E_EXPIRED;
	_JumpError(hr, error, "cert is expired");
    }
    if (!fTimeOnly)
    {
	hr = myVerifyCertContext(
			pcc,			// pCert
			(CRLF_REVCHECK_IGNORE_OFFLINE & g_dwCRLFlags)?
			    CA_VERIFY_FLAGS_IGNORE_OFFLINE : 0,	// dwFlags
			0,			// cUsageOids
			NULL,			// apszUsageOids
			HCCE_LOCAL_MACHINE,	// hChainEngine
			NULL,			// hAdditionalStore
			NULL);			// ppwszMissingIssuer
	_JumpIfError(hr, error, "myVerifyCertContext");
    }
    hr = S_OK;

error:
    return(hr);
}


HRESULT
pkcsSetValidityPeriod(
    IN ICertDBRow *prow,
    IN LONG lValidityPeriodCount,
    IN enum ENUM_PERIOD enumValidityPeriod)
{
    HRESULT hr;
    FILETIME ftNotBefore;
    FILETIME ftNotAfter;
    LONGLONG delta;
    CACTX *pCAContext = g_pCAContextCurrent;

    GetSystemTimeAsFileTime(&ftNotBefore);

    hr = pkcsVerifyCertContext(&ftNotBefore, TRUE, pCAContext->pccCA);
    _JumpIfErrorStr(hr, error, "pkcsVerifyCertContext", L"CA cert expired");

    ftNotAfter = ftNotBefore;

    // Set the start date to the current time minus clock skew.  But ensure the
    // new cert's start date is not before the CA certificate's start date.

    delta = g_dwClockSkewMinutes * CVT_MINUTES;
    myAddToFileTime(&ftNotBefore, -delta * CVT_BASE);

    if (0 > CompareFileTime(
			&ftNotBefore,
			&pCAContext->pccCA->pCertInfo->NotBefore))
    {
	ftNotBefore = pCAContext->pccCA->pCertInfo->NotBefore;
    }

    hr = prow->SetProperty(
		    g_wszPropCertificateNotBeforeDate,
		    PROPTYPE_DATE | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
                    sizeof(ftNotBefore),
                    (BYTE *) &ftNotBefore);
    _JumpIfError(hr, error, "pkcsSetValidityPeriod:SetProperty");

    // Set the end date to the start date plus the registry-configured
    // validity period.  Then clamp the new cert's end date to the CA
    // certificate's end date.

    myMakeExprDateTime(&ftNotAfter, lValidityPeriodCount, enumValidityPeriod);

    if (0 < CompareFileTime(
			&ftNotAfter,
			&pCAContext->pccCA->pCertInfo->NotAfter))
    {
	ftNotAfter = pCAContext->pccCA->pCertInfo->NotAfter;
    }

    hr = prow->SetProperty(
		    g_wszPropCertificateNotAfterDate,
		    PROPTYPE_DATE | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
                    sizeof(ftNotAfter),
                    (BYTE *) &ftNotAfter);
    _JumpIfError(hr, error, "pkcsSetValidityPeriod:SetProperty");

error:
    return(hr);
}


HRESULT
pkcsSetServerExtension(
    IN ICertDBRow *prow,
    IN WCHAR const *pwszObjId,
    IN DWORD cbExt,
    IN BYTE const *pbExt)
{
    HRESULT hr;
    BYTE *pbOld = NULL;
    DWORD cbOld;
    DWORD ExtFlags;

    ExtFlags = 0;
    if (NULL == pbExt)
    {
	CSASSERT(0 == cbExt);

	hr = PropGetExtension(
		    prow,
		    PROPTYPE_BINARY | PROPCALLER_SERVER,
		    pwszObjId,
		    &ExtFlags,
		    &cbOld,
		    &pbOld);
	if (S_OK != hr)
	{
	    ExtFlags = 0;
	}
	if (CERTSRV_E_PROPERTY_EMPTY != hr)
	{
	    ExtFlags |= EXTENSION_DISABLE_FLAG;
	}
    }
    if (NULL != pbExt || (EXTENSION_DISABLE_FLAG & ExtFlags))
    {
	ExtFlags &= ~EXTENSION_ORIGIN_MASK;
	ExtFlags |= EXTENSION_ORIGIN_SERVER;
	hr = PropSetExtension(
			prow,
			PROPTYPE_BINARY | PROPCALLER_SERVER,
			pwszObjId,
			ExtFlags,
			cbExt,
			pbExt);
	_JumpIfError(hr, error, "PropSetExtension");
    }
    hr = S_OK;

error:
    if (NULL != pbOld)
    {
	LocalFree(pbOld);
    }
    return(hr);
}


HRESULT
PKCSSetServerProperties(
    IN ICertDBRow *prow,
    IN LONG lValidityPeriodCount,
    IN enum ENUM_PERIOD enumValidityPeriod)
{
    HRESULT hr;
    CACTX *pCAContext = g_pCAContextCurrent;

    hr = pkcsSetServerExtension(
			prow,
			TEXT(szOID_AUTHORITY_KEY_IDENTIFIER2),
			pCAContext->KeyAuthority2Cert.cbData,
			pCAContext->KeyAuthority2Cert.pbData);
    _JumpIfError(hr, error, "pkcsSetServerExtension");

    hr = pkcsSetServerExtension(
			prow,
			TEXT(szOID_CRL_DIST_POINTS),
			pCAContext->CDPCert.cbData,
			pCAContext->CDPCert.pbData);
    _JumpIfError(hr, error, "pkcsSetServerExtension");

    hr = pkcsSetServerExtension(
			prow,
			TEXT(szOID_AUTHORITY_INFO_ACCESS),
			pCAContext->AIACert.cbData,
			pCAContext->AIACert.pbData);
    _JumpIfError(hr, error, "pkcsSetServerExtension");

    hr = pkcsSetValidityPeriod(prow, lValidityPeriodCount, enumValidityPeriod);
    _JumpIfError(hr, error, "pkcsSetValidityPeriod");

error:
    return(hr);
}


HRESULT
pkcsSetPublicKeyProperties(
    IN ICertDBRow *prow,
    IN CERT_PUBLIC_KEY_INFO const *pSubjectPublicKeyInfo)
{
    HRESULT hr;
    WCHAR *pwszExtensionName;
    WCHAR *pwszObjId = NULL;
    CACTX *pCAContext = g_pCAContextCurrent;
    CERT_EXTENSION ext;
    DWORD ExtFlags;
    DWORD dwCaller;
    DWORD cbitKey;

    ext.Value.pbData = NULL;

    // Public Key size must be a multiple of 8 bits.
    if (0 != pSubjectPublicKeyInfo->PublicKey.cUnusedBits)
    {
	hr = NTE_BAD_KEY;
	_JumpError(hr, error, "PublicKey.cUnusedBits");
    }
    hr = prow->SetProperty(
		    g_wszPropCertificateRawPublicKey,
		    PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		    pSubjectPublicKeyInfo->PublicKey.cbData,
		    pSubjectPublicKeyInfo->PublicKey.pbData);
    _JumpIfError(hr, error, "SetProperty");

    cbitKey = CertGetPublicKeyLength(
		    X509_ASN_ENCODING,
		    const_cast<CERT_PUBLIC_KEY_INFO *>(pSubjectPublicKeyInfo));
    hr = prow->SetProperty(
		    g_wszPropCertificatePublicKeyLength,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		    sizeof(cbitKey),
		    (BYTE const *) &cbitKey);
    _JumpIfError(hr, error, "SetProperty(KeyLength)");

    if (!ConvertSzToWsz(
		    &pwszObjId,
		    pSubjectPublicKeyInfo->Algorithm.pszObjId,
		    -1))
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "ConvertSzToWsz(AlgObjId)");
    }
    hr = prow->SetProperty(
		    g_wszPropCertificatePublicKeyAlgorithm,
		    PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		    MAXDWORD,
		    (BYTE const *) pwszObjId);
    _JumpIfError(hr, error, "SetProperty");

    if (NULL != pSubjectPublicKeyInfo->Algorithm.Parameters.pbData)
    {
	hr = prow->SetProperty(
		    g_wszPropCertificateRawPublicKeyAlgorithmParameters,
		    PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		    pSubjectPublicKeyInfo->Algorithm.Parameters.cbData,
		    pSubjectPublicKeyInfo->Algorithm.Parameters.pbData);
	_JumpIfError(hr, error, "SetProperty");
    }

    // Subject Key Identifier extension:

    hr = PropGetExtension(
		    prow,
		    PROPTYPE_BINARY | PROPCALLER_SERVER,
		    TEXT(szOID_SUBJECT_KEY_IDENTIFIER),
		    &ExtFlags,
		    &ext.Value.cbData,
		    &ext.Value.pbData);
    if (CERTSRV_E_PROPERTY_EMPTY != hr)
    {
	_JumpIfError(hr, error, "PropGetExtension");

	dwCaller = PROPCALLER_REQUEST;
	ExtFlags &= ~EXTENSION_DISABLE_FLAG;
    }
    else
    {
	dwCaller = PROPCALLER_SERVER;
	ExtFlags = EXTENSION_ORIGIN_SERVER;

	hr = myCreateSubjectKeyIdentifierExtension(
					pSubjectPublicKeyInfo,
					&ext.Value.pbData,
					&ext.Value.cbData);
	_JumpIfError(hr, error, "myCreateSubjectKeyIdentifierExtension");
    }

    hr = PropSetExtension(
		    prow,
		    PROPTYPE_BINARY | dwCaller,
		    TEXT(szOID_SUBJECT_KEY_IDENTIFIER),
		    ExtFlags,
		    ext.Value.cbData,
		    ext.Value.pbData);
    _JumpIfError(hr, error, "PropSetExtension");

error:
    if (NULL != ext.Value.pbData)
    {
	LocalFree(ext.Value.pbData);
    }
    if (NULL != pwszObjId)
    {
	LocalFree(pwszObjId);
    }
    return(hr);
}


HRESULT
pkcsParsePKCS10Request(
    IN DWORD dwFlags,
    IN ICertDBRow *prow,
    IN DWORD cbRequest,
    IN BYTE const *pbRequest,
    IN CERT_CONTEXT const *pSigningAuthority,
    OUT BOOL *pfRenewal,
    IN OUT CERTSRV_RESULT_CONTEXT *pResult)
{
    HRESULT hr;
    DWORD cbCertInfo;
    CERT_REQUEST_INFO *pRequestInfo = NULL;
    CRYPT_ATTRIBUTE const *pAttrib;
    CRYPT_ATTRIBUTE const *pAttribEnd;
    CRYPT_ATTR_BLOB *pAttrBlob;
    CERT_CONTEXT const *pOldCert = NULL;
    DWORD dwRequestFlags = 0;
    BOOL fRenewal = FALSE;
    BOOL fSubjectNameSet;

    CSASSERT(CR_IN_PKCS10 == (CR_IN_FORMATMASK & dwFlags));
    CSASSERT(
	CR_IN_PKCS10 == (CR_IN_FORMATMASK & pResult->dwFlagsTop) ||
	CR_IN_PKCS7 == (CR_IN_FORMATMASK & pResult->dwFlagsTop) ||
	CR_IN_CMC == (CR_IN_FORMATMASK & pResult->dwFlagsTop));

    if (!myDecodeObject(
		    X509_ASN_ENCODING,
		    X509_CERT_REQUEST_TO_BE_SIGNED,
		    pbRequest,
		    cbRequest,
		    CERTLIB_USE_LOCALALLOC,
		    (VOID **) &pRequestInfo,
		    &cbCertInfo))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myDecodeObject");
    }

    // verify with the public key passed in the PKCS10

    if (!CryptVerifyCertificateSignature(
			    NULL,
			    X509_ASN_ENCODING,
			    const_cast<BYTE *>(pbRequest),
			    cbRequest,
			    &pRequestInfo->SubjectPublicKeyInfo))
    {
	hr = myHLastError();
	_PrintError3(
		hr,
		"CryptVerifyCertificateSignature",
		E_INVALIDARG,
		CRYPT_E_ASN1_BADTAG);
	if (CR_IN_CMC == (CR_IN_FORMATMASK & pResult->dwFlagsTop))
	{
	    if (E_INVALIDARG == hr)			// NULL signature?
	    {
		CRYPT_DATA_BLOB Blob;
		
		Blob.cbData = cbRequest;
		Blob.pbData = const_cast<BYTE *>(pbRequest);
		if (!CryptVerifyCertificateSignatureEx(
					NULL,		// hCryptProv
					X509_ASN_ENCODING,
					CRYPT_VERIFY_CERT_SIGN_SUBJECT_BLOB,
					&Blob,
					CRYPT_VERIFY_CERT_SIGN_ISSUER_NULL,
					NULL,		// pvIssuer
					0,		// dwFlags
					NULL))		// pvReserved
		{
		    HRESULT hr2 = myHLastError();

		    _PrintError(hr2, "CryptVerifyCertificateSignatureEx");
		}
		else
		{
		    hr = S_OK;
		}
	    }
	    else if ((CRLF_ACCEPT_OLDRFC_CMC & g_dwCRLFlags) &&
		     CRYPT_E_ASN1_BADTAG == hr)		// No signature?
	    {
		hr = S_OK;
	    }
	}
	if (E_INVALIDARG == hr || CRYPT_E_ASN1_BADTAG == hr)
	{
	    hr = NTE_BAD_SIGNATURE;
	}
	_JumpIfError(hr, error, "CryptVerifyCertificateSignature");
    }

    // handle renewal certificate extensions BEFORE processing the rest of
    // the request attributes (which may also contain extensions)

    pAttribEnd = &pRequestInfo->rgAttribute[pRequestInfo->cAttribute];
    for (pAttrib = pRequestInfo->rgAttribute; pAttrib < pAttribEnd; pAttrib++)
    {
        if (0 == strcmp(pAttrib->pszObjId, szOID_RENEWAL_CERTIFICATE))
        {
	    hr = CERTSRV_E_BAD_RENEWAL_CERT_ATTRIBUTE;
            if (fRenewal)
	    {
                _JumpError(hr, error, "Multiple renewal certs!");
	    }
	    if (CR_IN_PKCS7 != (CR_IN_FORMATMASK & pResult->dwFlagsTop) &&
		CR_IN_CMC != (CR_IN_FORMATMASK & pResult->dwFlagsTop))
	    {
                _JumpError(hr, error, "renewal cert must be in PKCS7 or CMC");
	    }
            if (1 != pAttrib->cValue)
            {
                _JumpError(hr, error, "Attribute Value count != 1");
            }
            pAttrBlob = pAttrib->rgValue;

            pOldCert = CertCreateCertificateContext(
						X509_ASN_ENCODING,
						pAttrBlob->pbData,
						pAttrBlob->cbData);
            if (NULL == pOldCert)
            {
                _JumpError(hr, error, "CertCreateCertificateContext");
            }

            // The old raw certificate, and the signer of the PKCS7 must match!

            if (NULL == pSigningAuthority ||
               !CertCompareCertificate(
				pSigningAuthority->dwCertEncodingType,
				pSigningAuthority->pCertInfo,
				pOldCert->pCertInfo))
            {
		_JumpError(hr, error, "CertCompareCertificate");
            }

            // This is a renewal, mark it as such.

            hr = prow->SetProperty(
		            g_wszPropRequestRawOldCertificate,
		            PROPTYPE_BINARY |
				PROPCALLER_SERVER |
				PROPTABLE_REQUEST,
		            pAttrBlob->cbData,
		            pAttrBlob->pbData);
            _JumpIfError(hr, error, "SetProperty(old cert)");

	    hr = pkcsSetExtensions(
			prow,
			EXTENSION_ORIGIN_RENEWALCERT | EXTENSION_DISABLE_FLAG,
			pOldCert->pCertInfo->rgExtension,
			pOldCert->pCertInfo->cExtension);
            _JumpIfError(hr, error, "pkcsSetExtensions(old cert)");

            fRenewal = TRUE;
        }
    }

    // handle certificate extensions/known atributes

    hr = pkcsSetAttributes(
		    prow,
		    EXTENSION_ORIGIN_REQUEST,
		    PSA_DISALLOW_ARCHIVEDKEY,
		    pRequestInfo->rgAttribute,
		    pRequestInfo->cAttribute,
		    0,
		    NULL,
		    NULL,
		    pResult);
    _JumpIfError(hr, error, "pkcsSetAttributes(PKCS10)");

    hr = pkcsSetRequestNameInfo(
			prow,
			&pRequestInfo->Subject,
			NULL,		// pwszCNSuffix
			&dwRequestFlags,
			&fSubjectNameSet);
    _JumpIfError(hr, error, "pkcsSetRequestNameInfo");

    if (fSubjectNameSet)
    {
	dwRequestFlags |= CR_FLG_SUBJECTUNMODIFIED;
    }

    if (fRenewal)
    {
	if (!fSubjectNameSet)
	{
	    CSASSERT(NULL != pOldCert);
	    CSASSERT(NULL != pOldCert->pCertInfo);
	    hr = pkcsSetRequestNameInfo(
			    prow,
			    &pOldCert->pCertInfo->Subject,
			    NULL,		// pwszCNSuffix
			    &dwRequestFlags,
			    &fSubjectNameSet);
	    _JumpIfError(hr, error, "pkcsSetRequestNameInfo");
	}
        dwRequestFlags |= CR_FLG_RENEWAL;
    }

    hr = prow->SetProperty(
            g_wszPropRequestFlags,
            PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
            sizeof(dwRequestFlags),
            (BYTE const *) &dwRequestFlags);
    _JumpIfError(hr, error, "SetProperty(RequestFlags)");

    hr = pkcsSetPublicKeyProperties(prow, &pRequestInfo->SubjectPublicKeyInfo);
    _JumpIfError(hr, error, "pkcsSetPublicKeyProperties");

    hr = PKCSSetServerProperties(
			prow,
			g_lValidityPeriodCount,
			g_enumValidityPeriod);
    _JumpIfError(hr, error, "PKCSSetServerProperties");

    if (NULL != pfRenewal)
    {
        *pfRenewal = fRenewal;
    }

error:
    if (NULL != pOldCert)
    {
	CertFreeCertificateContext(pOldCert);
    }
    if (NULL != pRequestInfo)
    {
	LocalFree(pRequestInfo);
    }
    return(hr);
}


HRESULT
PKCSVerifyChallengeString(
    IN ICertDBRow *prow)
{
    HRESULT hr;
    DWORD cb;
    WCHAR wszPassed[MAX_PATH];
    WCHAR wszExpected[MAX_PATH];

    cb = sizeof(wszExpected);
    hr = prow->GetProperty(
		    g_wszPropExpectedChallenge,
		    PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_ATTRIBUTE,
		    &cb,
		    (BYTE *) wszExpected);
    if (S_OK != hr || L'\0' == wszExpected[0])
    {
	hr = S_OK;	// no challenge expected
	goto error;
    }

    cb = sizeof(wszPassed);
    hr = prow->GetProperty(
		    g_wszPropChallenge,
		    PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_ATTRIBUTE,
		    &cb,
		    (BYTE *) wszPassed);
    if (S_OK != hr)
    {
	hr = HRESULT_FROM_WIN32(ERROR_INVALID_PASSWORD);
	_JumpError(hr, error, "Missing Challenge String");
    }
    if (0 != wcscmp(wszExpected, wszPassed))
    {
	CONSOLEPRINT2((
		    DBG_SS_CERTSRV,
		    "Challenge: passed(%ws) expected(%ws)\n",
		    wszPassed,
		    wszExpected));

	hr = HRESULT_FROM_WIN32(ERROR_INVALID_PASSWORD);
	_JumpError(hr, error, "Invalid Challenge String");
    }
    hr = prow->SetProperty(
		    g_wszPropExpectedChallenge,
		    PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_ATTRIBUTE,
		    0,
		    NULL);
    _PrintIfError(hr, "SetProperty");

    hr = S_OK;

error:
    return(hr);
}


HRESULT
pkcsParseKeyGenRequest(
    IN DWORD dwFlags,
    IN ICertDBRow *prow,
    IN DWORD cbRequest,
    IN BYTE const *pbRequest,
    IN OUT CERTSRV_RESULT_CONTEXT *pResult)
{
    HRESULT hr;
    DWORD cbKeyGenRequest;
    CERT_KEYGEN_REQUEST_INFO *pKeyGenRequest = NULL;
    DWORD dwRequestFlags;

    CSASSERT(CR_IN_KEYGEN == (CR_IN_FORMATMASK & dwFlags));

    // Decode KeyGenRequest structure
    if (!myDecodeKeyGenRequest(
		    pbRequest,
		    cbRequest,
		    CERTLIB_USE_LOCALALLOC,
		    &pKeyGenRequest,
		    &cbKeyGenRequest))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myDecodeKeyGen");
    }

    // verify with the public key passed in the PKCS10
    if (!CryptVerifyCertificateSignature(
			    NULL,
			    X509_ASN_ENCODING,
			    (BYTE *) pbRequest,
			    cbRequest,
			    &pKeyGenRequest->SubjectPublicKeyInfo))
    {
	hr = myHLastError();
	_JumpError(hr, error, "CryptVerifyCertificateSignature");
    }

    hr = pkcsSetPublicKeyProperties(
				prow,
				&pKeyGenRequest->SubjectPublicKeyInfo);
    _JumpIfError(hr, error, "pkcsSetPublicKeyProperties");

    hr = PKCSSetServerProperties(
			prow,
			g_lValidityPeriodCount,
			g_enumValidityPeriod);
    _JumpIfError(hr, error, "PKCSSetServerProperties");

    hr = prow->SetProperty(
		    g_wszPropExpectedChallenge,
		    PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_ATTRIBUTE,
		    MAXDWORD,
		    (BYTE *) pKeyGenRequest->pwszChallengeString);
    _JumpIfError(hr, error, "SetProperty");

    dwRequestFlags = 0;
    switch (ENUM_TELETEX_MASK & g_fForceTeletex)
    {
	case ENUM_TELETEX_ON:
	case ENUM_TELETEX_AUTO:
	    dwRequestFlags |= CR_FLG_FORCETELETEX;
	    break;
    }
    if (ENUM_TELETEX_UTF8 & g_fForceTeletex)
    {
        dwRequestFlags |= CR_FLG_FORCEUTF8;
    }

    hr = prow->SetProperty(
            g_wszPropRequestFlags,
            PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
            sizeof(dwRequestFlags),
            (BYTE const *) &dwRequestFlags);
    _JumpIfError(hr, error, "SetProperty(RequestFlags)");

error:
    if (NULL != pKeyGenRequest)
    {
	LocalFree(pKeyGenRequest);
    }
    return(hr);
}


// Validate the certificate:
//    Signed by CA Certificate
//    issuer name == CA Certificate subject
//    NotBefore >= CA Certificate NotBefore
//    NotAfter <= CA Certificate NotAfter
//    if KEYID2 issuer KeyId set: == CA Certificate KeyId
//    if KEYID2 issuer Name set: == CA Certificate Issuer
//    if KEYID2 issuer Serial Number set: == CA Certificate serial number

HRESULT
pkcsVerifyCertIssuer(
    IN CERT_CONTEXT const *pCert,
    IN CACTX const *pCAContext)
{
    HRESULT hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
    CERT_INFO const *pCertInfo = pCert->pCertInfo;
    CERT_INFO const *pCACertInfo = pCAContext->pccCA->pCertInfo;
    CERT_EXTENSION const *pExt;
    CERT_EXTENSION const *pExtEnd;
    CERT_AUTHORITY_KEY_ID2_INFO *pkeyAuth = NULL;
    DWORD cbkeyAuth;
    CERT_NAME_BLOB const *pName;

    // verify with the CA cert's public key

    if (!CryptVerifyCertificateSignature(
				NULL,
				X509_ASN_ENCODING,
				pCert->pbCertEncoded,
				pCert->cbCertEncoded,
				const_cast<CERT_PUBLIC_KEY_INFO *>(
				    &pCACertInfo->SubjectPublicKeyInfo)))
    {
	hr = myHLastError();
	_JumpError2(
		hr,
		error,
		"CryptVerifyCertificateSignature",
		NTE_BAD_SIGNATURE);
    }

    // Check Issuer name:

    if (!myAreBlobsSame(
		pCACertInfo->Subject.pbData,
		pCACertInfo->Subject.cbData,
		pCertInfo->Issuer.pbData,
		pCertInfo->Issuer.cbData))
    {
	_JumpError(hr, error, "Bad Issuer Name");
    }

    // Check that NotBefore >= CA Certificate NotBefore

    if (0 > CompareFileTime(&pCertInfo->NotBefore, &pCACertInfo->NotBefore))
    {
	_JumpError(hr, error, "NotBefore too early");
    }

    // Check that NotAfter <= CA Certificate NotAfter

    if (0 < CompareFileTime(&pCertInfo->NotAfter, &pCACertInfo->NotAfter))
    {
	_JumpError(hr, error, "NotAfter too late");
    }

    pExtEnd = &pCert->pCertInfo->rgExtension[pCert->pCertInfo->cExtension];
    for (pExt = pCert->pCertInfo->rgExtension; pExt < pExtEnd; pExt++)
    {
        if (0 == strcmp(pExt->pszObjId, szOID_AUTHORITY_KEY_IDENTIFIER2))
        {
	    if (!myDecodeObject(
			    X509_ASN_ENCODING,
			    X509_AUTHORITY_KEY_ID2,
			    pExt->Value.pbData,
			    pExt->Value.cbData,
			    CERTLIB_USE_LOCALALLOC,
			    (VOID **) &pkeyAuth,
			    &cbkeyAuth))
	    {
		hr = myHLastError();
		_JumpError(hr, error, "myDecodeObject");
	    }

	    // Check Issuer KeyId:

	    if (NULL != pCAContext->IssuerKeyId.pbData &&
		NULL != pkeyAuth->KeyId.pbData &&
		!myAreBlobsSame(
			pCAContext->IssuerKeyId.pbData,
			pCAContext->IssuerKeyId.cbData,
			pkeyAuth->KeyId.pbData,
			pkeyAuth->KeyId.cbData))
	    {
		_JumpError(hr, error, "Bad AuthorityKeyId KeyId");
	    }

	    // Check Issuer name:

	    if (1 == pkeyAuth->AuthorityCertIssuer.cAltEntry &&
		CERT_ALT_NAME_DIRECTORY_NAME ==
		pkeyAuth->AuthorityCertIssuer.rgAltEntry[0].dwAltNameChoice)
	    {
		pName = &pkeyAuth->AuthorityCertIssuer.rgAltEntry[0].DirectoryName;

		if (NULL != pName->pbData &&
		    !myAreBlobsSame(
			pCACertInfo->Issuer.pbData,
			pCACertInfo->Issuer.cbData,
			pName->pbData,
			pName->cbData))
		{
		    _JumpError(hr, error, "Bad AuthorityKeyId Issuer Name");
		}
	    }

	    // Check Issuer SerialNumber:

	    if (NULL != pkeyAuth->AuthorityCertSerialNumber.pbData &&
		!myAreSerialNumberBlobsSame(
			    &pCACertInfo->SerialNumber,
			    &pkeyAuth->AuthorityCertSerialNumber))
	    {
		_JumpError(hr, error, "Bad AuthorityKeyId Issuer Serial Number");
	    }
	    break;
	}
    }
    hr = S_OK;

error:
    if (NULL != pkeyAuth)
    {
	LocalFree(pkeyAuth);
    }
    return(hr);
}


HRESULT
PKCSVerifyIssuedCertificate(
    IN CERT_CONTEXT const *pCert,
    OUT CACTX **ppCAContext)
{
    HRESULT hr;
    DWORD i;
    CACTX *pCAContext;

    *ppCAContext = NULL;

    CSASSERT(0 != g_cCACerts);
    for (i = g_cCACerts; i > 0; i--)
    {
	pCAContext = &g_aCAContext[i - 1];

	hr = pkcsVerifyCertIssuer(pCert, pCAContext);
	if (S_OK == hr)
	{
	    *ppCAContext = pCAContext;
	    break;
	}
	_PrintError2(hr, "pkcsVerifyCertIssuer", NTE_BAD_SIGNATURE);
    }

//error:
    return(hr);
}


HRESULT
pkcsSetCertHash(
    IN ICertDBRow *prow,
    IN CERT_CONTEXT const *pcc)
{
    HRESULT hr;
    BYTE abHash[CBMAX_CRYPT_HASH_LEN];
    DWORD cbHash;
    BSTR strHash = NULL;
    CACTX *pCAContext = g_pCAContextCurrent;

    cbHash = sizeof(abHash);
    if (!CertGetCertificateContextProperty(
				pcc,
				CERT_SHA1_HASH_PROP_ID,
				abHash,
				&cbHash))
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertGetCertificateContextProperty");
    }

    hr = MultiByteIntegerToBstr(TRUE, cbHash, abHash, &strHash);
    _JumpIfError(hr, error, "MultiByteIntegerToBstr");

    hr = prow->SetProperty(
		g_wszPropCertificateHash,
		PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		MAXDWORD,
		(BYTE const *) strHash);
    _JumpIfError(hr, error, "SetProperty");

error:
    if (NULL != strHash)
    {
	SysFreeString(strHash);
    }
    return(hr);
}


HRESULT
pkcsSetCertAndKeyHashes(
    IN ICertDBRow *prow,
    IN CERT_CONTEXT const *pcc)
{
    HRESULT hr;
    BYTE *pbHash = NULL;
    DWORD cbHash;
    BSTR strHash = NULL;

    hr = pkcsSetCertHash(prow, pcc);
    _JumpIfError(hr, error, "pkcsSetCertHash");

    hr = myGetPublicKeyHash(
		    pcc->pCertInfo,
		    &pcc->pCertInfo->SubjectPublicKeyInfo,
		    &pbHash,
		    &cbHash);
    _JumpIfError(hr, error, "myGetPublicKeyHash");

    hr = MultiByteIntegerToBstr(TRUE, cbHash, pbHash, &strHash);
    _JumpIfError(hr, error, "MultiByteIntegerToBstr");

    hr = prow->SetProperty(
		g_wszPropCertificateSubjectKeyIdentifier,
		PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		MAXDWORD,
		(BYTE const *) strHash);
    _JumpIfError(hr, error, "SetProperty");

error:
    if (NULL != strHash)
    {
	SysFreeString(strHash);
    }
    if (NULL != pbHash)
    {
	LocalFree(pbHash);
    }
    return(hr);
}


HRESULT
PKCSParseImportedCertificate(
    IN DWORD Disposition,
    IN ICertDBRow *prow,
    OPTIONAL IN CACTX const *pCAContext,
    IN CERT_CONTEXT const *pCert)
{
    HRESULT hr;
    CERT_INFO const *pCertInfo = pCert->pCertInfo;
    DWORD dwRequestFlags = 0;
    BOOL fSubjectNameSet;
    HRESULT ErrCode = S_OK;
    BSTR strSerialNumber = NULL;

    // set raw cert property in the db
    hr = prow->SetProperty(
		g_wszPropRawCertificate,
		PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		pCert->cbCertEncoded,
		pCert->pbCertEncoded);
    _JumpIfError(hr, error, "SetProperty");

    // set extensions
    hr = pkcsSetExtensions(
			prow,
			EXTENSION_ORIGIN_IMPORTEDCERT,
			pCertInfo->rgExtension,
			pCertInfo->cExtension);
    _JumpIfError(hr, error, "pkcsSetExtensions");

    // set request name info
    hr = pkcsSetRequestNameInfo(
			prow,
			&pCertInfo->Subject,
			NULL,		// pwszCNSuffix
			&dwRequestFlags,
			&fSubjectNameSet);
    _JumpIfError(hr, error, "pkcsSetRequestNameInfo");

    hr = pkcsSetPublicKeyProperties(prow, &pCertInfo->SubjectPublicKeyInfo);
    _JumpIfError(hr, error, "pkcsSetPublicKeyProperties");

    hr = prow->CopyRequestNames();
    _JumpIfError(hr, error, "CopyRequestNames");

    hr = pkcsSetCertAndKeyHashes(prow, pCert);
    _JumpIfError(hr, error, "pkcsSetCertAndKeyHashes");

    hr = prow->SetProperty(
		    g_wszPropCertificateNotBeforeDate,
		    PROPTYPE_DATE | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
                    sizeof(pCertInfo->NotBefore),
                    (BYTE *) &pCertInfo->NotBefore);
    _JumpIfError(hr, error, "SetProperty");

    hr = prow->SetProperty(
		    g_wszPropCertificateNotAfterDate,
		    PROPTYPE_DATE | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
                    sizeof(pCertInfo->NotAfter),
                    (BYTE *) &pCertInfo->NotAfter);
    _JumpIfError(hr, error, "SetProperty");

    hr = prow->SetProperty(
		g_wszPropSubjectRawName,
		PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		pCertInfo->Subject.cbData,
		pCertInfo->Subject.pbData);
    _JumpIfError(hr, error, "SetProperty");

    // set distinguished name
    pkcsSetDistinguishedName(
			prow,
			PROPTABLE_CERTIFICATE,
			&pCertInfo->Subject);

    // set disposition issued
    hr = prow->SetProperty(
			g_wszPropRequestDisposition,
			PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
			sizeof(Disposition),
			(BYTE const *) &Disposition);
    _JumpIfError(hr, error, "SetProperty(disposition)");

    // set disposition status code
    hr = prow->SetProperty(
			g_wszPropRequestStatusCode,
			PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
			sizeof(ErrCode),
			(BYTE const *) &ErrCode);
    _JumpIfError(hr, error, "SetProperty(status code)");

    if (NULL != pCAContext)
    {
	hr = prow->SetProperty(
		    g_wszPropCertificateIssuerNameID,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		    sizeof(pCAContext->NameId),
		    (BYTE *) &pCAContext->NameId);
	_JumpIfError(hr, error, "SetProperty");
    }

    hr = PropSetRequestTimeProperty(prow, g_wszPropRequestResolvedWhen);
    _JumpIfError(hr, error, "PropSetRequestTimeProperty");

    // Convert serial number to string and set in DB

    hr = MultiByteIntegerToBstr(
			FALSE,
			pCertInfo->SerialNumber.cbData,
			pCertInfo->SerialNumber.pbData,
			&strSerialNumber);
    _JumpIfError(hr, error, "MultiByteIntegerToBstr");

    hr = prow->SetProperty(
		g_wszPropCertificateSerialNumber,
		PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		MAXDWORD,
		(BYTE *) strSerialNumber);
    _JumpIfError(hr, error, "SetProperty");

error:
    if (NULL != strSerialNumber)
    {
        SysFreeString(strSerialNumber);
    }
    return(hr);
}


// Return TRUE if Data and Cert references apply to the specified CMC message

BOOL
pkcsCMCReferenceMatch(
    IN DWORD DataReference,	// nested CMC message Body Part Id
    IN DWORD CertReference,	// PKCS10 Cert Request Body Part Id
    IN DWORD dwCmcDataReference,
    IN DWORD cCertReference,
    IN DWORD const *rgdwCertReference)
{
    BOOL fMatch = FALSE;
    DWORD i;

    if (MAXDWORD != DataReference && dwCmcDataReference == DataReference)
    {
	fMatch = TRUE;
    }
    else if (MAXDWORD != CertReference && 0 == dwCmcDataReference)
    {
	for (i = 0; i < cCertReference; i++)
	{
	    if (rgdwCertReference[i] == CertReference)
	    {
		fMatch = TRUE;
		break;
	    }
	}
    }
    return(fMatch);
}


HRESULT
pkcsSetCMCExtensions(
    IN ICertDBRow *prow,
    IN DWORD DataReference,	// nested CMC message Body Part Id
    IN DWORD CertReference,	// PKCS10 Cert Request Body Part Id
    IN BYTE const *pbData,
    IN DWORD cbData)
{
    HRESULT hr;
    CMC_ADD_EXTENSIONS_INFO *pcmcExt = NULL;
    DWORD cb;

    // Decode CMC_ADD_EXTENSIONS_INFO from Attribute Blob

    CSASSERT(NULL == pcmcExt);
    if (!myDecodeObject(
		    X509_ASN_ENCODING,
		    CMC_ADD_EXTENSIONS,
		    pbData,
		    cbData,
		    CERTLIB_USE_LOCALALLOC,
		    (VOID **) &pcmcExt,
		    &cb))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myDecodeObject");
    }

    if (pkcsCMCReferenceMatch(
		    DataReference,
		    CertReference,
		    pcmcExt->dwCmcDataReference,
		    pcmcExt->cCertReference,
		    pcmcExt->rgdwCertReference))
    {
	hr = pkcsSetExtensions(
			prow,
			EXTENSION_ORIGIN_CMC | EXTENSION_DISABLE_FLAG,
			pcmcExt->rgExtension,
			pcmcExt->cExtension);
	_JumpIfError(hr, error, "pkcsSetExtensions(request)");
    }
    hr = S_OK;

error:
    if (NULL != pcmcExt)
    {
	LocalFree(pcmcExt);
    }
    return(hr);
}


HRESULT
pkcsSetCMCAttributes(
    IN ICertDBRow *prow,
    IN DWORD DataReference,	// nested CMC message Body Part Id
    IN DWORD CertReference,	// PKCS10 Cert Request Body Part Id
    IN BYTE const *pbData,
    IN DWORD cbData,
    OPTIONAL OUT BOOL *pfEnrollOnBehalfOf,
    IN OUT CERTSRV_RESULT_CONTEXT *pResult)
{
    HRESULT hr;
    CMC_ADD_ATTRIBUTES_INFO *pcmcAttrib = NULL;
    DWORD cb;

    if (NULL != pfEnrollOnBehalfOf)
    {
	*pfEnrollOnBehalfOf = FALSE;
    }

    // Decode CMC_ADD_ATTRIBUTES_INFO from Attribute Blob

    CSASSERT(NULL == pcmcAttrib);
    if (!myDecodeObject(
		    X509_ASN_ENCODING,
		    CMC_ADD_ATTRIBUTES,
		    pbData,
		    cbData,
		    CERTLIB_USE_LOCALALLOC,
		    (VOID **) &pcmcAttrib,
		    &cb))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myDecodeObject");
    }
    if (pkcsCMCReferenceMatch(
		    DataReference,
		    CertReference,
		    pcmcAttrib->dwCmcDataReference,
		    pcmcAttrib->cCertReference,
		    pcmcAttrib->rgdwCertReference))
    {
	hr = pkcsSetAttributes(
			prow,
			EXTENSION_ORIGIN_CMC,
			PSA_DISALLOW_EXTENSIONS | PSA_DISALLOW_ARCHIVEDKEY,
			pcmcAttrib->rgAttribute,
			pcmcAttrib->cAttribute,
			0,
			NULL,
			pfEnrollOnBehalfOf,
			pResult);
	_JumpIfError(hr, error, "pkcsSetAttributes(CMC)");
    }
    hr = S_OK;

error:
    if (NULL != pcmcAttrib)
    {
	LocalFree(pcmcAttrib);
    }
    return(hr);
}


// map "email_mail" to "email"
// map "email_*" to "*"?
// mail_firstName=Terry&mail_lastName=Cheung+CMC+Zero+2&mail_email=
// tcheung%40verisign%2Ecom&challenge=test&

HRESULT
pkcsSetCMCRegInfo(
    IN ICertDBRow *prow,
    IN BYTE const *pbOctet,
    IN DWORD cbOctet,
    OPTIONAL OUT BOOL *pfEnrollOnBehalfOf)
{
    HRESULT hr;
    WCHAR *pwszRA = NULL;

    if (NULL != pfEnrollOnBehalfOf)
    {
	*pfEnrollOnBehalfOf = FALSE;
    }
    hr = myDecodeCMCRegInfo(pbOctet, cbOctet, &pwszRA);
    _JumpIfError(hr, error, "myDecodeCMCRegInfo");

    hr = PKCSParseAttributes(
			prow,
			pwszRA,
			TRUE,
			PROPTABLE_REQUEST,
			pfEnrollOnBehalfOf);
    _JumpIfError(hr, error, "PKCSParseAttributes");

error:
    if (NULL != pwszRA)
    {
	LocalFree(pwszRA);
    }
    return(hr);
}


HRESULT
pkcsSetTaggedAttributes(
    IN ICertDBRow *prow,
    IN DWORD DataReference,	// nested CMC message Body Part Id
    IN DWORD CertReference,	// PKCS10 Cert Request Body Part Id
    IN CMC_TAGGED_ATTRIBUTE const *pTaggedAttribute,
    OPTIONAL OUT BOOL *pfEnrollOnBehalfOf,
    IN OUT CERTSRV_RESULT_CONTEXT *pResult)
{
    HRESULT hr;
    DWORD i;
    CRYPT_ATTRIBUTE const *pAttribute = &pTaggedAttribute->Attribute;
    DWORD cb;
    BOOL fEnrollOnBehalfOf;

    if (NULL != pfEnrollOnBehalfOf)
    {
	*pfEnrollOnBehalfOf = FALSE;
    }
    for (i = 0; i < pAttribute->cValue; i++)
    {
	if (0 == strcmp(szOID_CMC_ADD_EXTENSIONS, pAttribute->pszObjId))
	{
	    hr = pkcsSetCMCExtensions(
				prow,
				DataReference,
				CertReference,
				pAttribute->rgValue[i].pbData,
				pAttribute->rgValue[i].cbData);
	    _JumpIfError(hr, error, "pkcsSetCMCExtensions");
	}
	else
	if (0 == strcmp(szOID_CMC_ADD_ATTRIBUTES, pAttribute->pszObjId))
	{
	    fEnrollOnBehalfOf = FALSE;

	    hr = pkcsSetCMCAttributes(
			prow,
			DataReference,
			CertReference,
			pAttribute->rgValue[i].pbData,
			pAttribute->rgValue[i].cbData,
			NULL != pfEnrollOnBehalfOf? &fEnrollOnBehalfOf : NULL,
			pResult);
	    _JumpIfError(hr, error, "pkcsSetCMCAttributes");

	    if (fEnrollOnBehalfOf)
	    {
		CSASSERT(NULL != pfEnrollOnBehalfOf);
		*pfEnrollOnBehalfOf = TRUE;
	    }
	}
	else
	if (0 == strcmp(szOID_CMC_REG_INFO, pAttribute->pszObjId))
	{
	    fEnrollOnBehalfOf = FALSE;

	    hr = pkcsSetCMCRegInfo(
			prow,
			pAttribute->rgValue[i].pbData,
			pAttribute->rgValue[i].cbData,
			NULL != pfEnrollOnBehalfOf? &fEnrollOnBehalfOf : NULL);
	    _JumpIfError(hr, error, "pkcsSetCMCRegInfo");

	    if (fEnrollOnBehalfOf)
	    {
		CSASSERT(NULL != pfEnrollOnBehalfOf);
		*pfEnrollOnBehalfOf = TRUE;
	    }
	}
	else
	if (0 == strcmp(szOID_CMC_TRANSACTION_ID, pAttribute->pszObjId))
	{
	    DWORD dwTransactionId;
	    
	    cb = sizeof(dwTransactionId);
	    dwTransactionId = 0;
	    if (!CryptDecodeObject(
				X509_ASN_ENCODING,
				X509_INTEGER,
				pAttribute->rgValue[i].pbData,
				pAttribute->rgValue[i].cbData,
				0,
				&dwTransactionId,
				&cb))
	    {
		hr = myHLastError();
		_JumpError(hr, error, "CryptDecodeObject");
	    }
	    pResult->fTransactionId = TRUE;
	    pResult->dwTransactionId = dwTransactionId;
	}
	else
	if (0 == strcmp(szOID_CMC_SENDER_NONCE, pAttribute->pszObjId))
	{
	    CRYPT_DATA_BLOB *pBlob;
	    BYTE *pb;

	    if (!myDecodeObject(
			    X509_ASN_ENCODING,
			    X509_OCTET_STRING,
			    pAttribute->rgValue[i].pbData,
			    pAttribute->rgValue[i].cbData,
			    CERTLIB_USE_LOCALALLOC,
			    (VOID **) &pBlob,
			    &cb))
	    {
		hr = myHLastError();
		_JumpError(hr, error, "myDecodeObject");
	    }
	    pb = (BYTE *) LocalAlloc(LMEM_FIXED, pBlob->cbData);
	    if (NULL == pb)
	    {
		hr = E_OUTOFMEMORY;
	    }
	    else
	    {
		CopyMemory(pb, pBlob->pbData, pBlob->cbData);
		if (NULL != pResult->pbSenderNonce)
		{
		    LocalFree(pResult->pbSenderNonce);
		}
		pResult->pbSenderNonce = pb;
		pResult->cbSenderNonce = pBlob->cbData;
		hr = S_OK;
	    }
	    LocalFree(pBlob);
	    _JumpIfError(hr, error, "LocalAlloc");
	}
	else if (0 == (CRLF_IGNORE_UNKNOWN_CMC_ATTRIBUTES & g_dwCRLFlags))
	{
	    hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	    _JumpError(hr, error, "unknown tagged attribute");
	}
    }
    hr = S_OK;

error:
    return(hr);
}


//+------------------------------------------------------------------------
// pkcsParseCMCRequest
//
// Crack a CMC request and dig the goodies out of it.
// Crack the contents of the CMC request recursively.
//-------------------------------------------------------------------------

HRESULT
pkcsParseCMCRequest(
    IN ICertDBRow *prow,
    IN DWORD cbIn,
    IN BYTE const *pbIn,
    OPTIONAL IN CERT_CONTEXT const *pCertSigner,
    OPTIONAL OUT BOOL *pfRenewal,
    OPTIONAL OUT BOOL *pfEnrollOnBehalfOf,
    IN OUT CERTSRV_RESULT_CONTEXT *pResult)
{
    HRESULT hr;
    DWORD cb;
    CMC_DATA_INFO const *pcmcData = NULL;
    DWORD i;
    DWORD DataReference = MAXDWORD;	// nested CMC message Body Part Id
    DWORD CertReference = MAXDWORD;	// PKCS10 Cert Request Body Part Id

    if (NULL != pfRenewal)
    {
	*pfRenewal = FALSE;
    }
    if (NULL != pfEnrollOnBehalfOf)
    {
	*pfEnrollOnBehalfOf = FALSE;
    }
    if (!myDecodeObject(
		    X509_ASN_ENCODING,
		    CMC_DATA,
		    pbIn,
		    cbIn,
		    CERTLIB_USE_LOCALALLOC,
		    (VOID **) &pcmcData,
		    &cb))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myDecodeObject");
    }

    if (0 != pcmcData->cTaggedOtherMsg)
    {
	hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	_JumpError(hr, error, "unknown other message");
    }

    // Process nested CMC messages

    if (0 != pcmcData->cTaggedContentInfo)
    {
	CMC_TAGGED_CONTENT_INFO const *pTaggedContentInfo;

	// Only handle one CMC message at a time for now.

	hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	if (1 < pcmcData->cTaggedContentInfo)
	{
	    _JumpError(hr, error, "multiple nested CMC messages");
	}

	// Disallow CMC message recursion below a PKCS10 request.

	if (0 != pcmcData->cTaggedRequest)
	{
	    _JumpError(hr, error, "recursion below PKCS10 request");
	}

	// Recurse on the nested CMC message

	pTaggedContentInfo = &pcmcData->rgTaggedContentInfo[0];

	hr = PKCSParseRequest(
			CR_IN_CMC | (~CR_IN_FORMATMASK & pResult->dwFlagsTop),
			prow,
			pTaggedContentInfo->EncodedContentInfo.cbData,
			pTaggedContentInfo->EncodedContentInfo.pbData,
			pCertSigner,
			pfRenewal,
			pResult);
	_JumpIfError(hr, error, "PKCSParseRequest");

	DataReference = pTaggedContentInfo->dwBodyPartID;
    }

    // Process nested PKCS10 requests

    if (0 != pcmcData->cTaggedRequest)
    {
	CMC_TAGGED_REQUEST const *pTaggedRequest;
	CMC_TAGGED_CERT_REQUEST const *pTaggedCertRequest;

	// Only handle one request at a time for now.

	hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	if (1 < pcmcData->cTaggedRequest)
	{
	    _JumpError(hr, error, "multiple PKCS10 requests");
	}

	pTaggedRequest = &pcmcData->rgTaggedRequest[0];

	// The request must be a PKCS10 request

	if (CMC_TAGGED_CERT_REQUEST_CHOICE !=
	    pTaggedRequest->dwTaggedRequestChoice)
	{
	    hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	    _JumpError(hr, error, "recursion below PKCS10 request");
	}

	pTaggedCertRequest = pTaggedRequest->pTaggedCertRequest;

	hr = PKCSParseRequest(
		    CR_IN_PKCS10 | (~CR_IN_FORMATMASK & pResult->dwFlagsTop),
		    prow,
		    pTaggedCertRequest->SignedCertRequest.cbData,
		    pTaggedCertRequest->SignedCertRequest.pbData,
		    pCertSigner,
		    pfRenewal,
		    pResult);
	_JumpIfError(hr, error, "PKCSParseRequest");

	CertReference = pTaggedCertRequest->dwBodyPartID;
    }

    // Process extensions and attributes

    for (i = 0; i < pcmcData->cTaggedAttribute; i++)
    {
	hr = pkcsSetTaggedAttributes(
			prow,
			DataReference,
			CertReference,
			&pcmcData->rgTaggedAttribute[i],
			pfEnrollOnBehalfOf,
			pResult);
	_JumpIfError(hr, error, "pkcsSetTaggedAttributes");
    }
    hr = S_OK;

error:
    if (NULL != pcmcData)
    {
	LocalFree((VOID *) pcmcData);
    }
    return(hr);
}


HRESULT
pkcsAppendPolicies(
    IN ICertDBRow *prow,
    IN WCHAR const *pwszPropName,
    OPTIONAL IN WCHAR const *pwszzPolicies)
{
    HRESULT hr;
    WCHAR *pwszOld = NULL;
    WCHAR *pwszNew = NULL;
    WCHAR const *pwszIn;
    WCHAR *pwsz;
    DWORD cwc = 0;
    DWORD cb;

    hr = PKCSGetProperty(
		prow,
		pwszPropName,
		PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		&cb,
		(BYTE **) &pwszOld);
    _PrintIfError2(hr, "PKCSGetProperty", hr);
    if (S_OK != hr)
    {
	pwszOld = NULL;
    }
    if (NULL != pwszOld)
    {
	cwc = wcslen(pwszOld) + 1;	// allow for \n separator
    }
    if (NULL == pwszzPolicies || L'\0' == *pwszzPolicies)
    {
	pwszzPolicies = L"-\0";
    }
    for (pwszIn = pwszzPolicies; L'\0' != *pwszIn; pwszIn += wcslen(pwszIn) + 1)
	    ;

    cwc += SAFE_SUBTRACT_POINTERS(pwszIn, pwszzPolicies);
    pwszNew = (WCHAR *) LocalAlloc(LMEM_FIXED, cwc * sizeof(WCHAR));
    if (NULL == pwszNew)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }
    pwsz = pwszNew;

    if (NULL != pwszOld)
    {
	wcscpy(pwsz, pwszOld);
	pwsz += wcslen(pwsz);

	wcscpy(pwsz, L"\n");
	pwsz++;
    }

    for (pwszIn = pwszzPolicies; L'\0' != *pwszIn; pwszIn += wcslen(pwszIn) + 1)
    {
	if (pwszIn != pwszzPolicies)
	{
	    wcscpy(pwsz, L",");
	    pwsz++;
	}
	wcscpy(pwsz, pwszIn);
	pwsz += wcslen(pwsz);
    }
    CSASSERT(&pwsz[1] == &pwszNew[cwc]);

    hr = prow->SetProperty(
	    pwszPropName,
	    PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_REQUEST,
	    MAXDWORD,
	    (BYTE const *) pwszNew);
    _JumpIfError(hr, error, "SetProperty");

error:
    if (NULL != pwszOld)
    {
	LocalFree(pwszOld);
    }
    if (NULL != pwszNew)
    {
	LocalFree(pwszNew);
    }
    return(hr);
}


//+------------------------------------------------------------------------
// pkcsParsePKCS7Request
//
// Crack a PKCS7 and dig the goodies out of it.
// Verify the signature of the 7 against the cert given in the 7.
// Crack the contents of the 7 recursively.
//-------------------------------------------------------------------------

HRESULT
pkcsParsePKCS7Request(
    IN BOOL fTopLevel,
    IN DWORD dwFlags,
    IN ICertDBRow *prow,
    IN DWORD cbIn,
    IN BYTE const *pbIn,
    IN OUT CERTSRV_RESULT_CONTEXT *pResult)
{
    HRESULT hr;
    BYTE *pbContents = NULL;
    DWORD cbContents;
    CERT_CONTEXT const *pCertSigner = NULL;
    HCERTSTORE hStore = NULL;
    HCRYPTMSG hMsg = NULL;
    char *pszInnerContentObjId = NULL;
    DWORD i;
    BOOL fCMC;
    BOOL fRenewal = FALSE;
    DWORD cbAttrib;
    char *apszEnrollOids[] = {szOID_ENROLLMENT_AGENT};
    DWORD dwVerifyContextFlags;
    DWORD dwMsgType;
    DWORD cSigner;
    DWORD cFirstSigner;
    BOOL fFirstSigner;
    DWORD cRecipient;
    DWORD cb;
    CMSG_CMS_SIGNER_INFO *pcsi = NULL;
    DWORD dwDisallowFlags;
    DWORD iElement;
    WCHAR *pwszzIssuancePolicies = NULL;
    WCHAR *pwszzApplicationPolicies = NULL;
    CERT_REQUEST_INFO *pRequest = NULL;
    BOOL fEnrollOnBehalfOf;

    CSASSERT(
	CR_IN_PKCS7 == (CR_IN_FORMATMASK & dwFlags) ||
	CR_IN_CMC == (CR_IN_FORMATMASK & dwFlags));

    // Crack the 7 and verify the signature.

    hr = myDecodePKCS7(
		    pbIn,
		    cbIn,
		    &pbContents,
		    &cbContents,
		    &dwMsgType,
		    &pszInnerContentObjId,
		    &cSigner,
		    &cRecipient,
		    &hStore,
		    &hMsg);
    _JumpIfError(hr, error, "myDecodePKCS7");

    if (CMSG_SIGNED != dwMsgType || 0 == cSigner)
    {
	hr = CRYPT_E_NO_SIGNER;
	_JumpIfError(hr, error, "myDecodePKCS7(no signing cert)");
    }

#define szOID_CT_PKI_DATA_OLDRFC     "1.3.6.1.5.5.7.5.2" // BUGBUG: temporary!
    fCMC = NULL != pszInnerContentObjId &&
	   (0 == strcmp(pszInnerContentObjId, szOID_CT_PKI_DATA) ||
	    (0 == strcmp(pszInnerContentObjId, szOID_CT_PKI_DATA_OLDRFC) &&
	     (CRLF_ACCEPT_OLDRFC_CMC & g_dwCRLFlags)));


    // Decode the contents.

    if (fCMC)
    {
	if (CR_IN_CMC != (CR_IN_FORMATMASK & dwFlags))
	{
	    hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	    _JumpError(hr, error, "dwFlags");
	}
	// CMC renewal requests may have one 'first' signer (non-NULL KeyId or
	// Dummy signer) and one additional Issuer+Serial signer.  If the
	// request has the appropriate signatures, pass the cert to the lowest
	// level to see if it really is a renewal request.

	if (1 <= cSigner && 2 >= cSigner)
	{
	    DWORD iCertSigner = MAXDWORD;

	    cFirstSigner = 0;
	    for (i = 0; i < cSigner; i++)
	    {
		if (NULL != pcsi)
		{
		    LocalFree(pcsi);
		    pcsi = NULL;
		}
		hr = myCryptMsgGetParam(
				    hMsg,
				    CMSG_CMS_SIGNER_INFO_PARAM,
				    i,
				    CERTLIB_USE_LOCALALLOC,
				    (VOID **) &pcsi,
				    &cb);
		_JumpIfError(hr, error, "myCryptMsgGetParam");

		fFirstSigner = FALSE;
		if (CERT_ID_KEY_IDENTIFIER == pcsi->SignerId.dwIdChoice ||
		    (NULL != pcsi->HashEncryptionAlgorithm.pszObjId &&
		     0 == strcmp(
			    szOID_PKIX_NO_SIGNATURE,
			    pcsi->HashEncryptionAlgorithm.pszObjId)))
		{
		    fFirstSigner = TRUE;
		}
		else if ((CRLF_ACCEPT_OLDRFC_CMC & g_dwCRLFlags) &&
		    CERT_ID_ISSUER_SERIAL_NUMBER == pcsi->SignerId.dwIdChoice)
		{
		    hr = myIsFirstSigner(
				    &pcsi->SignerId.IssuerSerialNumber.Issuer,
				    &fFirstSigner);
		    _JumpIfError(hr, error, "myIsFirstSigner");
		}

		if (fFirstSigner)
		{
		    cFirstSigner++;
		}
		else
		{
		    if (MAXDWORD != iCertSigner)
		    {
			iCertSigner = MAXDWORD;	// must not be a renewal
			break;
		    }
		    iCertSigner = i;
		}
	    }
	    if (MAXDWORD != iCertSigner && 1 >= cFirstSigner)
	    {
		iElement = iCertSigner;
		if (!CryptMsgGetAndVerifySigner(
					hMsg,
					0,		// cSignerStore
					NULL,		// rghSignerStore
					CMSG_USE_SIGNER_INDEX_FLAG,
					&pCertSigner,
					&iElement))
		{
		    hr = myHLastError();
		    _JumpError(hr, error, "CryptMsgGetAndVerifySigner");
		}
	    }
	}
	fEnrollOnBehalfOf = FALSE;
	hr = pkcsParseCMCRequest(
			    prow,
			    cbContents,
			    pbContents,
			    pCertSigner,
			    &fRenewal,
			    &fEnrollOnBehalfOf,
			    pResult);
	_JumpIfError(hr, error, "pkcsParseCMCRequest");

	if (fEnrollOnBehalfOf)
	{
	    pResult->fEnrollOnBehalfOf = TRUE;
	}
	if (0 == strcmp(pszInnerContentObjId, szOID_CT_PKI_DATA_OLDRFC))
	{
	    hr = PKCSSetRequestFlags(prow, TRUE, CR_FLG_OLDRFCCMC);
	    _JumpIfError(hr, error, "PKCSSetRequestFlags");
	}
    }
    else
    {
	if (CR_IN_PKCS7 != (CR_IN_FORMATMASK & dwFlags))
	{
	    hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	    _JumpError(hr, error, "dwFlags");
	}

	// Expect only one signer for PKCS7 renewal requests.  Pass the cert
	// to the lowest level to see if it really is a renewal request.

	iElement = 0;
	if (!CryptMsgGetAndVerifySigner(
				hMsg,
				0,		// cSignerStore
				NULL,		// rghSignerStore
				CMSG_USE_SIGNER_INDEX_FLAG,
				&pCertSigner,
				&iElement))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "CryptMsgGetAndVerifySigner");
	}
	hr = PKCSParseRequest(
		CR_IN_FORMATANY | (~CR_IN_FORMATMASK & pResult->dwFlagsTop),
		prow,
		cbContents,
		pbContents,
		pCertSigner,
		&fRenewal,
		pResult);
	_JumpIfError(hr, error, "PKCSParseRequest");
    }

    // Loop through the signers, verifying signatures and saving attributes.

    cFirstSigner = 0;
    for (i = 0; i < cSigner; i++)
    {
	BOOL fNTAuth;
	BOOL fEnrollOnBehalfOf;

	if (NULL != pcsi)
	{
	    LocalFree(pcsi);
	    pcsi = NULL;
	}
	if (NULL != pwszzIssuancePolicies)
	{
	    LocalFree(pwszzIssuancePolicies);
	    pwszzIssuancePolicies = NULL;
	}
	if (NULL != pwszzApplicationPolicies)
	{
	    LocalFree(pwszzApplicationPolicies);
	    pwszzApplicationPolicies = NULL;
	}
	if (NULL != pCertSigner)
	{
	    CertFreeCertificateContext(pCertSigner);
	    pCertSigner = NULL;
	}
	hr = myCryptMsgGetParam(
			    hMsg,
			    CMSG_CMS_SIGNER_INFO_PARAM,
			    i,
                            CERTLIB_USE_LOCALALLOC,
			    (VOID **) &pcsi,
			    &cb);
	_JumpIfError(hr, error, "myCryptMsgGetParam");

	fFirstSigner = FALSE;
	if (fCMC &&
	    (CERT_ID_KEY_IDENTIFIER == pcsi->SignerId.dwIdChoice ||
	     (NULL != pcsi->HashEncryptionAlgorithm.pszObjId &&
	      0 == strcmp(
		    szOID_PKIX_NO_SIGNATURE,
		    pcsi->HashEncryptionAlgorithm.pszObjId))))
	{
	    CMSG_CTRL_VERIFY_SIGNATURE_EX_PARA cvse;

	    fFirstSigner = TRUE;
	    ZeroMemory(&cvse, sizeof(cvse));
	    cvse.cbSize = sizeof(cvse);
	    cvse.dwSignerIndex = i;

	    if (CERT_ID_KEY_IDENTIFIER == pcsi->SignerId.dwIdChoice)
	    {
		if (NULL == pRequest)
		{
		    hr = myGetInnerPKCS10(
				    hMsg,
				    pszInnerContentObjId,
				    &pRequest);
		    _JumpIfError(hr, error, "myGetInnerPKCS10");
		}
		cvse.dwSignerType = CMSG_VERIFY_SIGNER_PUBKEY;
		cvse.pvSigner = &pRequest->SubjectPublicKeyInfo;
	    }
	    else
	    {
		cvse.dwSignerType = CMSG_VERIFY_SIGNER_NULL;
	    }

	    if (!CryptMsgControl(
			    hMsg,
			    0,		// dwFlags
			    CMSG_CTRL_VERIFY_SIGNATURE_EX,
			    &cvse))
	    {
		hr = myHLastError();
		_JumpError(hr, error, "CryptMsgControl(VerifySig)");
	    }
	}
	else
	{
	    if (fCMC &&
		(CRLF_ACCEPT_OLDRFC_CMC & g_dwCRLFlags) &&
		CERT_ID_ISSUER_SERIAL_NUMBER == pcsi->SignerId.dwIdChoice)
	    {
		hr = myIsFirstSigner(
				&pcsi->SignerId.IssuerSerialNumber.Issuer,
				&fFirstSigner);
		_JumpIfError(hr, error, "myIsFirstSigner");
	    }
	    iElement = i;
	    if (!CryptMsgGetAndVerifySigner(
				    hMsg,
				    0,			// cSignerStore
				    NULL,		// rghSignerStore
				    CMSG_USE_SIGNER_INDEX_FLAG,
				    &pCertSigner,
				    &iElement))
	    {
		hr = myHLastError();
		_JumpError(hr, error, "CryptMsgGetAndVerifySigner");
	    }
	}

	// Only enroll-on-behalf-of requests may contain Name, Value pairs.
	// Only enroll-on-behalf-of requests and renewal requests may contain
	// certificate extensions.

	dwDisallowFlags = PSA_DISALLOW_ARCHIVEDKEY;
	if (fRenewal)
	{
	    dwDisallowFlags |= PSA_DISALLOW_NAMEVALUEPAIRS;
	}
	if (fCMC)
	{
	    dwDisallowFlags |= PSA_DISALLOW_EXTENSIONS |
			       PSA_DISALLOW_NAMEVALUEPAIRS;
	}
	fEnrollOnBehalfOf = FALSE;
	hr = pkcsSetAttributes(
			prow,
			EXTENSION_ORIGIN_PKCS7,
			dwDisallowFlags,
			pcsi->AuthAttrs.rgAttr,
			pcsi->AuthAttrs.cAttr,
			0,
			NULL,
			&fEnrollOnBehalfOf,
			pResult);
	_JumpIfError(hr, error, "pkcsSetAttributes(Authenticated)");

	if (fEnrollOnBehalfOf)
	{
	    pResult->fEnrollOnBehalfOf = TRUE;
	}

	// Pull encrypted private key out of unauthenticated attributes

	hr = pkcsSetAttributes(
			prow,
			EXTENSION_ORIGIN_PKCS7,
			((fTopLevel && fFirstSigner)? 0 :  PSA_DISALLOW_ARCHIVEDKEY) |
			    PSA_DISALLOW_EXTENSIONS |
			    PSA_DISALLOW_NAMEVALUEPAIRS,
			pcsi->UnauthAttrs.rgAttr,
			pcsi->UnauthAttrs.cAttr,
			cbIn,
			fTopLevel? pbIn : NULL,
			NULL,
			pResult);
	_JumpIfError(hr, error, "pkcsSetAttributes(UNauthenticated)");

	if (fFirstSigner)
	{
	    cFirstSigner++;
	}
	else
	{
	    // This is a renewal request, an enroll-on-behalf-of request, a CMC
	    // request or just a request inside a PKCS 7 -- verify the cert
	    // chain for all signers.  If enroll-on-behalf-of on an Enterprise
	    // CA (if requester name is set in the authenticated attributes),
	    // check the signing cert via NTAuth policy and check for
	    // szOID_ENROLLMENT_AGENT usage.  NtAuth verification was added to
	    // control the ability of enroll-on-behalf agents to add usernames
	    // to the PKCS7 wrapper.

	    fNTAuth = pResult->fEnrollOnBehalfOf && IsEnterpriseCA(g_CAType);
	    dwVerifyContextFlags = 0;
	    if (CRLF_REVCHECK_IGNORE_OFFLINE & g_dwCRLFlags)
	    {
		dwVerifyContextFlags |= CA_VERIFY_FLAGS_IGNORE_OFFLINE;
	    }
	    if (fNTAuth)
	    {
		dwVerifyContextFlags |= CA_VERIFY_FLAGS_NT_AUTH;
	    }

	    hr = myVerifyCertContextEx(
			    pCertSigner,
			    dwVerifyContextFlags,
			    (DWORD)(fNTAuth? ARRAYSIZE(apszEnrollOids) : 0),
			    fNTAuth? apszEnrollOids : NULL,
			    HCCE_LOCAL_MACHINE,		// hChainEngine
			    NULL,			// pft
			    hStore,			// hAdditionalStore
			    NULL,			// ppwszMissingIssuer
			    &pwszzIssuancePolicies,
			    &pwszzApplicationPolicies);
	    _JumpIfError(hr, error, "myVerifyCertContextEx");

	    if (fTopLevel)
	    {
		// save Issuance Policies

		hr = pkcsAppendPolicies(
				    prow,
				    wszPROPSIGNERPOLICIES,
				    pwszzIssuancePolicies);
		_JumpIfError(hr, error, "pkcsAppendPolicies");

		// save Application Policies

		hr = pkcsAppendPolicies(
				    prow,
				    wszPROPSIGNERAPPLICATIONPOLICIES,
				    pwszzApplicationPolicies);
		_JumpIfError(hr, error, "pkcsAppendPolicies");
	    }
	}
    }
    if (pResult->fEnrollOnBehalfOf)
    {
	hr = PKCSSetRequestFlags(prow, TRUE, CR_FLG_ENROLLONBEHALFOF);
	_JumpIfError(hr, error, "PKCSSetRequestFlags");

	if (fCMC && cSigner == cFirstSigner)
	{
	    hr = CRYPT_E_NO_TRUSTED_SIGNER;
	    _JumpError(hr, error, "No NTAuth signer");
	}
    }
    if ((fCMC && 1 < cFirstSigner) || (!fCMC && 0 < cFirstSigner))
    {
	hr = NTE_BAD_SIGNATURE;
	_JumpError(hr, error, "cFirstSigner");
    }

error:
    if (NULL != pRequest)
    {
	LocalFree(pRequest);
    }
    if (NULL != pcsi)
    {
	LocalFree(pcsi);
    }
    if (NULL != pwszzIssuancePolicies)
    {
	LocalFree(pwszzIssuancePolicies);
    }
    if (NULL != pwszzApplicationPolicies)
    {
	LocalFree(pwszzApplicationPolicies);
    }
    if (NULL != hMsg)
    {
	CryptMsgClose(hMsg);
    }
    if (NULL != pCertSigner)
    {
	CertFreeCertificateContext(pCertSigner);
    }
    if (NULL != hStore)
    {
	CertCloseStore(hStore, CERT_CLOSE_STORE_CHECK_FLAG);
    }
    if (NULL != pbContents)
    {
	LocalFree(pbContents);
    }
    if (NULL != pszInnerContentObjId)
    {
	LocalFree(pszInnerContentObjId);
    }
    return(hr);
}


typedef struct _REQUESTFORMATS
{
    char const *pszFormat;
    DWORD       dwFlags;
} REQUESTFORMATS;


REQUESTFORMATS g_arf[] = {
    { X509_CERT_REQUEST_TO_BE_SIGNED,   CR_IN_PKCS10 },
    { X509_KEYGEN_REQUEST_TO_BE_SIGNED, CR_IN_KEYGEN },
};
#define CREQUESTFORMATS		ARRAYSIZE(g_arf)


HRESULT
pkcsCrackRequestType(
    IN DWORD cbRequest,
    IN BYTE const *pbRequest,
    OUT DWORD *pdwFlags)
{
    HRESULT hr;
    DWORD cb;
    BYTE *pbDecoded = NULL;
    REQUESTFORMATS const *prf;
    REQUESTFORMATS const *prfEnd;
    HCRYPTMSG hMsg = NULL;
    char *pszInnerContentObjId = NULL;

    prfEnd = &g_arf[CREQUESTFORMATS];
    for (prf = g_arf; prf < prfEnd; prf++)
    {
	CSASSERT(NULL == pbDecoded);
	if (myDecodeObject(
			X509_ASN_ENCODING,
			prf->pszFormat,
			pbRequest,
			cbRequest,
			CERTLIB_USE_LOCALALLOC,
			(VOID **) &pbDecoded,
			&cb))
	{
	    *pdwFlags = prf->dwFlags;
	    break;
	}
	hr = myHLastError();
	CSASSERT(S_OK != hr);
    }
    if (prf >= prfEnd)
    {
	CSASSERT(S_OK != hr);

	hr = myDecodePKCS7(
			pbRequest,
			cbRequest,
			NULL,		// ppbContents
			NULL,		// pcbContents
			NULL,		// pdwMsgType
			&pszInnerContentObjId,
			NULL,		// pcSigner
			NULL,		// pcRecipient
			NULL,		// phStore
			&hMsg);
	_JumpIfError(hr, error, "myDecodePKCS7");

	*pdwFlags = CR_IN_PKCS7;	// default to renewal

	if (NULL != pszInnerContentObjId &&
	    (0 == strcmp(pszInnerContentObjId, szOID_CT_PKI_DATA) ||
	     0 == strcmp(pszInnerContentObjId, szOID_CT_PKI_DATA_OLDRFC)))
	{
	    *pdwFlags = CR_IN_CMC;
	}
    }
    hr = S_OK;

error:
    if (NULL != hMsg)
    {
	CryptMsgClose(hMsg);
    }
    if (NULL != pszInnerContentObjId)
    {
	LocalFree(pszInnerContentObjId);
    }
    if (NULL != pbDecoded)
    {
	LocalFree(pbDecoded);
    }
    return(hr);
}


HRESULT
PKCSParseRequest(
    IN DWORD dwFlags,
    IN ICertDBRow *prow,
    IN DWORD cbRequest,
    IN BYTE const *pbRequest,
    IN CERT_CONTEXT const *pSigningAuthority,
    OPTIONAL OUT BOOL *pfRenewal,
    IN OUT CERTSRV_RESULT_CONTEXT *pResult)
{
    HRESULT hr;

    if (NULL != pfRenewal)
    {
	*pfRenewal = FALSE;
    }

    if (CR_IN_FORMATANY == (CR_IN_FORMATMASK & dwFlags))
    {
	hr = pkcsCrackRequestType(cbRequest, pbRequest, &dwFlags);
	_JumpIfError(hr, error, "pkcsCrackRequestType");

	dwFlags |= ~CR_IN_FORMATMASK & pResult->dwFlagsTop;

	// If this is the top level caller, store a more specific request type:

	if (NULL == pfRenewal)
	{
	    pResult->dwFlagsTop = dwFlags;
	    hr = prow->SetProperty(
		g_wszPropRequestType,
		PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		sizeof(dwFlags),
		(BYTE const *) &dwFlags);
	    _JumpIfError(hr, error, "SetProperty(reqtype)");
	}
    }

    switch (CR_IN_FORMATMASK & dwFlags)
    {
	case CR_IN_PKCS10:
	    hr = pkcsParsePKCS10Request(
				    dwFlags,
				    prow,
				    cbRequest,
				    pbRequest,
				    pSigningAuthority,
				    pfRenewal,
				    pResult);
	    _JumpIfError(hr, error, "pkcsParsePKCS10Request");
	    break;

	case CR_IN_KEYGEN:
	    hr = pkcsParseKeyGenRequest(
				    dwFlags,
				    prow,
				    cbRequest,
				    pbRequest,
				    pResult);
	    _JumpIfError(hr, error, "pkcsParseKeyGenRequest");
	    break;

	case CR_IN_CMC:
	case CR_IN_PKCS7:
	    // PKCS7 requests can either be an 'enroll on behalf of', renewal
	    // request or a CMC request.  We need to recursively unwrap it to
	    // process it.

	    hr = pkcsParsePKCS7Request(
				NULL == pfRenewal,	// fTopLevel
				dwFlags,
				prow,
				cbRequest,
				pbRequest,
				pResult);
	    _JumpIfError(hr, error, "pkcsParsePKCS7Request");

	    break;

	default:
	    hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	    _JumpError(hr, error, "dwFlags");
    }

error:
    if (NULL == pfRenewal)
    {
	HRESULT hr2;
	DWORD cbData;

	hr2 = prow->GetProperty(
		    g_wszPropRequestRawRequest,
		    PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		    &cbData,
		    NULL);
	if (S_OK != hr2)
	{
	    hr2 = prow->SetProperty(
			g_wszPropRequestRawRequest,
			PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_REQUEST,
			cbRequest,
			pbRequest);
	    _PrintIfError(hr2, "SetProperty(request)");
	    if (S_OK == hr)
	    {
		hr = hr2;
	    }
	}
    }
    return(hr);
}


HRESULT
PKCSGetCRLList(
    IN BOOL fDelta,
    IN DWORD iCert,
    OUT WCHAR const * const **ppapwszCRLList)
{
    HRESULT hr = E_INVALIDARG;

    *ppapwszCRLList = NULL;
    if (iCert < g_cCACerts)
    {
	CACTX *pCAContext = &g_aCAContext[iCert];

	if (NULL == pCAContext->pccCA)
	{
	    hr = S_FALSE;
	    goto error;
	}
	*ppapwszCRLList = fDelta?
			    pCAContext->papwszDeltaCRLFiles :
			    pCAContext->papwszCRLFiles;
	if (NULL != *ppapwszCRLList)
	{
	    hr = S_OK;
	}
    }
error:
    return(hr);
}


HRESULT
pkcsBuildCRLList(
    IN BOOL fDelta,
    IN OUT CACTX *pCAContext,
    OUT WCHAR ***ppapwszOut)
{
    HRESULT hr;
    DWORD cFiles;
    CSURLTEMPLATE const *pTemplate;
    CSURLTEMPLATE const *pTemplateEnd;

    cFiles = 0;
    pTemplateEnd = &g_paRevURL[g_caRevURL];
    for (pTemplate = g_paRevURL; pTemplate < pTemplateEnd; pTemplate++)
    {
	if (CSURL_SERVERPUBLISH & pTemplate->Flags)
	{
	    cFiles++;
	}
    }
    *ppapwszOut = (WCHAR **) LocalAlloc(
				LMEM_FIXED | LMEM_ZEROINIT,
				(cFiles + 1) * sizeof((*ppapwszOut)[0]));
    if (NULL == *ppapwszOut)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }
    DBGPRINT((
	DBG_SS_CERTSRVI,
	"CRLList alloc[%u] = %x @%x\n",
	cFiles,
	*ppapwszOut,
	ppapwszOut));

    CSASSERT(NULL != g_strDomainDN && NULL != g_strConfigDN);
    cFiles = 0;
    for (pTemplate = g_paRevURL; pTemplate < pTemplateEnd; pTemplate++)
    {
	if (CSURL_SERVERPUBLISH & pTemplate->Flags)
	{
	    hr = myFormatCertsrvStringArray(
		    FALSE,			// fURL
		    g_pwszServerName,		// pwszServerName_p1_2
		    g_wszSanitizedName,		// pwszSanitizedName_p3_7
		    pCAContext->iKey,		// iCert_p4 -- use iKey!!
		    g_strDomainDN,		// pwszDomainDN_p5
		    g_strConfigDN,		// pwszConfigDN_p6
		    pCAContext->iKey,		// iCRL_p8
		    fDelta,			// fDeltaCRL_p9
		    FALSE,			// fDSAttrib_p10_11
		    1,				// cStrings
		    (LPCWSTR *) &pTemplate->pwszURL, // apwszStringsIn
		    &(*ppapwszOut)[cFiles]);	     // apwszStringsOut
	    _JumpIfError(hr, error, "myFormatCertsrvStringArray");

	    DBGPRINT((
		DBG_SS_CERTSRVI,
		"CRLList format[%u] = %x @%x (%ws)\n",
		cFiles,
		(*ppapwszOut)[cFiles],
		&(*ppapwszOut)[cFiles],
		(*ppapwszOut)[cFiles]));

	    cFiles++;
	}
    }
    (*ppapwszOut)[cFiles] = NULL;
    hr = S_OK;

error:
    // Freeing the CACTX structure during shutdown will free orphaned CRL paths
    return(hr);
}


HRESULT
pkcsBuildKeyAuthority2(
    IN DWORD EditFlags,
    IN CACTX const *pCAContext,
    OUT CRYPT_OBJID_BLOB *pKeyAuthority2)
{
    HRESULT hr = S_OK;
    CERT_AUTHORITY_KEY_ID2_INFO keyAuth;
    CERT_ALT_NAME_ENTRY AltNameEntry;

    if (0 ==
	((EDITF_ENABLEAKIKEYID |
	  EDITF_ENABLEAKIISSUERNAME |
	  EDITF_ENABLEAKIISSUERSERIAL) & EditFlags))
    {
	goto error;
    }
    ZeroMemory(&keyAuth, sizeof(keyAuth));

    // Issuer's KeyId:

    if ((EDITF_ENABLEAKIKEYID & EditFlags) &&
	NULL != pCAContext->IssuerKeyId.pbData)
    {
	keyAuth.KeyId = pCAContext->IssuerKeyId;
    }

    // The Issuer's Issuer name and the Issuer's SerialNumber combined
    // should uniquely identify the Issuer cert.

    // Issuer's Issuer name:
    // -------- ------ ----

    if (EDITF_ENABLEAKIISSUERNAME & EditFlags)
    {
	AltNameEntry.dwAltNameChoice = CERT_ALT_NAME_DIRECTORY_NAME;
	AltNameEntry.DirectoryName = pCAContext->pccCA->pCertInfo->Issuer;
	keyAuth.AuthorityCertIssuer.cAltEntry = 1;
	keyAuth.AuthorityCertIssuer.rgAltEntry = &AltNameEntry;
    }

    // Issuer's SerialNumber:

    if (EDITF_ENABLEAKIISSUERSERIAL & EditFlags)
    {
	keyAuth.AuthorityCertSerialNumber =
	    pCAContext->pccCA->pCertInfo->SerialNumber;
    }

    // put in Key Authority Info

    if (!myEncodeKeyAuthority2(
			X509_ASN_ENCODING,
			&keyAuth,
			CERTLIB_USE_LOCALALLOC,
			&pKeyAuthority2->pbData,
			&pKeyAuthority2->cbData))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myEncodeKeyAuthority2");
    }

error:
    return(hr);
}


HRESULT
pkcsBuildCDP(
    IN DWORD Flags,
    IN BOOL fDelta,
    IN CACTX const *pCAContext,
    OUT CRYPT_OBJID_BLOB *pCDP)
{
    HRESULT hr;
    DWORD i;
    CSURLTEMPLATE const *pTemplate;
    CSURLTEMPLATE const *pTemplateEnd;
    CRL_DIST_POINTS_INFO CRLDistInfo;
    CRL_DIST_POINT CRLDistPoint;
    CERT_ALT_NAME_INFO *pAltInfo;

    ZeroMemory(&CRLDistPoint, sizeof(CRLDistPoint));
    pAltInfo = &CRLDistPoint.DistPointName.FullName;

    pCDP->pbData = NULL;
    pCDP->cbData = 0;

    if (0 != g_caRevURL)
    {
	pTemplateEnd = &g_paRevURL[g_caRevURL];
	for (pTemplate = g_paRevURL; pTemplate < pTemplateEnd; pTemplate++)
	{
	    if (Flags & pTemplate->Flags)
	    {
		pAltInfo->cAltEntry++;
	    }
	}
    }
    if (0 == pAltInfo->cAltEntry)
    {
	hr = S_FALSE;
	goto error;
    }

    CRLDistInfo.cDistPoint = 1;
    CRLDistInfo.rgDistPoint = &CRLDistPoint;

    CRLDistPoint.DistPointName.dwDistPointNameChoice = CRL_DIST_POINT_FULL_NAME;

    pAltInfo->rgAltEntry = (CERT_ALT_NAME_ENTRY *) LocalAlloc(
			LMEM_FIXED | LMEM_ZEROINIT,
			pAltInfo->cAltEntry * sizeof(pAltInfo->rgAltEntry[0]));
    if (NULL == pAltInfo->rgAltEntry)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }

    CSASSERT(NULL != g_strDomainDN && NULL != g_strConfigDN);
    i = 0;
    for (pTemplate = g_paRevURL; pTemplate < pTemplateEnd; pTemplate++)
    {
	if (Flags & pTemplate->Flags)
	{
	    hr = myFormatCertsrvStringArray(
		    TRUE,			// fURL
		    g_pwszServerName,		// pwszServerName_p1_2
		    g_wszSanitizedName,		// pwszSanitizedName_p3_7
		    pCAContext->iCert,		// iCert_p4
		    g_strDomainDN,		// pwszDomainDN_p5
		    g_strConfigDN,		// pwszConfigDN_p6
		    pCAContext->iKey,		// iCRL_p8
		    fDelta,			// fDeltaCRL_p9
		    TRUE,			// fDSAttrib_p10_11
		    1,				// cStrings
		    (LPCWSTR *) &pTemplate->pwszURL,   // apwszStringsIn
		    &pAltInfo->rgAltEntry[i].pwszURL); // apwszStringsOut
	    _JumpIfError(hr, error, "myFormatCertsrvStringArray");

	    pAltInfo->rgAltEntry[i].dwAltNameChoice = CERT_ALT_NAME_URL;
	    i++;
	}
    }
    CSASSERT(pAltInfo->cAltEntry == i);

    if (!myEncodeObject(
		    X509_ASN_ENCODING,
		    X509_CRL_DIST_POINTS,
		    &CRLDistInfo,
		    0,
		    CERTLIB_USE_LOCALALLOC,
		    &pCDP->pbData,
		    &pCDP->cbData))
    {
	hr = myHLastError();
	_JumpIfError(hr, error, "myEncodeObject");
    }
    hr = S_OK;

error:
    if (NULL != pAltInfo->rgAltEntry)
    {
	for (i = 0; i < pAltInfo->cAltEntry; i++)
	{
	    if (NULL != pAltInfo->rgAltEntry[i].pwszURL)
	    {
		LocalFree(pAltInfo->rgAltEntry[i].pwszURL);
	    }
	}
	LocalFree(pAltInfo->rgAltEntry);
    }
    return(hr);
}


HRESULT
pkcsBuildAIA(
    IN DWORD Flags,
    IN CACTX const *pCAContext,
    OUT CRYPT_OBJID_BLOB *pAIA)
{
    HRESULT hr;
    DWORD cAIA;
    DWORD i;
    CSURLTEMPLATE const *pTemplate;
    CSURLTEMPLATE const *pTemplateEnd;
    CERT_AUTHORITY_INFO_ACCESS caio;
    CERT_ACCESS_DESCRIPTION *pcad;

    caio.cAccDescr = 0;
    caio.rgAccDescr = NULL;

    pAIA->pbData = NULL;
    pAIA->cbData = 0;

    cAIA = 0;
    if (0 != g_caRevURL)
    {
	pTemplateEnd = &g_paCACertURL[g_caCACertURL];
	for (pTemplate = g_paCACertURL; pTemplate < pTemplateEnd; pTemplate++)
	{
	    if (Flags & pTemplate->Flags)
	    {
		cAIA++;
	    }
	}
    }
    if (0 == cAIA)
    {
	hr = S_FALSE;
	goto error;
    }

    caio.rgAccDescr = (CERT_ACCESS_DESCRIPTION *) LocalAlloc(
			    LMEM_FIXED | LMEM_ZEROINIT,
			    cAIA * sizeof(caio.rgAccDescr[0]));
    if (NULL == caio.rgAccDescr)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }

    CSASSERT(NULL != g_strDomainDN && NULL != g_strConfigDN);
    for (pTemplate = g_paCACertURL; pTemplate < pTemplateEnd; pTemplate++)
    {
	if (Flags & pTemplate->Flags)
	{
	    pcad = &caio.rgAccDescr[caio.cAccDescr];

	    pcad->pszAccessMethod = (CSURL_ADDTOCERTOCSP & pTemplate->Flags)?
		szOID_PKIX_OCSP : szOID_PKIX_CA_ISSUERS;
	    pcad->AccessLocation.dwAltNameChoice = CERT_ALT_NAME_URL;

	    hr = myFormatCertsrvStringArray(
		    TRUE,			// fURL
		    g_pwszServerName,		// pwszServerName_p1_2
		    g_wszSanitizedName,		// pwszSanitizedName_p3_7
		    pCAContext->iCert,		// iCert_p4
		    g_strDomainDN,		// pwszDomainDN_p5
		    g_strConfigDN,		// pwszConfigDN_p6
		    pCAContext->iKey,		// iCRL_p8
		    FALSE,			// fDeltaCRL_p9
		    TRUE,			// fDSAttrib_p10_11
		    1,				// cStrings
		    (LPCWSTR *) &pTemplate->pwszURL, // apwszStringsIn
		    &pcad->AccessLocation.pwszURL);  // apwszStringsOut

	    _JumpIfError(hr, error, "myFormatCertsrvStringArray");

	    caio.cAccDescr++;
	}
    }
    CSASSERT(caio.cAccDescr == cAIA);

    if (!myEncodeObject(
		    X509_ASN_ENCODING,
		    X509_AUTHORITY_INFO_ACCESS,
		    &caio,
		    0,
		    CERTLIB_USE_LOCALALLOC,
		    &pAIA->pbData,
		    &pAIA->cbData))
    {
	hr = myHLastError();
	_JumpIfError(hr, error, "myEncodeObject");
    }
    hr = S_OK;

error:
    if (NULL != caio.rgAccDescr)
    {
	for (i = 0; i < caio.cAccDescr; i++)
	{
	    pcad = &caio.rgAccDescr[i];
	    if (NULL != pcad->AccessLocation.pwszURL)
	    {
		LocalFree(pcad->AccessLocation.pwszURL);
	    }
	}
	LocalFree(caio.rgAccDescr);
    }
    return(hr);
}


// Find the newest cert with the matching key container name:

HRESULT
pkcsFindMatchingKeyContext(
    OPTIONAL IN CERT_PUBLIC_KEY_INFO *pPublicKeyInfo,
    IN DWORD iKey,
    OUT CACTX **ppCAContext)
{
    HRESULT hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
    DWORD i;
    CACTX *pCAContext;

    *ppCAContext = NULL;
    for (i = g_cCACerts; i > 0; i--)
    {
	pCAContext = &g_aCAContext[i - 1];

	if ((MAXDWORD != iKey && iKey == pCAContext->iKey) ||
	    (NULL != pCAContext->pccCA &&
	     NULL != pPublicKeyInfo &&
	     CertComparePublicKeyInfo(
			X509_ASN_ENCODING,
			pPublicKeyInfo,
			&pCAContext->pccCA->pCertInfo->SubjectPublicKeyInfo)))
	{
	    // by design, CertComparePublicKeyInfo doesn't set last error!

	    *ppCAContext = pCAContext;
	    hr = S_OK;
	    break;
	}
    }
    return(hr);
}


HRESULT
pkcsLoadTemplates(
    IN WCHAR const *pwszRegName,
    OUT CSURLTEMPLATE **ppaURL,
    OUT DWORD *pcaURL)
{
    HRESULT hr;
    WCHAR *pwszzTemplates = NULL;
    WCHAR *pwsz;
    DWORD cTemplate = 0;
    CSURLTEMPLATE *pTemplate;
    DWORD Flags;
    WCHAR *pwsz2;

    *ppaURL = NULL;
    *pcaURL = 0;

    // get (multiple) path templates

    hr = myGetCertRegMultiStrValue(
			    g_wszSanitizedName,
			    NULL,
			    NULL,
			    pwszRegName,
			    &pwszzTemplates);
    _JumpIfError(hr, error, "myGetCertRegStrValue");

    for (pwsz = pwszzTemplates; L'\0' != *pwsz; pwsz += wcslen(pwsz) + 1)
    {
	Flags = _wtoi(pwsz);
	pwsz2 = pwsz;
	while (iswdigit(*pwsz2))
	{
	    pwsz2++;
	}
	if (0 != Flags && pwsz2 > pwsz && L':' == *pwsz2)
	{
	    cTemplate++;
	}
    }
    if (0 != cTemplate)
    {
	*ppaURL = (CSURLTEMPLATE *) LocalAlloc(
				LMEM_FIXED | LMEM_ZEROINIT,
				cTemplate * sizeof((*ppaURL)[0]));
	if (NULL == *ppaURL)
	{
	    hr = E_OUTOFMEMORY;
	    _JumpError(hr, error, "LocalAlloc");
	}
	pTemplate = *ppaURL;
	*pcaURL = cTemplate;

	for (pwsz = pwszzTemplates; L'\0' != *pwsz; pwsz += wcslen(pwsz) + 1)
	{
	    Flags = _wtoi(pwsz);
	    pwsz2 = pwsz;
	    while (iswdigit(*pwsz2))
	    {
		pwsz2++;
	    }
	    if (0 != Flags && pwsz2 > pwsz && L':' == *pwsz2)
	    {
		pTemplate->Flags = Flags;

		hr = myDupString(&pwsz2[1], &pTemplate->pwszURL);
		_JumpIfError(hr, error, "myDupString");

		pTemplate++;
	    }
	}
	CSASSERT(pTemplate == &(*ppaURL)[*pcaURL]);
    }

error:
    if (NULL != pwszzTemplates)
    {
	LocalFree(pwszzTemplates);
    }
    return(hr);
}


VOID
pkcsFreeTemplates(
    IN OUT CSURLTEMPLATE **ppaURL,
    IN OUT DWORD *pcaURL)
{
    CSURLTEMPLATE *pTemplate;
    CSURLTEMPLATE *pTemplateEnd;

    if (0 != *pcaURL && NULL != *ppaURL)
    {
	pTemplateEnd = &(*ppaURL)[*pcaURL];
	for (pTemplate = *ppaURL; pTemplate < pTemplateEnd; pTemplate++)
	{
	    if (NULL != pTemplate->pwszURL)
	    {
		LocalFree(pTemplate->pwszURL);
	    }
	}
	LocalFree(*ppaURL);
	*ppaURL = NULL;
    }
}


HRESULT
pkcsGetCertFilename(
    IN WCHAR const *pwszSanitizedName,
    IN DWORD iCert,
    OUT WCHAR **ppwszCertFile)
{
    HRESULT hr;
    WCHAR wszBuf[MAX_PATH];
    WCHAR *pwszIndexedName = NULL;
    DWORD cwc;

    *ppwszCertFile = NULL;

    hr = myAllocIndexedName(
			pwszSanitizedName,
			iCert,
			&pwszIndexedName);
    _JumpIfError(hr, error, "myAllocIndexedName");

    if (0 == GetEnvironmentVariable(L"SystemRoot", wszBuf, ARRAYSIZE(wszBuf)))
    {
	hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
	_JumpError(hr, error, "GetEnvironmentVariable");
    }
    cwc = wcslen(wszBuf) +
	    WSZARRAYSIZE(L"\\System32\\" wszCERTENROLLSHAREPATH L"\\") +
	    wcslen(g_pwszServerName) +
	    WSZARRAYSIZE(L"_") +
	    wcslen(pwszIndexedName) +
	    WSZARRAYSIZE(L".crt") +
	    1;

    *ppwszCertFile = (WCHAR *) LocalAlloc(LMEM_FIXED, cwc * sizeof(WCHAR));
    if (NULL == *ppwszCertFile)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }

    wcscpy(*ppwszCertFile, wszBuf);
    wcscat(*ppwszCertFile, L"\\System32\\" wszCERTENROLLSHAREPATH L"\\");
    wcscat(*ppwszCertFile, g_pwszServerName);
    wcscat(*ppwszCertFile, L"_");
    wcscat(*ppwszCertFile, pwszIndexedName);
    wcscat(*ppwszCertFile, L".crt");
    CSASSERT(1 + wcslen(*ppwszCertFile) == cwc);

error:
    if (NULL != pwszIndexedName)
    {
	LocalFree(pwszIndexedName);
    }
    return(hr);
}


HRESULT
pkcsReloadMissingCertByHash(
    IN HCERTSTORE hStore,
    IN WCHAR const *pwszSanitizedName,
    IN DWORD dwRegHashChoice,
    IN BYTE const *pbHashReg,
    IN DWORD cbHashReg,
    IN DWORD iHash)
{
    HRESULT hr;
    DWORD cbHash;
    BYTE abHash[CBMAX_CRYPT_HASH_LEN];
    BSTR strHash = NULL;
    ICertDBRow *prow = NULL;
    DWORD cbCert;
    BYTE *pbCert = NULL;
    WCHAR *pwszCertFile = NULL;
    CERT_CONTEXT const *pcc = NULL;

    hr = MultiByteIntegerToBstr(TRUE, cbHashReg, pbHashReg, &strHash);
    _JumpIfError(hr, error, "MultiByteIntegerToBstr");

    DBGPRINT((
	    DBG_SS_CERTSRV,
	    "Reloading %wsContext[%u]\n    %ws\n",
	    CSRH_CASIGCERT == dwRegHashChoice? L"CA" : L"KRA",
	    iHash,
	    strHash));

    hr = g_pCertDB->OpenRow(
			PROPOPEN_READONLY |
			    PROPOPEN_CERTHASH |
			    PROPTABLE_REQCERT,
			0,
			strHash,
			&prow);
    _PrintIfErrorStr(hr, "OpenRow", strHash);
    if (S_OK == hr)
    {
	hr = PKCSGetProperty(
		    prow,
		    g_wszPropRawCertificate,
		    PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		    &cbCert,
		    (BYTE **) &pbCert);
	_JumpIfError(hr, error, "PKCSGetProperty(cert)");
    }
    else if (CSRH_CASIGCERT != dwRegHashChoice)
    {
	_JumpError(hr, error, "OpenRow");
    }
    else
    {
	hr = pkcsGetCertFilename(
			pwszSanitizedName,
			iHash,
			&pwszCertFile);
	_JumpIfError(hr, error, "myGetCertFilename");

	hr = DecodeFileW(pwszCertFile, &pbCert, &cbCert, CRYPT_STRING_ANY);
	_JumpIfError(hr, error, "DecodeFileW");
    }

    pcc = CertCreateCertificateContext(X509_ASN_ENCODING, pbCert, cbCert);
    if (NULL == pcc)
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertCreateCertificateContext");
    }

    cbHash = sizeof(abHash);
    if (!CertGetCertificateContextProperty(
				pcc,
				CERT_SHA1_HASH_PROP_ID,
				abHash,
				&cbHash))
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertGetCertificateContextProperty");
    }
    if (cbHash != cbHashReg || 0 != memcmp(abHash, pbHashReg, cbHash))
    {
	hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	_JumpError(hr, error, "wrong Cert");
    }

    // Add as encoded blob to avoid all properties, key prov info, etc.

    if (!CertAddEncodedCertificateToStore(
			hStore,
			X509_ASN_ENCODING,
			pbCert,
			cbCert,
			CERT_STORE_ADD_REPLACE_EXISTING,
			NULL))			// ppCertContext
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertAddEncodedCertificateToStore");
    }
    DBGPRINT((
	DBG_SS_CERTSRV,
	"Reloaded %wsContext[%u]\n",
	CSRH_CASIGCERT == dwRegHashChoice? L"CA" : L"KRA",
	iHash));
    hr = S_OK;

error:
    if (NULL != pcc)
    {
	CertFreeCertificateContext(pcc);
    }
    if (NULL != pwszCertFile)
    {
	LocalFree(pwszCertFile);
    }
    if (NULL != prow)
    {
	prow->Release();
    }
    if (NULL != pbCert)
    {
	LocalFree(pbCert);
    }
    if (NULL != strHash)
    {
	SysFreeString(strHash);
    }
    return(hr);
}


HRESULT
pkcsReloadMissingCAOrKRACert(
    IN HCERTSTORE hStore,
    IN WCHAR const *pwszSanitizedName,
    IN DWORD dwRegHashChoice,
    IN DWORD iHash)
{
    HRESULT hr;
    BYTE *pbHashReg = NULL;
    DWORD cbHashReg;

    hr = myGetCARegHash(
		    pwszSanitizedName,
		    dwRegHashChoice,
		    iHash,
		    &pbHashReg,
		    &cbHashReg);
    _JumpIfError(hr, error, "myGetCARegHash");

    hr = pkcsReloadMissingCertByHash(
		    hStore,
		    pwszSanitizedName,
		    dwRegHashChoice,
		    pbHashReg,
		    cbHashReg,
		    iHash);
    _JumpIfError(hr, error, "pkcsReloadMissingCertByHash");

error:
    if (NULL != pbHashReg)
    {
	LocalFree(pbHashReg);
    }
    return(hr);
}


VOID
pkcsFreeBlobArray(
    IN DWORD cBlob,
    CERT_BLOB *rgBlob)
{
    DWORD i;

    for (i = 0; i < cBlob; i++)
    {
	if (NULL != rgBlob[cBlob].pbData)
	{
	    LocalFree(rgBlob[i].pbData);
	}
    }
    LocalFree(rgBlob);
}


HRESULT
pkcsGetKRACertBlobs(
    IN ICertDBRow *prow,
    OUT DWORD *pcCertBlob,
    OUT CERT_BLOB **prgCertBlob)
{
    HRESULT hr;
    WCHAR *pwszHashes = NULL;
    WCHAR *pwsz;
    DWORD cb;
    DWORD cHash;
    DWORD i;
    CERT_BLOB *rgBlob = NULL;
    HCERTSTORE hStore = NULL;
    CRYPT_DATA_BLOB HashBlob;
    DWORD cBlobLoaded;
    CERT_CONTEXT const *pcc = NULL;

    HashBlob.pbData = NULL;

    hr = PKCSGetProperty(
		prow,
		g_wszPropRequestKeyRecoveryHashes,
		PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		&cb,
		(BYTE **) &pwszHashes);
    _JumpIfError(hr, error, "PKCSGetProperty(KRA hashes)");

    cHash = 1;
    pwsz = pwszHashes;
    while (TRUE)
    {
	pwsz = wcschr(pwsz, L'\n');
	if (NULL == pwsz)
	{
	    break;
	}
	*pwsz++ = L'\0';
	cHash++;
    }
    cBlobLoaded = 0;
    rgBlob = (CERT_BLOB *) LocalAlloc(
				LMEM_FIXED | LMEM_ZEROINIT,
				cHash * sizeof(rgBlob[0]));
    if (NULL == rgBlob)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }

    // open KRA store

    hStore = CertOpenStore(
			CERT_STORE_PROV_SYSTEM_W,
			X509_ASN_ENCODING,
			NULL,			// hProv
			CERT_SYSTEM_STORE_LOCAL_MACHINE,
			wszKRA_CERTSTORE);
    if (NULL == hStore)
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertOpenStore");
    }

    pwsz = pwszHashes;
    for (i = 0; i < cHash; i++)
    {
	BOOL fReloaded;

	hr = WszToMultiByteInteger(
				TRUE,
				pwsz,
				&HashBlob.cbData,
				&HashBlob.pbData);
	_JumpIfError(hr, error, "WszToMultiByteInteger");

	fReloaded = FALSE;
	while (TRUE)
	{
	    pcc = CertFindCertificateInStore(
					hStore,
					X509_ASN_ENCODING,
					0,
					CERT_FIND_HASH,
					&HashBlob,
					NULL);
	    if (fReloaded || NULL != pcc)
	    {
		break;
	    }
	    hr = pkcsReloadMissingCertByHash(
					hStore,
					g_wszSanitizedName,
					CSRH_CAKRACERT,
					HashBlob.pbData,
					HashBlob.cbData,
					i);
	    _PrintIfError(hr, "pkcsReloadMissingCertByHash");
	    fReloaded = TRUE;
	}
	if (NULL == pcc)
	{
	    hr = myHLastError();
	    _PrintError(hr, "CertFindCertificateInStore");
	}
	else
	{
	    rgBlob[cBlobLoaded].pbData = (BYTE *) LocalAlloc(
							LMEM_FIXED,
							pcc->cbCertEncoded);
	    if (NULL == rgBlob[cBlobLoaded].pbData)
	    {
		hr = E_OUTOFMEMORY;
		_JumpError(hr, error, "LocalAlloc");
	    }
	    rgBlob[cBlobLoaded].cbData = pcc->cbCertEncoded;
	    CopyMemory(
		    rgBlob[cBlobLoaded].pbData,
		    pcc->pbCertEncoded,
		    pcc->cbCertEncoded);
	    cBlobLoaded++;

	    CertFreeCertificateContext(pcc);
	    pcc = NULL;
	}
	pwsz += wcslen(pwsz) + 1;
	LocalFree(HashBlob.pbData);
	HashBlob.pbData = NULL;
    }
    *pcCertBlob = cBlobLoaded;
    *prgCertBlob = rgBlob;
    rgBlob = NULL;

error:
    if (NULL != rgBlob)
    {
	pkcsFreeBlobArray(cBlobLoaded, rgBlob);
    }
    if (NULL != hStore)
    {
	CertCloseStore(hStore, CERT_CLOSE_STORE_CHECK_FLAG);
    }
    if (NULL != pcc)
    {
	CertFreeCertificateContext(pcc);
    }
    if (NULL != HashBlob.pbData)
    {
	LocalFree(HashBlob.pbData);
    }
    if (NULL != pwszHashes)
    {
	LocalFree(pwszHashes);
    }
    return(hr);
}


HRESULT
pkcsGetHashAsOctet(
    IN ICertDBRow *prow,
    OUT BYTE **ppbData,
    OUT DWORD *pcbData)
{
    HRESULT hr;
    WCHAR *pwszHash = NULL;
    DWORD cb;
    CRYPT_DATA_BLOB Blob;
    DWORD cbHash;

    *ppbData = NULL;
    Blob.pbData = NULL;

    hr = PKCSGetProperty(
		prow,
		g_wszPropCertificateHash,
		PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		&cb,
		(BYTE **) &pwszHash);
    _JumpIfError(hr, error, "PKCSGetProperty(hash)");

    hr = WszToMultiByteInteger(TRUE, pwszHash, &Blob.cbData, &Blob.pbData);
    _JumpIfError(hr, error, "WszToMultiByteInteger");

    if (!myEncodeObject(
		    X509_ASN_ENCODING,
		    X509_OCTET_STRING,
		    &Blob,
		    0,
		    CERTLIB_USE_LOCALALLOC,
		    ppbData,
		    pcbData))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myEncodeObject");
    }
    hr = S_OK;

error:
    if (NULL != pwszHash)
    {
	LocalFree(pwszHash);
    }
    if (NULL != Blob.pbData)
    {
	LocalFree(Blob.pbData);
    }
    return(hr);
}


VOID
AddCertBlobToArray(
    IN CERT_CONTEXT const *pcc,
    IN CERT_BLOB *rgCertBlobAll,
    IN CERT_BLOB **ppCertBlob)
{
    CERT_BLOB *pCertBlob = *ppCertBlob;
    DWORD i;
    DWORD cBlob;

    cBlob = SAFE_SUBTRACT_POINTERS(pCertBlob, rgCertBlobAll);
    for (i = 0; i < cBlob; i++)
    {
	if (rgCertBlobAll[i].cbData == pcc->cbCertEncoded &&
	    0 == memcmp(
		    rgCertBlobAll[i].pbData,
		    pcc->pbCertEncoded,
		    pcc->cbCertEncoded))
	{
	    DBGPRINT((
		DBG_SS_CERTSRV,
		"Duplicate Recovery Blob Cert[%u]\n",
		i));
	    goto error;
	}
    }
    DBGPRINT((
	DBG_SS_CERTSRV,
	"Adding Recovery Blob Cert[%u]\n",
	cBlob));
    pCertBlob->cbData = pcc->cbCertEncoded;
    pCertBlob->pbData = pcc->pbCertEncoded;
    pCertBlob++;

    *ppCertBlob = pCertBlob;

error:
    ;
}


HRESULT
PKCSGetArchivedKey(
    IN DWORD dwRequestId,
    OUT BYTE **ppbArchivedKey,	// CoTaskMem*
    OUT DWORD *pcbArchivedKey)
{
    HRESULT hr;
    ICertDBRow *prow = NULL;
    BYTE *pbKey = NULL;
    DWORD cbKey;
    BYTE *pbCertUser = NULL;
    DWORD cbCertUser;
    DWORD cb;
    HCRYPTMSG hMsg = NULL;
    CACTX *pCAContext;
    CMSG_SIGNED_ENCODE_INFO SignedMsgEncodeInfo;
    CMSG_SIGNER_ENCODE_INFO SignerEncodeInfo;
    CERT_CONTEXT const *pccUser = NULL;
    CERT_CHAIN_CONTEXT const *pCertChainContextUser = NULL;
    CERT_CHAIN_PARA CertChainPara;
    CERT_BLOB *rgCertBlobKRA = NULL;
    DWORD cCertBlobKRA;
    CERT_BLOB *rgCertBlobAll = NULL;
    DWORD cCertBlobAll;
    CERT_BLOB *pCertBlob;
    CRYPT_ATTRIBUTE HashAttrib;
    CRYPT_ATTR_BLOB HashAttribBlob;
    DWORD i;

    *ppbArchivedKey = NULL;
    HashAttribBlob.pbData = NULL;

    hr = g_pCertDB->OpenRow(
			PROPOPEN_READONLY | PROPTABLE_REQCERT,
			dwRequestId,
			NULL,
			&prow);
    _JumpIfError(hr, error, "OpenRow");

    hr = PKCSGetProperty(
		prow,
		g_wszPropRequestRawArchivedKey,
		PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		&cbKey,
		&pbKey);
    _JumpIfError(hr, error, "PKCSGetProperty(key)");

    hr = pkcsGetKRACertBlobs(prow, &cCertBlobKRA, &rgCertBlobKRA);
    _JumpIfError(hr, error, "pkcsGetKRACertBlobs");

    hr = pkcsGetHashAsOctet(
		    prow,
		    &HashAttribBlob.pbData,
		    &HashAttribBlob.cbData);
    _JumpIfError(hr, error, "pkcsGetHashAsOctet");

    HashAttrib.pszObjId = szOID_ARCHIVED_KEY_CERT_HASH;
    HashAttrib.cValue = 1;
    HashAttrib.rgValue = &HashAttribBlob;

    hr = PKCSGetProperty(
		prow,
		g_wszPropRawCertificate,
		PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		&cbCertUser,
		&pbCertUser);
    _JumpIfError(hr, error, "PKCSGetProperty(cert)");

    pccUser = CertCreateCertificateContext(
				    X509_ASN_ENCODING,
				    pbCertUser,
				    cbCertUser);
    if (NULL == pccUser)
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertCreateCertificateContext");
    }

    // build the user cert chain

    ZeroMemory(&CertChainPara, sizeof(CertChainPara));
    CertChainPara.cbSize = sizeof(CertChainPara);

    if (!CertGetCertificateChain(
			    HCCE_LOCAL_MACHINE,
			    pccUser,
			    NULL,
			    NULL,
			    &CertChainPara,
			    0,
			    NULL,
			    &pCertChainContextUser))
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertGetCertificateChain");
    }

    // make sure there is at least 1 simple chain

    if (0 == pCertChainContextUser->cChain)
    {
	hr = E_INVALIDARG;
	_JumpError(hr, error, "No user chain");
    }

    // Encode the encrypted key into a PKCS 7, signed by the current CA cert.
    // Initialize the CMSG_SIGNER_ENCODE_INFO structure for one signer.

    pCAContext = g_pCAContextCurrent;
    cCertBlobAll = cCertBlobKRA +
		   pCAContext->cCACertChain +
		   pCertChainContextUser->rgpChain[0]->cElement;

    rgCertBlobAll = (CERT_BLOB *) LocalAlloc(
				    LMEM_FIXED,
				    cCertBlobAll * sizeof(rgCertBlobAll[0]));
    if (NULL == rgCertBlobAll)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }
    pCertBlob = rgCertBlobAll;

    CopyMemory(pCertBlob, rgCertBlobKRA, cCertBlobKRA * sizeof(pCertBlob[0]));
    pCertBlob += cCertBlobKRA;

    // Add the current CA cert chain

    for (i = 0; i < pCAContext->cCACertChain; i++)
    {
	AddCertBlobToArray(
		    pCAContext->apCACertChain[i],
		    rgCertBlobAll,
		    &pCertBlob);
    }

    // Add the user cert chain

    {
	CERT_SIMPLE_CHAIN *pSimpleChain;

	pSimpleChain = pCertChainContextUser->rgpChain[0];
	for (i = 0; i < pSimpleChain->cElement; i++)
	{
	    AddCertBlobToArray(
			pSimpleChain->rgpElement[i]->pCertContext,
			rgCertBlobAll,
			&pCertBlob);
	}
    }
    CSASSERT(pCertBlob <= &rgCertBlobAll[cCertBlobAll]);
    DBGPRINT((
	DBG_SS_CERTSRV,
	"Recovery Certs: %u --> %u\n",
	cCertBlobAll,
	SAFE_SUBTRACT_POINTERS(pCertBlob, rgCertBlobAll)));
    cCertBlobAll = SAFE_SUBTRACT_POINTERS(pCertBlob, rgCertBlobAll);

    ZeroMemory(&SignerEncodeInfo, sizeof(SignerEncodeInfo));
    SignerEncodeInfo.cbSize = sizeof(SignerEncodeInfo);
    SignerEncodeInfo.pCertInfo = pCAContext->pccCA->pCertInfo;
    SignerEncodeInfo.hCryptProv = pCAContext->hProvCA;
    SignerEncodeInfo.dwKeySpec = AT_SIGNATURE;
    SignerEncodeInfo.HashAlgorithm.pszObjId = szOID_OIWSEC_sha1;
    SignerEncodeInfo.cAuthAttr = 1;
    SignerEncodeInfo.rgAuthAttr = &HashAttrib;
    //SignerEncodeInfo.cUnauthAttr = 0;
    //SignerEncodeInfo.rgUnauthAttr = NULL;
    //SignerEncodeInfo.HashEncryptionAlgorithm.pszObjId = ???;

    // CERT_ID_SHA1_HASH is not yet implemented in CryptMsgOpenToEncode
    //SignerEncodeInfo.SignerId.dwIdChoice = CERT_ID_SHA1_HASH;
    //SignerEncodeInfo.SignerId.HashId.cbData = cb;
    //SignerEncodeInfo.SignerId.HashId.pbData = abHash;

    ZeroMemory(&SignedMsgEncodeInfo, sizeof(SignedMsgEncodeInfo));
    SignedMsgEncodeInfo.cbSize = sizeof(SignedMsgEncodeInfo);
    SignedMsgEncodeInfo.cSigners = 1;
    SignedMsgEncodeInfo.rgSigners = &SignerEncodeInfo;
    SignedMsgEncodeInfo.cCertEncoded = cCertBlobAll;
    SignedMsgEncodeInfo.rgCertEncoded = rgCertBlobAll;
    //SignedMsgEncodeInfo.cCrlEncoded = 0;
    //SignedMsgEncodeInfo.rgCrlEncoded = NULL;

    hMsg = CryptMsgOpenToEncode(
			    PKCS_7_ASN_ENCODING | X509_ASN_ENCODING,
			    0,				// dwFlags
			    CMSG_SIGNED,		// dwMsgType
			    &SignedMsgEncodeInfo,	// pvMsgEncodeInfo
			    NULL,			// pszInnerContentObjID
			    NULL);			// pStreamInfo
    if (NULL == hMsg)
    {
	hr = myHLastError();
	_JumpError(hr, error, "CryptMsgOpenToDecode");
    }

    if (!CryptMsgUpdate(hMsg, pbKey, cbKey, TRUE))
    {
	hr = myHLastError();
	_JumpError(hr, error, "CryptMsgUpdate");
    }

    // Return the encoded and signed content.
    // Use CMSG_CONTENT_PARAM to get the signed message.

    hr = myCryptMsgGetParam(
		    hMsg,
		    CMSG_CONTENT_PARAM,
		    0,
		    CERTLIB_USE_COTASKMEMALLOC,
		    (VOID **) ppbArchivedKey,
		    pcbArchivedKey);
    _JumpIfError(hr, error, "myCryptMsgGetParam");

error:
    if (pCertChainContextUser != NULL)
    {
	CertFreeCertificateChain(pCertChainContextUser);
    }
    if (NULL != pccUser)
    {
	CertFreeCertificateContext(pccUser);
    }
    if (NULL != hMsg)
    {
	CryptMsgClose(hMsg);
    }
    if (NULL != rgCertBlobKRA)
    {
	pkcsFreeBlobArray(cCertBlobKRA, rgCertBlobKRA);
    }
    if (NULL != rgCertBlobAll)
    {
	LocalFree(rgCertBlobAll);
    }
    if (NULL != HashAttribBlob.pbData)
    {
	LocalFree(HashAttribBlob.pbData);
    }
    if (NULL != pbKey)
    {
	LocalFree(pbKey);
    }
    if (NULL != pbCertUser)
    {
	LocalFree(pbCertUser);
    }
    if (NULL != prow)
    {
	prow->Release();
    }
    return(hr);
}


HRESULT
pkcsGetKeyContainerName(
    IN CERT_CONTEXT const *pccCA,
    OUT WCHAR **ppwszKeyContainerName)
{
    HRESULT hr;
    CRYPT_HASH_BLOB KeyIdentifier;
    CRYPT_KEY_PROV_INFO *pkpi = NULL;
    DWORD cb;

    KeyIdentifier.pbData = NULL;
    *ppwszKeyContainerName = NULL;

    hr = myGetPublicKeyHash(
			pccCA->pCertInfo,
			&pccCA->pCertInfo->SubjectPublicKeyInfo,
			&KeyIdentifier.pbData,
			&KeyIdentifier.cbData);
    _JumpIfError(hr, error, "myGetPublicKeyHash");

    cb = 0;
    while (TRUE)
    {
	if (!CryptGetKeyIdentifierProperty(
			    &KeyIdentifier,
			    CERT_KEY_PROV_INFO_PROP_ID,
			    CRYPT_KEYID_MACHINE_FLAG,
			    NULL,			// pwszComputerName
			    NULL,			// pvReserved
			    pkpi,
			    &cb))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "Cert index");
	}
	if (NULL != pkpi)
	{
	    break;
	}
	pkpi = (CRYPT_KEY_PROV_INFO *) LocalAlloc(LMEM_FIXED, cb);
	if (NULL == pkpi)
	{
	    hr = E_OUTOFMEMORY;
	    _JumpError(hr, error, "LocalAlloc");
	}
    }
    hr = myDupString(pkpi->pwszContainerName, ppwszKeyContainerName);
    _JumpIfError(hr, error, "myDupString");

error:
    if (NULL != pkpi)
    {
	LocalFree(pkpi);
    }
    if (NULL != KeyIdentifier.pbData)
    {
	LocalFree(KeyIdentifier.pbData);
    }
    return(hr);
}


HRESULT
pkcsLoadCAContext(
    IN WCHAR const *pwszSanitizedName,
    IN WCHAR *pwszProvName,
    IN DWORD dwProvType,
    IN ALG_ID idAlg,
    IN BOOL fMachineKeyset,
    IN DWORD iHash,
    IN HCERTSTORE hMyStore)
{
    HRESULT hr;
    HCRYPTPROV hProvCA = NULL;
    char *pszObjIdSignatureAlgorithm = NULL;
    WCHAR *pwszKeyContainerName = NULL;
    CERT_CONTEXT const *pccCA = NULL;
    DWORD cCACertChain;
    CERT_CONTEXT const **apCACertChain = NULL;
    CERT_CHAIN_CONTEXT const *pCertChainContext = NULL;
    CERT_CHAIN_PARA CertChainPara;
    CRYPT_KEY_PROV_INFO *pKey = NULL;
    CACTX *pCAContext;
    DWORD i;
    DWORD cbKey;
    DWORD iCert;
    DWORD iKey;
    DWORD NameId;
    BOOL fReloaded;

    hr = myGetSigningOID(
		    NULL,	// hProv
		    pwszProvName,
		    dwProvType,
		    idAlg,
		    &pszObjIdSignatureAlgorithm);
    _JumpIfError(hr, error, "myGetSigningOID");

    if (~_16BITMASK & iHash)
    {
	hr = E_INVALIDARG;
	_JumpError(hr, error, "Cert index");
    }

    fReloaded = FALSE;
    while (TRUE)
    {
	hr = myFindCACertByHashIndex(
				hMyStore,
				pwszSanitizedName,
				CSRH_CASIGCERT,
				iHash,
				&NameId,
				&pccCA);
	iCert = iHash;
	iKey = iCert;
	if (S_OK == hr)
	{
	    break;
	}

	// if no hash entry exists for this index, fake up a CA Context
	// as a place holder.

	if (S_FALSE == hr)
	{
	    CSASSERT(MAXDWORD == NameId);
	    CSASSERT(NULL == pccCA);
	    break;
	}
	if (fReloaded || CRYPT_E_NOT_FOUND != hr)
	{
	    _JumpError(hr, error, "myFindCACertByHashIndex");
	}
	_PrintError(hr, "myFindCACertByHashIndex");

	// The CA cert is missing from the HKLM "my" store -- look it up in
	// the DB or the CertEnroll directory, and put it back in the store.

	hr = pkcsReloadMissingCAOrKRACert(
				hMyStore,
				pwszSanitizedName,
				CSRH_CASIGCERT,
				iHash);
	_JumpIfError(hr, error, "pkcsReloadMissingCAOrKRACert");

	fReloaded = TRUE;
    }

    CSASSERT(S_FALSE == hr || S_OK == hr);
    if (S_OK == hr)
    {
	if (MAXDWORD != NameId && iCert != CANAMEIDTOICERT(NameId))
	{
	    hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	    DBGPRINT((
		DBG_SS_CERTSRV,
		"NameId=%u.%u iCert=%u\n",
		CANAMEIDTOICERT(NameId),
		CANAMEIDTOIKEY(NameId),
		iCert));
	    _JumpError(hr, error, "bad iCert");
	}

	fReloaded = FALSE;
	while (TRUE)
	{
	    if (NULL != pwszKeyContainerName)
	    {
		LocalFree(pwszKeyContainerName);
		pwszKeyContainerName = NULL;
	    }
	    if (!fReloaded)
	    {
		// get the private key provider info

		if (!myCertGetCertificateContextProperty(
						pccCA,
						CERT_KEY_PROV_INFO_PROP_ID,
						CERTLIB_USE_LOCALALLOC,
						(VOID **) &pKey,
						&cbKey))
		{
		    hr = myHLastError();
		    if (CRYPT_E_NOT_FOUND != hr)
		    {
			_JumpError(hr, error, "myCertGetCertificateContextProperty");
		    }
		    _PrintError(hr, "CertGetCertificateContextProperty");

		    // The Key Provider Info is missing -- use the sanitized
		    // name and key index to construct the key container name.
		    // If that key matches, we'll write out the new Key
		    // Provider Info below.

		    hr = myAllocIndexedName(
			    pwszSanitizedName,
			    MAXDWORD != NameId? CANAMEIDTOIKEY(NameId) : iCert,
			    &pwszKeyContainerName);
		    _JumpIfError(hr, error, "myAllocIndexedName");
		}
		else
		{
		    hr = myDupString(pKey->pwszContainerName, &pwszKeyContainerName);
		    _JumpIfError(hr, error, "myDupString");
		}
	    }
	    else
	    {
		hr = pkcsGetKeyContainerName(pccCA, &pwszKeyContainerName);
		_JumpIfError(hr, error, "pkcsGetKeyContainerName");
	    }

	    // signing testing

	    hr = myValidateHashForSigning(
				pwszKeyContainerName,
				pwszProvName,
				dwProvType,
				fMachineKeyset,
				&pccCA->pCertInfo->SubjectPublicKeyInfo,
				idAlg);
	    if (S_OK == hr)
	    {
		break;
	    }
	    if (fReloaded)
	    {
		_JumpError(hr, error, "myValidateHashForSigning");
	    }
	    _PrintError(hr, "myValidateHashForSigning");

	    fReloaded = TRUE;
	}

	// If the Key Provider Info is missing, write out new Key Provider Info

	if (NULL == pKey)
	{
	    CRYPT_KEY_PROV_INFO kpi;

	    ZeroMemory(&kpi, sizeof(kpi));
	    kpi.pwszContainerName = pwszKeyContainerName;
	    kpi.pwszProvName = pwszProvName;
	    kpi.dwProvType = dwProvType;
	    kpi.dwFlags = fMachineKeyset? CRYPT_MACHINE_KEYSET : 0;
	    kpi.dwKeySpec = AT_SIGNATURE;

	    if (!CertSetCertificateContextProperty(
					    pccCA,
					    CERT_KEY_PROV_INFO_PROP_ID,
					    0,
					    &kpi))
	    {
		hr = myHLastError();
		_JumpError(hr, error, "CertSetCertificateContextProperty");
	    }
	    DBGPRINT((
		DBG_SS_CERTSRV,
		"Reloaded CAContext[%u] KeyProvInfo[%u]\n",
		iCert,
		iKey));
	}

	hr = pkcsFindMatchingKeyContext(
			    &pccCA->pCertInfo->SubjectPublicKeyInfo,
			    MAXDWORD,
			    &pCAContext);
	if (S_OK != hr && MAXDWORD != NameId)
	{
	    iKey = CANAMEIDTOIKEY(NameId);
	    if (iKey < iCert)
	    {
		hr = pkcsFindMatchingKeyContext(NULL, iKey, &pCAContext);
		_JumpIfError(hr, error, "pkcsFindMatchingKeyContext");
	    }
	}
	if (S_OK == hr)
	{
	    iKey = pCAContext->iKey;
	    if (MAXDWORD != NameId && iKey != CANAMEIDTOIKEY(NameId))
	    {
		hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
		_JumpError(hr, error, "bad iKey");
	    }
	    if (NULL == pCAContext->pccCA)
	    {
		CSASSERT(pCAContext->Flags & CTXF_CERTMISSING);
		pCAContext->Flags |= CTXF_CRLZOMBIE;
	    }
	    else
	    {
		CSASSERT(0 == (pCAContext->Flags & CTXF_CERTMISSING));
		pCAContext->Flags |= CTXF_SKIPCRL;
	    }
	}
	else
	{
	    g_cCAKeys++;	// this key has not previously been loaded
	}

	DBGPRINT((
	    DBG_SS_CERTSRV,
	    "CAContext[%u]: Key %u: %ws\n",
	    iCert,
	    iKey,
	    pwszKeyContainerName));

	// get private key handler for later use if current CA

	if (!myCertSrvCryptAcquireContext(
				   &hProvCA,
				   pwszKeyContainerName,
				   pwszProvName,
				   dwProvType,
				   g_fCryptSilent? CRYPT_SILENT : 0,
				   fMachineKeyset))
	{
	    hr = myHLastError();
	    _JumpErrorStr(
			hr,
			error,
			"myCertSrvCryptAcquireContext",
			pwszKeyContainerName);
	}

	// now try to figure out the chain

	ZeroMemory(&CertChainPara, sizeof(CertChainPara));
	CertChainPara.cbSize = sizeof(CertChainPara);

	if (!CertGetCertificateChain(
				HCCE_LOCAL_MACHINE,
				pccCA,
				NULL,
				NULL,
				&CertChainPara,
				0,
				NULL,
				&pCertChainContext))
	{
	    hr = myHLastError();
	    goto error;
	}

	// make sure there is at least 1 simple chain

	if (pCertChainContext->cChain == 0)
	{
	    hr = E_INVALIDARG;
	    _JumpError(hr, error, "No valid trust chain could be formed");
	}

	// tell global how many elements we have in our chain

	cCACertChain = pCertChainContext->rgpChain[0]->cElement;

	// Allocate memory for global.  Allocate one extra pointer to allow loop
	// to assign NULL pointer in place in array.  Leave the count set to the
	// actual number of CA cert contexts, excluding the NULL pointer.

	apCACertChain = (CERT_CONTEXT const **) LocalAlloc(
				    LMEM_FIXED,
				    (cCACertChain + 1) * sizeof(apCACertChain[0]));
	if (NULL == apCACertChain)
	{
	    hr = E_OUTOFMEMORY;
	    _JumpError(hr, error, "LocalAlloc");
	}

	// copy chain in reverse order: from parent to child

	{
	    int i;

	    for (i = cCACertChain - 1; i >= 0; i--)
	    {
		apCACertChain[i] = CertDuplicateCertificateContext(
		    pCertChainContext->rgpChain[0]->rgpElement[i]->pCertContext);

		if (NULL == apCACertChain[i])
		{
		    hr = myHLastError();
		    _JumpError(hr, error, "CertDuplicateCertificateContext");
		}
	    }
	}
    }

    for (i = 0; i < g_cCACerts; i++)
    {
	if (iCert < g_aCAContext[i].iCert)
	{
	    MoveMemory(
		    &g_aCAContext[i + 1],
		    &g_aCAContext[i],
		    (g_cCACerts - i) * sizeof(g_aCAContext[0]));
	    break;
	}
    }
    g_cCACerts++;

    pCAContext = &g_aCAContext[i];
    ZeroMemory(pCAContext, sizeof(*pCAContext));

    if (NULL == pccCA)
    {
	pCAContext->Flags |= CTXF_CERTMISSING | CTXF_SKIPCRL;
    }
    pCAContext->iCert = iCert;
    pCAContext->iKey = iKey;
    pCAContext->NameId = MAKECANAMEID(iCert, iKey);

    pCAContext->hProvCA = hProvCA;
    hProvCA = NULL;

    pCAContext->pccCA = pccCA;
    pccCA = NULL;

    if (NULL != apCACertChain)
    {
	pCAContext->cCACertChain = cCACertChain;
	pCAContext->apCACertChain = apCACertChain;
	apCACertChain = NULL;
    }

    pCAContext->pszObjIdSignatureAlgorithm = pszObjIdSignatureAlgorithm;
    pszObjIdSignatureAlgorithm = NULL;

    pCAContext->pwszKeyContainerName = pwszKeyContainerName;
    pwszKeyContainerName = NULL;


    // Ignore failure from here on -- collected data is optional

    if (NULL != pCAContext->pccCA)
    {
	hr = myGetPublicKeyHash(
			pCAContext->pccCA->pCertInfo,
			&pCAContext->pccCA->pCertInfo->SubjectPublicKeyInfo,
			&pCAContext->IssuerKeyId.pbData,
			&pCAContext->IssuerKeyId.cbData);
	_PrintIfError(hr, "myGetPublicKeyHash");

	if (0 == (CTXF_SKIPCRL & pCAContext->Flags))
	{
	    hr = pkcsBuildKeyAuthority2(
				g_CRLEditFlags,
				pCAContext,
				&pCAContext->KeyAuthority2CRL);
	    _PrintIfError(hr, "pkcsBuildKeyAuthority2");

	    hr = pkcsBuildCDP(
			CSURL_ADDTOFRESHESTCRL,
			TRUE,
			pCAContext,
			&pCAContext->CDPCRLFreshest);
	    _PrintIfError(hr, "pkcsBuildCDP");

	    hr = pkcsBuildCDP(
			CSURL_ADDTOCRLCDP,
			FALSE,
			pCAContext,
			&pCAContext->CDPCRLBase);
	    _PrintIfError(hr, "pkcsBuildCDP");

	    hr = pkcsBuildCDP(
			CSURL_ADDTOCRLCDP,
			TRUE,
			pCAContext,
			&pCAContext->CDPCRLDelta);
	    _PrintIfError(hr, "pkcsBuildCDP");

	    hr = pkcsBuildCRLList(
				FALSE,
				pCAContext,
				&pCAContext->papwszCRLFiles);
	    _JumpIfError(hr, error, "pkcsBuildCRLList");

	    hr = pkcsBuildCRLList(
				TRUE,
				pCAContext,
				&pCAContext->papwszDeltaCRLFiles);
	    _JumpIfError(hr, error, "pkcsBuildCRLList");
	}
    }
    hr = S_OK;

error:
    if (NULL != hProvCA)
    {
	CryptReleaseContext(hProvCA, 0);
    }
    if (NULL != pszObjIdSignatureAlgorithm)
    {
	LocalFree(pszObjIdSignatureAlgorithm);
    }
    if (NULL != pwszKeyContainerName)
    {
	LocalFree(pwszKeyContainerName);
    }
    if (NULL != pKey)
    {
	LocalFree(pKey);
    }
    if (pCertChainContext != NULL)
    {
	CertFreeCertificateChain(pCertChainContext);
    }
    if (NULL != pccCA)
    {
	CertFreeCertificateContext(pccCA);
    }
    return(hr);
}


HRESULT
pkcsLoadCAContextArray(
    IN WCHAR const *pwszCommonName,
    IN WCHAR const *pwszSanitizedName)
{
    HRESULT hr;
    DWORD cCACerts;
    HCERTSTORE hMyStore = NULL;
    WCHAR *pwszProvName = NULL;
    DWORD dwProvType;
    ALG_ID idAlg;
    BOOL fMachineKeyset;
    DWORD iHash;

    // get provider name

    hr = myGetCertSrvCSP(
		    FALSE,	// fEncryptionCSP
		    pwszSanitizedName,
		    &dwProvType,
		    &pwszProvName,
		    &idAlg,
		    &fMachineKeyset,
		    NULL);	// pdwKeySize
    _JumpIfError(hr, error, "myGetCertSrvCSP");

    // open MY store

    hMyStore = CertOpenStore(
		       CERT_STORE_PROV_SYSTEM_W,
		       X509_ASN_ENCODING,
		       NULL,			// hProv
		       CERT_SYSTEM_STORE_LOCAL_MACHINE,
		       wszMY_CERTSTORE);
    if (NULL == hMyStore)
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertOpenStore");
    }

    // find & load CA certs, etc.

    hr = myGetCARegHashCount(pwszSanitizedName, CSRH_CASIGCERT, &cCACerts);
    if (S_OK == hr && 0 == cCACerts)
    {
	hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
    }
    _JumpIfError(hr, error, "myGetCARegHashCount");

    g_aCAContext = (CACTX *) LocalAlloc(
				    LMEM_FIXED | LMEM_ZEROINIT,
				    cCACerts * sizeof(g_aCAContext[0]));
    if (NULL == g_aCAContext)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }

    for (iHash = 0; iHash < cCACerts; iHash++)
    {
	hr = pkcsLoadCAContext(
			pwszSanitizedName,
			pwszProvName,
			dwProvType,
			idAlg,
			fMachineKeyset,
			iHash,
			hMyStore);
	if (S_FALSE == hr)
	{
	    continue;
	}
	_JumpIfError(hr, error, "pkcsLoadCAContext");
    }

    g_pCAContextCurrent = &g_aCAContext[g_cCACerts - 1];

    // Only build a Key Authority extension for the current CACTX -- it's the
    // only one used to issue certs.

    hr = pkcsBuildKeyAuthority2(
			EDITF_ENABLEAKIKEYID |
			    EDITF_ENABLEAKIISSUERNAME |
			    EDITF_ENABLEAKIISSUERSERIAL,
			g_pCAContextCurrent,
			&g_pCAContextCurrent->KeyAuthority2Cert);
    _PrintIfError(hr, "pkcsBuildKeyAuthority2");

    // Only build a CDP extension for the current CACTX -- it's the
    // only one used to issue certs.

    hr = pkcsBuildCDP(
		CSURL_ADDTOCERTCDP,
		FALSE,
		g_pCAContextCurrent,
		&g_pCAContextCurrent->CDPCert);
    _PrintIfError(hr, "pkcsBuildCDP");

    // Only build a CDP extension for the current CACTX -- it's the
    // only one used to issue certs.

    hr = pkcsBuildAIA(
		CSURL_ADDTOCERTCDP | CSURL_ADDTOCERTOCSP,
		g_pCAContextCurrent,
		&g_pCAContextCurrent->AIACert);
    _PrintIfError(hr, "pkcsBuildAIA");

    hr = S_OK;

error:
    if (NULL != pwszProvName)
    {
	LocalFree(pwszProvName);
    }
    if (NULL != hMyStore)
    {
	CertCloseStore(hMyStore, CERT_CLOSE_STORE_CHECK_FLAG);
    }
    return(hr);
}


HRESULT
pkcsImportCAOrKRACert(
    IN CERT_CONTEXT const *pcc,
    IN DWORD DBDisposition,
    OPTIONAL IN CACTX const *pCAContext)
{
    HRESULT hr;
    BYTE abHash[CBMAX_CRYPT_HASH_LEN];
    DWORD cbHash;
    BSTR strHash = NULL;
    ICertDBRow *prow = NULL;
    WCHAR *pwszUserName = NULL;
    DWORD cb;
    BOOL fCommit = FALSE;
    BOOL fCommitted = FALSE;

    cbHash = sizeof(abHash);
    if (!CertGetCertificateContextProperty(
			pcc,
			CERT_HASH_PROP_ID,
			abHash,
			&cbHash))
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertGetCertificateContextProperty");
    }

    hr = MultiByteIntegerToBstr(TRUE, cbHash, abHash, &strHash);
    _JumpIfError(hr, error, "MultiByteIntegerToBstr");

    // Import Cert if it doesn't already exist in DB:

    hr = g_pCertDB->OpenRow(
			PROPOPEN_CERTHASH | PROPTABLE_REQCERT,
			0,
			strHash,
			&prow);
    if (S_OK != hr)
    {
	CSASSERT(CERTSRV_E_PROPERTY_EMPTY == hr);

	hr = g_pCertDB->OpenRow(PROPTABLE_REQCERT, 0, NULL, &prow);
	_JumpIfError(hr, error, "OpenRow");

	hr = PKCSParseImportedCertificate(
				    DBDisposition,
				    prow,
				    pCAContext,
				    pcc);
	_JumpIfError(hr, error, "PKCSParseImportedCertificate");

	fCommit = TRUE;
    }

    // Set requester name if missing

    hr = prow->GetProperty(
		g_wszPropRequesterName,
		PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		&cb,
		NULL);
    if (CERTSRV_E_PROPERTY_EMPTY == hr)
    {
	hr = myGetComputerObjectName(NameSamCompatible, &pwszUserName);
	if (S_OK != hr)
	{
	    _PrintError(hr, "myGetComputerObjectName");

	    hr = myGetUserNameEx(NameSamCompatible, &pwszUserName);
	    _JumpIfError(hr, error, "myGetUserNameEx");
	}

	hr = prow->SetProperty(
		    g_wszPropRequesterName,
		    PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		    MAXDWORD,
		    (BYTE const *) pwszUserName);
	_JumpIfError(hr, error, "SetProperty");

	hr = prow->SetProperty(
		    g_wszPropCallerName,
		    PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		    MAXDWORD,
		    (BYTE const *) pwszUserName);
	_JumpIfError(hr, error, "SetProperty");

	fCommit = TRUE;
    }
    hr = prow->CommitTransaction(fCommit);
    _JumpIfError(hr, error, "CommitTransaction");

    fCommitted = TRUE;
    hr = S_OK;

error:
    if (NULL != prow)
    {
	if (S_OK != hr && !fCommitted)
	{
	    HRESULT hr2 = prow->CommitTransaction(FALSE);
	    _PrintIfError(hr2, "CommitTransaction");
	}
	prow->Release();
    }
    if (NULL != pwszUserName)
    {
	LocalFree(pwszUserName);
    }
    if (NULL != strHash)
    {
	SysFreeString(strHash);
    }
    return(hr);
}


HRESULT
pkcsImportCAContext(
    IN CACTX const *pCAContext)
{
    HRESULT hr;
    HRESULT hr2;
    DWORD i;

    hr = S_OK;
    for (i = 0; i < pCAContext->cCACertChain; i++)
    {
	CERT_CONTEXT const *pCert = pCAContext->apCACertChain[i];

	hr2 = pkcsImportCAOrKRACert(
			    pCert,
			    0 == i? DB_DISP_CA_CERT : DB_DISP_CA_CERT_CHAIN,
			    pCAContext);
	if (S_OK != hr2)
	{
	    if (S_OK == hr)
	    {
		hr = hr2;	// return first error
	    }
	    _PrintError(hr2, "pkcsImportCAOrKRACert");
	    continue;
	}
    }
    _JumpIfError(hr, error, "pkcsImportCAOrKRACert");

error:
    return(hr);
}


HRESULT
pkcsImportCAContextArray()
{
    HRESULT hr = S_OK;
    HRESULT hr2;
    DWORD i;

    for (i = 0; i < g_cCACerts; i++)
    {
	CACTX *pCAContext = &g_aCAContext[i];

	if (NULL == pCAContext->pccCA)
	{
	    continue;
	}
	hr2 = pkcsImportCAContext(pCAContext);
	if (S_OK != hr2)
	{
	    _PrintError(hr2, "pkcsImportCAContext");
	    if (S_OK == hr)
	    {
		hr = hr2;	// return first error
	    }
	}
    }

//error:
    return(hr);
}

PCCERT_CONTEXT pkcsFindCertificateInOtherStore(
    IN HCERTSTORE hOtherStore,
    IN PCCERT_CONTEXT pCert
    )
{
    BYTE rgbHash[SHA1_HASH_LENGTH];
    CRYPT_DATA_BLOB HashBlob;

    HashBlob.pbData = rgbHash;
    HashBlob.cbData = SHA1_HASH_LENGTH;
    if (!CertGetCertificateContextProperty(
            pCert,
            CERT_SHA1_HASH_PROP_ID,
            rgbHash,
            &HashBlob.cbData
            ) || SHA1_HASH_LENGTH != HashBlob.cbData)
        return NULL;

    return CertFindCertificateInStore(
            hOtherStore,
            X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,      // dwCertEncodingType
            0,                  // dwFindFlags
            CERT_FIND_SHA1_HASH,
            (const void *) &HashBlob,
            NULL                //pPrevCertContext
            );
}

HRESULT pkcsObtainNTAuthStore(IN HCERTSTORE *phCertStore)
{
    HRESULT         hr=E_INVALIDARG;
    HCERTSTORE      hEnterpriseStore = NULL;

    LPWSTR          pwszLdapStore=NULL;
    

    if((NULL==phCertStore) || (NULL==g_strConfigDN))
	    _JumpError(hr, error, "LocalAlloc for pwazLdapStore");

    *phCertStore=NULL;

    pwszLdapStore = (LPWSTR)LocalAlloc(LPTR, sizeof(WCHAR)*(wcslen(g_strConfigDN)+wcslen(g_wszNTAuth)));

    if(pwszLdapStore == NULL)
    {
        hr = E_OUTOFMEMORY;
	    _JumpError(hr, error, "LocalAlloc for pwazLdapStore");
    }

    wsprintf(pwszLdapStore, 
             g_wszNTAuth,
             g_strConfigDN);

    hEnterpriseStore = CertOpenStore(CERT_STORE_PROV_LDAP, 
                  0,
                  0,
                  CERT_STORE_READONLY_FLAG | CERT_LDAP_STORE_SIGN_FLAG,
                  pwszLdapStore);

    if(NULL == hEnterpriseStore)
    {
        hr=myHLastError();
	    _JumpError(hr, error, "CertOpenStore");
    }

    *phCertStore=hEnterpriseStore;

    hr = S_OK;
    
error:

    if(pwszLdapStore)
        LocalFree(pwszLdapStore);

    return hr;
}


HRESULT
pkcsVerifySignatureCertContext(
    IN WCHAR const * pwszCommonName,
    IN HCERTSTORE hNTAuthStore,
    IN DWORD    dwCAIndex,
    IN OUT CACTX *pCAContext,
    OUT DWORD *pLogMsg,
    OUT BOOL *pfWarn)
{
    HRESULT hr;
    WCHAR awc[11];
    WCHAR const *apwsz[2];

    PCCERT_CONTEXT          pCertContext = NULL;

    *pLogMsg = 0;
    *pfWarn = FALSE;
    hr = myVerifyCertContext(
			pCAContext->pccCA,	// pCert
			0,			// dwFlags
			0,			// cUsageOids
			NULL,			// apszUsageOids
			HCCE_LOCAL_MACHINE,	// hChainEngine
			NULL,			// hAdditionalStore
			NULL);			// ppwszMissingIssuer
    pCAContext->hrVerifyStatus = hr;
    if (S_OK != hr)
    {
	_PrintError2(hr, "myVerifyCertContext", CRYPT_E_REVOCATION_OFFLINE);
	if (CERT_E_EXPIRED == hr)
	{
	    pCAContext->Flags |= CTXF_EXPIRED;
	    if (0 == (CRLF_PUBLISH_EXPIRED_CERT_CRLS & g_dwCRLFlags))
	    {
		pCAContext->Flags |= CTXF_SKIPCRL;
	    }
	    *pLogMsg = MSG_E_CA_CERT_EXPIRED;
	}
	else if (CRYPT_E_REVOKED == hr)
	{
	    pCAContext->Flags |= CTXF_REVOKED | CTXF_SKIPCRL;
	    *pLogMsg = MSG_E_CA_CERT_REVOKED;
	}
	else if (CRYPT_E_REVOCATION_OFFLINE == hr)
	{
	    DWORD dwState;

	    hr = GetSetupStatus(NULL, &dwState);
	    if ((S_OK != hr || 0 == (SETUP_CREATEDB_FLAG & dwState)) &&
		CERTLOG_WARNING <= g_dwLogLevel)
	    {
		*pLogMsg = MSG_E_CA_CERT_REVOCATION_OFFLINE;
		*pfWarn = TRUE;
	    }
	    else
	    {
		hr = S_OK;
	    }
	}
	else if (CRYPT_E_NO_REVOCATION_CHECK == hr)
	{
	    if (CERTLOG_VERBOSE <= g_dwLogLevel)
	    {
		*pLogMsg = MSG_E_CA_CERT_REVOCATION_NOT_CHECKED;
		*pfWarn = TRUE;
	    }
	    else
	    {
		hr = S_OK;
	    }
	}
	else
	{
	    *pLogMsg = MSG_E_CA_CHAIN;
	}
	_JumpIfError(hr, error, "myVerifyCertContext");
    }

    //the CA's certificate looks good.  We verify the CA's
    //certificate is in the NTAuth store
    if(hNTAuthStore)
    {
        if(NULL == (pCertContext=pkcsFindCertificateInOtherStore(
                hNTAuthStore,
                pCAContext->pccCA)))

        {
            wsprintf(awc, L"%u", dwCAIndex);
            apwsz[0] = awc;
            apwsz[1] = pwszCommonName;

            LogEvent(EVENTLOG_WARNING_TYPE, MSG_CA_CERT_NO_IN_AUTH, ARRAYSIZE(apwsz), apwsz);
        }

        if(pCertContext)
            CertFreeCertificateContext(pCertContext);
    }

error:
    return(hr);
}


HRESULT
pkcsVerifySignatureCertContextArray(
    IN  WCHAR const * pwszCommonName,
    OUT DWORD *pLogMsg,
    OUT BOOL *pfWarn)
{
    HRESULT hr;
    DWORD i;
    WCHAR const *apwsz[1];

    HCERTSTORE  hNTAuthStore=NULL;

    CSASSERT(0 != g_cCACerts);

    //we need to verify CA's certificates should be in 
    //the NTAuth store if the certificate is not yet expired or revoked
    if(IsEnterpriseCA(g_CAType))
	{
        pkcsObtainNTAuthStore(&hNTAuthStore);

		if(NULL == hNTAuthStore)
		{
            apwsz[0] = pwszCommonName;

            LogEvent(EVENTLOG_WARNING_TYPE, MSG_CA_CERT_NO_AUTH_STORE, ARRAYSIZE(apwsz), apwsz);
		}
	}


    for (i = 0; i < g_cCACerts; i++)
    {
	CACTX *pCAContext = &g_aCAContext[i];

	if (NULL == pCAContext->pccCA)
	{
	    continue;
	}

	// Ignore all errors except for the current CA (last entry in array)

	hr = pkcsVerifySignatureCertContext(
                    pwszCommonName,
                    hNTAuthStore,
                    i,
		    pCAContext,
		    pLogMsg,
		    pfWarn);
    }

    if(hNTAuthStore)
        CertCloseStore(hNTAuthStore, 0);

    return(hr);
}


VOID
PKCSVerifyCAState(
    IN OUT CACTX *pCAContext)
{
    HRESULT hr;
    
    if (0 == pCAContext->Flags && NULL != pCAContext->pccCA)
    {
	DWORD LogMsg = MAXDWORD;
	BOOL fWarn = FALSE;

	hr = pkcsVerifySignatureCertContext(NULL, NULL, 0, pCAContext, &LogMsg, &fWarn);
	if (S_OK != hr)
	{
	    CSASSERT(MAXDWORD != LogMsg);
	    LogEventStringHResult(
			    fWarn? EVENTLOG_WARNING_TYPE : EVENTLOG_ERROR_TYPE,
			    LogMsg,
			    g_wszCommonName,
			    hr);
	}
    }
}


HRESULT
pkcsVerifyDSCACert(
    IN LDAP *pld)
{
    HRESULT hr;
    HCAINFO hCAInfo = NULL;
    PCCERT_CONTEXT pDSCertContext = NULL;

    // BUGBUG: verify all of this CA's unexpired signature certs are in the DS.
    // Republish any that aren't.  Cleans up DS replication conflicts.

    CSASSERT(g_pCAContextCurrent && g_pCAContextCurrent->pccCA);

    hr = CAFindByName(
        g_wszSanitizedName,
        NULL,
        CA_FIND_LOCAL_SYSTEM |
        CA_FIND_INCLUDE_UNTRUSTED, // this will cause findbyname to skip
        &hCAInfo);                 // ca cert checking
    _JumpIfErrorStr(hr, error, "CAFindByName", g_wszSanitizedName);

    hr = CAGetCACertificate(hCAInfo, &pDSCertContext);
    _JumpIfError(hr, error, "CAGetCACertificate");

    if(!pDSCertContext ||
       pDSCertContext->cbCertEncoded !=
       g_pCAContextCurrent->pccCA->cbCertEncoded ||
       0 != memcmp(pDSCertContext->pbCertEncoded,
                   g_pCAContextCurrent->pccCA->pbCertEncoded,
                   g_pCAContextCurrent->pccCA->cbCertEncoded))
    {
        // published cert is invalid or old, publish the current one

        hr = CASetCACertificate(
            hCAInfo,
            g_pCAContextCurrent->pccCA);
        _JumpIfError(hr, error, "CASetCACertificate");

        hr = CAUpdateCA(hCAInfo);
        _JumpIfError(hr, error, "CAUpdateCA");

        {
            CAuditEvent audit(SE_AUDITID_CERTSRV_PUBLISHCACERT, g_dwAuditFilter);

            hr = audit.AddData( // %1 Certificate Hash
                g_pCAContextCurrent->pccCA->pCertInfo->SerialNumber.pbData,
                g_pCAContextCurrent->pccCA->pCertInfo->SerialNumber.cbData);
            _JumpIfError(hr, error, "CAuditEvent::AddData");

            hr = audit.AddData(g_pCAContextCurrent->pccCA->pCertInfo->NotBefore); // %2 Valid From
            _JumpIfError(hr, error, "CAuditEvent::AddData");

            hr = audit.AddData(g_pCAContextCurrent->pccCA->pCertInfo->NotAfter); //%3 Valid To
            _JumpIfError(hr, error, "CAuditEvent::AddData");

            hr = audit.Report();
            _JumpIfError(hr, error, "CAuditEvent::Report");
        }
    }

    hr = S_OK;
error:

    if(hCAInfo)
    {
        CACloseCA(hCAInfo);
    }
    if(pDSCertContext)
    {
        CertFreeCertificateContext(pDSCertContext);
    }
    return(hr);
}


VOID
pkcsReleaseKRACertArray()
{
    DWORD i;

    if (NULL != g_rgKRACerts)
    {
	for (i = 0; i < g_cKRACerts; i++)
	{
	    if (NULL != g_rgKRACerts[i])
	    {
		CertFreeCertificateContext(g_rgKRACerts[i]);
	    }
	}
	LocalFree(g_rgKRACerts);
	g_rgKRACerts = NULL;
    }
    if (NULL != g_rgstrKRAHashes)
    {
	for (i = 0; i < g_cKRACerts; i++)
	{
	    if (NULL != g_rgstrKRAHashes[i])
	    {
		SysFreeString(g_rgstrKRAHashes[i]);
	    }
	}
	LocalFree(g_rgstrKRAHashes);
	g_rgstrKRAHashes = NULL;
    }
    g_cKRACerts = 0;
    g_hrKRALoad = S_OK;
}


VOID
pkcsLogKRACertError(
    IN DWORD LogMsg,
    IN DWORD iHash,
    OPTIONAL IN CERT_CONTEXT const *pcc,
    IN HRESULT hrLog)
{
    HRESULT hr;
    WCHAR awc[11];
    WCHAR *pwszName = NULL;
    WCHAR const *pwszError = NULL;
    WCHAR const *apwsz[3];

    wsprintf(awc, L"%u", iHash);
    apwsz[0] = awc;

    if (NULL != pcc)
    {
	hr = myCertNameToStr(
		    X509_ASN_ENCODING,
		    &pcc->pCertInfo->Subject,
		    CERT_X500_NAME_STR | CERT_NAME_STR_REVERSE_FLAG,
		    &pwszName);
	_PrintIfError(hr, "myCertNameToStr");
    }
    apwsz[1] = NULL != pwszName? pwszName : L"";

    pwszError = myGetErrorMessageText(hrLog, TRUE);
    apwsz[2] = NULL != pwszError? pwszError : L"";

    LogEvent(EVENTLOG_ERROR_TYPE, LogMsg, ARRAYSIZE(apwsz), apwsz);

//error:
    if (NULL != pwszName)
    {
	LocalFree(pwszName);
    }
    if (NULL != pwszError)
    {
	LocalFree(const_cast<WCHAR *>(pwszError));
    }
}


HRESULT
pkcsLoadKRACertContext(
    IN DWORD iHash,
    IN HCERTSTORE hStore)
{
    HRESULT hr;
    CERT_CONTEXT const *pcc = NULL;
    BSTR strHash = NULL;
    BYTE abHash[CBMAX_CRYPT_HASH_LEN];
    DWORD cbHash;
    DWORD LogMsg = 0;
    BOOL fReloaded;

    DBGPRINT((DBG_SS_CERTSRV, "Loading KRA Cert[%u]:\n", iHash));

    fReloaded = FALSE;
    while (TRUE)
    {
	hr = myFindCACertByHashIndex(
				hStore,
				g_wszSanitizedName,
				CSRH_CAKRACERT,
				iHash,
				NULL,		// pNameId
				&pcc);
	if (S_OK == hr)
	{
	    break;
	}
	if (fReloaded || CRYPT_E_NOT_FOUND != hr)
	{
	    _JumpError(hr, error, "myFindCACertByHashIndex");
	}
	_PrintError(hr, "myFindCACertByHashIndex");

	// The KRA cert is missing from the HKLM "kra" store -- look it up in
	// the DB, and put it back in the store.

	hr = pkcsReloadMissingCAOrKRACert(
				hStore,
				g_wszSanitizedName,
				CSRH_CAKRACERT,
				iHash);
	_JumpIfError(hr, error, "pkcsReloadMissingCAOrKRACert");

	fReloaded = TRUE;
    }

    hr = myVerifyKRACertContext(
			    pcc,
			    (CRLF_REVCHECK_IGNORE_OFFLINE & g_dwCRLFlags)?
				CA_VERIFY_FLAGS_IGNORE_OFFLINE : 0);
    if (S_OK != hr)
    {
	LogMsg = MSG_E_INVALID_KRA_CERT;
	_JumpErrorStr(hr, error, "myVerifyKRACertContext", L"KRA cert invalid");
    }

    hr = pkcsImportCAOrKRACert(pcc, DB_DISP_KRA_CERT, NULL);
    _JumpIfError(hr, error, "pkcsReloadMissingCAOrKRACert");

    cbHash = sizeof(abHash);
    if (!CertGetCertificateContextProperty(
				pcc,
				CERT_SHA1_HASH_PROP_ID,
				abHash,
				&cbHash))
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertGetCertificateContextProperty");
    }
    hr = MultiByteIntegerToBstr(TRUE, cbHash, abHash, &strHash);
    _JumpIfError(hr, error, "MultiByteIntegerToBstr");

    g_rgstrKRAHashes[g_cKRACerts] = strHash;
    g_rgKRACerts[g_cKRACerts] = pcc;
    g_cKRACerts++;
    strHash = NULL;
    pcc = NULL;
    hr = S_OK;

error:
    if (S_OK != hr)
    {
	if (0 == LogMsg)
	{
	    LogMsg = MSG_E_CANNOT_LOAD_KRA_CERT;
	}
	pkcsLogKRACertError(LogMsg, iHash, pcc, hr);
    }
    if (NULL != strHash)
    {
	SysFreeString(strHash);
    }
    if (NULL != pcc)
    {
	CertFreeCertificateContext(pcc);
    }
    return(hr);
}


HRESULT
pkcsLoadKRACertArray()
{
    HRESULT hr;
    DWORD iHash;
    DWORD i;
    HCERTSTORE hStore = NULL;
    DWORD LogMsg = 0;

    if (!g_fAdvancedServer)
    {
	LogMsg = MSG_E_KRA_NOT_ADVANCED_SERVER;
	hr = HRESULT_FROM_WIN32(ERROR_NOT_SUPPORTED);
	_JumpError(hr, error, "!g_fAdvancedServer");
    }

    // open KRA store

    hStore = CertOpenStore(
			CERT_STORE_PROV_SYSTEM_W,
			X509_ASN_ENCODING,
			NULL,			// hProv
			CERT_SYSTEM_STORE_LOCAL_MACHINE,
			wszKRA_CERTSTORE);
    if (NULL == hStore)
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertOpenStore");
    }

    // find & load KRA certs

    hr = myGetCARegHashCount(g_wszSanitizedName, CSRH_CAKRACERT, &g_cKRAHashes);
    if (S_OK == hr && 0 == g_cKRAHashes)
    {
	hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
    }
    _JumpIfError(hr, error, "myGetCARegHashCount");

    g_rgKRACerts = (CERT_CONTEXT const **) LocalAlloc(
				LMEM_FIXED | LMEM_ZEROINIT,
				g_cKRAHashes * sizeof(g_rgKRACerts[0]));
    if (NULL == g_rgKRACerts)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }
    g_rgstrKRAHashes = (BSTR *) LocalAlloc(
				LMEM_FIXED | LMEM_ZEROINIT,
				g_cKRAHashes * sizeof(g_rgstrKRAHashes[0]));
    if (NULL == g_rgstrKRAHashes)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }

    for (iHash = 0; iHash < g_cKRAHashes; iHash++)
    {
	hr = pkcsLoadKRACertContext(iHash, hStore);
	if (S_OK != hr)
	{
	    _PrintError(hr, "pkcsLoadKRACertContext");
	    g_hrKRALoad = hr;
	}
    }
    if (0 == g_cKRACerts)
    {
	LogMsg = MSG_E_NO_VALID_KRA_CERTS;
	hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
	_JumpError(hr, error, "g_cKRACerts == 0");
    }
    g_iKRACerts = 0;
    if (g_cKRACerts > g_cKRACertsRoundRobin)
    {
	srand((unsigned) time(NULL));
	g_iKRACerts = rand() % g_cKRACerts;
    }
    else
    {
	g_cKRACertsRoundRobin = g_cKRACerts;
    }
    hr = S_OK;

error:
    if (S_OK != hr)
    {
	if (0 == LogMsg)
	{
	    LogMsg = MSG_E_LOADING_KRA_CERTS;
	}
	LogEventHResult(EVENTLOG_ERROR_TYPE, LogMsg, hr);
	pkcsReleaseKRACertArray();
    }
    if (NULL != hStore)
    {
	CertCloseStore(hStore, CERT_CLOSE_STORE_CHECK_FLAG);
    }
    return(hr);
}


HRESULT
pkcsExpandURL(
    IN WCHAR const *pwszURLTemplate,
    OUT WCHAR **ppwszURL)
{
    HRESULT hr;

    *ppwszURL = NULL;

    CSASSERT(NULL != g_strDomainDN && NULL != g_strConfigDN);
    hr = myFormatCertsrvStringArray(
	    FALSE,			// fURL
	    g_pwszServerName,		// pwszServerName_p1_2
	    g_wszSanitizedName,		// pwszSanitizedName_p3_7
	    0,				// iCert_p4
	    g_strDomainDN,		// pwszDomainDN_p5
	    g_strConfigDN,		// pwszConfigDN_p6
	    0,				// iCRL_p8
	    FALSE,			// fDeltaCRL_p9
	    FALSE,			// fDSAttrib_p10_11
	    1,				// cStrings
	    &pwszURLTemplate,		// apwszStringsIn
	    ppwszURL);			// apwszStringsOut
    _JumpIfError(hr, error, "myFormatCertsrvStringArray");

error:
    return(hr);
}


HRESULT
pkcsPatchDN(
    IN HRESULT hrFail,
    IN WCHAR const *pwszRegName,
    IN OUT BSTR *pstrDSValue)
{
    HRESULT hr;
    WCHAR *pwszRegValue = NULL;
    
    hr = myGetCertRegStrValue(
		    g_wszSanitizedName,
		    NULL,
		    NULL,
		    pwszRegName,
		    &pwszRegValue);
    _PrintIfErrorStr(hr, "myGetCertRegStrValue", pwszRegName);

    if (NULL != *pstrDSValue)
    {
	if (NULL == pwszRegValue || 0 != lstrcmp(*pstrDSValue, pwszRegValue))
	{
	    // set reg value

	    hr = mySetCertRegStrValue(
			    g_wszSanitizedName,
			    NULL,
			    NULL,
			    pwszRegName,
			    *pstrDSValue);
	    _PrintIfErrorStr(hr, "mySetCertRegStrValue", pwszRegName);
	}
    }
    else
    {
	if (NULL == pwszRegValue || L'\0' == *pwszRegValue)
	{
	    hr = hrFail;
	    _JumpError(hr, error, "both DS and Reg NULL");
	}
	if (!ConvertWszToBstr(pstrDSValue, pwszRegValue, -1))
	{
	    hr = E_OUTOFMEMORY;
	    _JumpError(hr, error, "ConvertWszToBstr");
	}
    }
    hr = S_OK;

error:
    if (NULL != pwszRegValue)
    {
	LocalFree(pwszRegValue);
    }
    return(hr);
}


HRESULT
pkcsGetAuthoritativeDomainDn(
    IN WCHAR const *pwszCommonName,
    OUT LDAP **ppld,
    OUT BSTR *pstrDomainDN,
    OUT BSTR *pstrConfigDN)
{
    HRESULT hr;
    WCHAR *pwszConfigDN = NULL;
    WCHAR *pwszDomainDN = NULL;

    // Get domain and config containers (%5, %6)

    *ppld = NULL;
    *pstrDomainDN = NULL;
    *pstrConfigDN = NULL;

    if (g_fUseDS)
    {
	HRESULT hr2;

	hr = myRobustLdapBind(ppld, FALSE);
	if (S_OK != hr)
	{
	    _PrintError(hr, "myRobustLdapBind");
	}
	else
	{
	    hr = myGetAuthoritativeDomainDn(*ppld, pstrDomainDN, pstrConfigDN);
	    _PrintIfError(hr, "myGetAuthoritativeDomainDn");
	}
	if (S_OK != hr)
	{
	    LogEventStringHResult(
			EVENTLOG_ERROR_TYPE,
			MSG_E_DS_RETRY,
			pwszCommonName,
			hr);
	}
	hr2 = hr;

	hr = pkcsPatchDN(hr2, wszREGDSCONFIGDN, pstrConfigDN);
	_JumpIfError(hr, error, "pkcsPatchDN");

	hr = pkcsPatchDN(hr2, wszREGDSDOMAINDN, pstrDomainDN);
	_JumpIfError(hr, error, "pkcsPatchDN");
    }
    else
    {
	*pstrDomainDN = SysAllocString(L"");
	*pstrConfigDN = SysAllocString(L"");
	if (NULL == *pstrDomainDN || NULL == *pstrConfigDN)
	{
	    hr = E_OUTOFMEMORY;
	    _JumpError(hr, error, "SysAllocString");
	}
    }
    hr = S_OK;

error:
    return(hr);
}


HRESULT
PKCSSetup(
    IN WCHAR const *pwszCommonName,
    IN WCHAR const *pwszSanitizedName)
{
    HRESULT hr;
    LDAP *pld = NULL;
    DWORD LogMsg = MAXDWORD;
    BOOL fWarn = FALSE;

    // set crypt handles and load certificate chain

    hr = pkcsGetAuthoritativeDomainDn(
				pwszCommonName,
				&pld,
				&g_strDomainDN,
				&g_strConfigDN);
    if (S_OK != hr)
    {
	LogMsg = MSG_E_NO_DS;
	_JumpError(hr, error, "pkcsGetAuthoritativeDomainDn");
    }

    // get (multiple) CRL path templates

    hr = pkcsLoadTemplates(
		    wszREGCRLPUBLICATIONURLS,
		    &g_paRevURL,
		    &g_caRevURL);
    _PrintIfErrorStr(hr, "pkcsLoadTemplates", wszREGCRLPUBLICATIONURLS);

    // get (multiple) CA Cert path templates

    hr = pkcsLoadTemplates(
		    wszREGCACERTPUBLICATIONURLS,
		    &g_paCACertURL,
		    &g_caCACertURL);
    _PrintIfErrorStr(hr, "pkcsLoadTemplates", wszREGCACERTPUBLICATIONURLS);

    hr = DBOpen(pwszSanitizedName);
    if (S_OK != hr)
    {
	LogMsg = MSG_E_DB_INIT_FAILED;
	_JumpError(hr, error, "PKCSSetup:DBOpen");
    }

    hr = pkcsLoadCAContextArray(pwszCommonName, pwszSanitizedName);
    if (S_OK != hr)
    {
	LogMsg = MSG_E_CA_CHAIN;
	_JumpError(hr, error, "pkcsLoadCAContextArray");
    }

    hr = pkcsImportCAContextArray();
    _PrintIfError(hr, "pkcsImportCAContextArray");

    hr = pkcsVerifySignatureCertContextArray(pwszCommonName, &LogMsg, &fWarn);
    _JumpIfError(hr, error, "pkcsVerifySignatureCertContextArray");

    if (0 != g_cKRACertsRoundRobin)
    {
	hr = pkcsLoadKRACertArray();
	_PrintIfError(hr, "pkcsLoadKRACertArray");
    }

    hr = pkcsExpandURL(g_wszzLDAPKRACertURLTemplate, &g_pwszKRAPublishURL);
    _JumpIfError(hr, error, "pkcsExpandURL");

    hr = pkcsExpandURL(
		g_wszzLDAPIssuerCertURLTemplate,
		&g_pwszAIACrossCertPublishURL);
    _JumpIfError(hr, error, "pkcsExpandURL");

    hr = pkcsExpandURL(
		g_wszLDAPRootTrustURLTemplate,
		&g_pwszRootTrustCrossCertPublishURL);
    _JumpIfError(hr, error, "pkcsExpandURL");

    if (NULL != pld)
    {
	hr = pkcsVerifyDSCACert(pld);
	_PrintIfError(hr, "pkcsVerifyDSCACert");
    }

    hr = S_OK;

error:
    if (NULL != pld)
    {
	ldap_unbind(pld);
    }
    if (S_OK != hr)
    {
	CSASSERT(MAXDWORD != LogMsg);
	if (!fWarn)
	{
	    PKCSTerminate();
	}
	LogEventStringHResult(
			fWarn? EVENTLOG_WARNING_TYPE : EVENTLOG_ERROR_TYPE,
			LogMsg,
			pwszCommonName,
			hr);
	if (fWarn)
	{
	    hr = S_OK;
	}
    }
    return(hr);
}


VOID
pkcsReleaseCACertificateChain(
    CERT_CONTEXT const **apCACertChain,
    DWORD                cCACertChain)
{
    DWORD i;

    if (NULL != apCACertChain)
    {
	for (i = 0; i < cCACertChain; ++i)
	{
	    CertFreeCertificateContext(apCACertChain[i]);
	}
	LocalFree(apCACertChain);
    }
}


VOID
pkcsReleaseCAContext(
    IN OUT CACTX *pCAContext)
{
    pkcsReleaseCACertificateChain(
			    pCAContext->apCACertChain,
			    pCAContext->cCACertChain);
    //pCAContext->apCACertChain = NULL;
    //pCAContext->pccCA = NULL;

    if (NULL != pCAContext->hProvCA)
    {
	CryptReleaseContext(pCAContext->hProvCA, 0);
    }
    if (NULL != pCAContext->IssuerKeyId.pbData)
    {
	LocalFree(pCAContext->IssuerKeyId.pbData);
    }
    if (NULL != pCAContext->pszObjIdSignatureAlgorithm)
    {
	LocalFree(pCAContext->pszObjIdSignatureAlgorithm);
    }
    if (NULL != pCAContext->KeyAuthority2Cert.pbData)
    {
	LocalFree(pCAContext->KeyAuthority2Cert.pbData);
    }
    if (NULL != pCAContext->KeyAuthority2CRL.pbData)
    {
	LocalFree(pCAContext->KeyAuthority2CRL.pbData);
    }
    if (NULL != pCAContext->CDPCert.pbData)
    {
	LocalFree(pCAContext->CDPCert.pbData);
    }
    if (NULL != pCAContext->CDPCRLFreshest.pbData)
    {
	LocalFree(pCAContext->CDPCRLFreshest.pbData);
    }
    if (NULL != pCAContext->CDPCRLBase.pbData)
    {
	LocalFree(pCAContext->CDPCRLBase.pbData);
    }
    if (NULL != pCAContext->CDPCRLDelta.pbData)
    {
	LocalFree(pCAContext->CDPCRLDelta.pbData);
    }
    if (NULL != pCAContext->AIACert.pbData)
    {
	LocalFree(pCAContext->AIACert.pbData);
    }
    if (NULL != pCAContext->pwszKeyContainerName)
    {
	LocalFree(pCAContext->pwszKeyContainerName);
    }
    if (NULL != pCAContext->papwszCRLFiles)
    {
	WCHAR **ppwsz;

	for (ppwsz = pCAContext->papwszCRLFiles; NULL != *ppwsz; ppwsz++)
	{
	    LocalFree(*ppwsz);
	}
	LocalFree(pCAContext->papwszCRLFiles);
    }
    if (NULL != pCAContext->papwszDeltaCRLFiles)
    {
	WCHAR **ppwsz;

	for (ppwsz = pCAContext->papwszDeltaCRLFiles; NULL != *ppwsz; ppwsz++)
	{
	    LocalFree(*ppwsz);
	}
	LocalFree(pCAContext->papwszDeltaCRLFiles);
    }
}


VOID
pkcsReleaseCAContextArray()
{
    DWORD i;

    if (NULL != g_aCAContext)
    {
	for (i = 0; i < g_cCACerts; i++)
	{
	    pkcsReleaseCAContext(&g_aCAContext[i]);
	}
	LocalFree(g_aCAContext);
	g_aCAContext = NULL;
    }
    g_cCACerts = 0;
    g_pCAContextCurrent = NULL;
}


// Trim  off leading and trailing whitespace and separator characters

WCHAR *
pkcsTrimToken(
    IN WCHAR *pwszIn,
    IN WCHAR wchSeparator)
{
    WCHAR *pwsz;

    while (wchSeparator == *pwszIn || iswspace(*pwszIn))
    {
	pwszIn++;
    }
    pwsz = &pwszIn[wcslen(pwszIn)];
    while (--pwsz >= pwszIn &&
	(wchSeparator == *pwsz || iswspace(*pwsz)))
    {
	*pwsz = L'\0';
    }
    if (L'\0' == *pwszIn)
    {
	pwszIn = NULL;
    }
    return(pwszIn);
}


WCHAR *
PKCSSplitToken(
    IN OUT WCHAR **ppwszIn,
    IN WCHAR *pwcSeparator,
    OUT BOOL *pfSplit)
{
    WCHAR *pwszOut = NULL;
    WCHAR *pwszNext = NULL;
    BOOL fSplit = FALSE;
    WCHAR *pwszIn;
    WCHAR *pwsz;

    pwszIn = *ppwszIn;
    if (NULL != pwszIn)
    {
	pwszOut = pwszIn;
	if (NULL != pwcSeparator)
	{
	    pwsz = wcschr(pwszIn, *pwcSeparator);
	    if (NULL != pwsz)
	    {
		*pwsz = L'\0';

		pwszNext = pkcsTrimToken(&pwsz[1], *pwcSeparator);
		pwszOut = pkcsTrimToken(pwszOut, *pwcSeparator);
		fSplit = TRUE;
	    }
	}
    }
    *ppwszIn = pwszNext;
    *pfSplit = fSplit;
    return(pwszOut);
}


HRESULT
PKCSSetSubjectTemplate(
    IN WCHAR const *pwszzTemplate)
{
    HRESULT hr;
    BOOL fSplit;
    WCHAR const *pwszz;
    WCHAR const *pwszPropName;
    BSTR  bstrToken;
    SUBJECTTABLE const **ppSubject;
    SUBJECTTABLE const **pps;
    SUBJECTTABLE const *pSubject;
    DWORD dwIndex;
    DWORD cchMax;

    hr = E_INVALIDARG;
    if (NULL == pwszzTemplate)
    {
	_JumpError(hr, error, "pwszzTemplate NULL");
    }
    ppSubject = pkcs_apSubject; // fill in this empty subject array with string matches

    for (pwszz = pwszzTemplate; L'\0' != *pwszz; pwszz += wcslen(pwszz) + 1)
    {
	pwszPropName = PKCSMapAttributeName(pwszz, NULL, &dwIndex, &cchMax);
	if (NULL == pwszPropName)
	{
	    hr = E_INVALIDARG;
	    _JumpErrorStr(hr, error, "PKCSMapAttributeName", pwszz);
	}

	for (pSubject = pkcs_subject; ; pSubject++)
	{
	    if (NULL == pSubject->pwszPropName)
	    {
		_JumpError(hr, error, "pkcs_subject lookup");
	    }
	    if (0 == lstrcmpi(pSubject->pwszPropName, pwszPropName))
	    {
		break;
	    }
	}
	for (pps = pkcs_apSubject; pps < ppSubject; pps++)
	{
	    if (*pps == pSubject)
	    {
		_JumpErrorStr(hr, error, "pkcs_subject duplicate", pwszz);
	    }
	}
	if (ppSubject >= &pkcs_apSubject[CSUBJECTTABLE])
	{
	    _JumpError(hr, error, "pkcs_subject overflow");
	}
	DBGPRINT((
	    DBG_SS_CERTSRVI,
	    "Subject Template[%u]: %hs -- %ws\n",
	    SAFE_SUBTRACT_POINTERS(ppSubject, pkcs_apSubject),
	    pSubject->pszObjId,
	    pSubject->pwszPropName));
	*ppSubject++ = pSubject;
    }
    CSASSERT(ppSubject <= &pkcs_apSubject[CSUBJECTTABLE]);

    if (ppSubject == pkcs_apSubject)
    {
	_JumpError(hr, error, "pwszzTemplate empty");
    }
    pkcs_ppSubjectLast = ppSubject - 1;
    pkcsfSubjectTemplate = TRUE;
    hr = S_OK;

error:
    return(hr);
}


HRESULT
pkcsSplitRDNComponents(
    IN SUBJECTTABLE const *pSubjectTable,
    IN OUT WCHAR *pwszRDN,	// Parsing stomps string in-place
    IN DWORD cAttrMax,
    OUT DWORD *pcAttr,
    OUT CERT_RDN_ATTR *rgAttr)
{
    HRESULT hr;
    DWORD cAttr;
    DWORD i;
    DWORD cwc;
    WCHAR *pwszRemain;
    WCHAR const *pwszToken;
    WCHAR *pwszT;
    BOOL fSplit;

    *pcAttr = 0;
    cAttr = 0;
    if (NULL != pwszRDN)
    {
	// Allocate memory for each RDN component filled in:

	pwszRemain = pwszRDN;
	while (TRUE)
	{
	    pwszToken = PKCSSplitToken(
				&pwszRemain,
				wszNAMESEPARATORDEFAULT,
				&fSplit);
	    if (NULL == pwszToken)
	    {
		break;
	    }

	    if (cAttr >= cAttrMax)
	    {
		hr = CERTSRV_E_BAD_REQUESTSUBJECT;
		_JumpError(hr, error, "Subject RDN overflow");
	    }

	    cwc = wcslen(pwszToken);
	    if (g_fEnforceRDNNameLengths && cwc > pSubjectTable->cchMax)
	    {
		DBGPRINT((
		    DBG_SS_CERTSRV,
		    "RDN component too long: %u/%u: %ws[%u]=\"%ws\"\n",
		    cwc,
		    pSubjectTable->cchMax,
		    pSubjectTable->pwszPropName,
		    cAttr,
		    pwszToken));
		hr = CERTSRV_E_BAD_REQUESTSUBJECT;
		_JumpErrorStr(hr, error, "RDN component too long", pwszToken);
	    }
	    pwszT = (WCHAR *) LocalAlloc(LMEM_FIXED, (cwc + 1) * sizeof(WCHAR));
	    if (NULL == pwszT)
	    {
		hr = E_OUTOFMEMORY;
		_JumpError(hr, error, "LocalAlloc(pwszToken)");
	    }
	    wcscpy(pwszT, pwszToken);

	    rgAttr[cAttr].pszObjId = (char *) pSubjectTable->pszObjId;
	    rgAttr[cAttr].dwValueType = CERT_RDN_ANY_TYPE;  // 'best' encoding
	    rgAttr[cAttr].Value.pbData = (BYTE *) pwszT;
	    rgAttr[cAttr].Value.cbData = 0;	// Indicate Unicode input

	    cAttr++;
	}
    }
    *pcAttr = cAttr;
    hr = S_OK;

error:
    if (S_OK != hr)
    {
	for (i = 0; i < cAttr; i++)
	{
	    LocalFree(rgAttr[i].Value.pbData);
	}
    }
    return(hr);
}


#define CSUBJECTRDNMAX	(4 * CSUBJECTTABLE)

HRESULT
pkcsEncodeSubjectName(
    IN ICertDBRow *prow,
    IN CERT_RDN_ATTR const *rgAttr,
    IN DWORD cAttr,
    OUT BYTE **ppbData,
    OUT DWORD *pcbData)
{
    HRESULT hr;
    DWORD i;
    DWORD cbprop;
    DWORD dwRequestFlags;
    DWORD dwFlags;
    CERT_RDN rgRDN[CSUBJECTRDNMAX];
    CERT_NAME_INFO nameinfo;

    CSASSERT(ARRAYSIZE(rgRDN) >= cAttr);
    for (i = 0; i < cAttr; i++)
    {
	rgRDN[i].cRDNAttr = 1;
	rgRDN[i].rgRDNAttr = (CERT_RDN_ATTR *) &rgAttr[i];
    }
    nameinfo.cRDN = cAttr;
    nameinfo.rgRDN = rgRDN;

    cbprop = sizeof(dwRequestFlags);
    hr = prow->GetProperty(
			g_wszPropRequestFlags,
			PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
			&cbprop,
			(BYTE *) &dwRequestFlags);
    _JumpIfError(hr, error, "GetProperty");

    CSASSERT(sizeof(dwRequestFlags) == cbprop);
    dwFlags = 0;
    if (CR_FLG_FORCETELETEX & dwRequestFlags)
    {
	dwFlags |= CERT_RDN_ENABLE_T61_UNICODE_FLAG;
    }
    if (CR_FLG_FORCEUTF8 & dwRequestFlags)
    {
	dwFlags |= CERT_RDN_ENABLE_UTF8_UNICODE_FLAG;
    }

    if (!myEncodeName(
		X509_ASN_ENCODING,
		&nameinfo,
		dwFlags,
		CERTLIB_USE_LOCALALLOC,
		ppbData,
		pcbData))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myEncodeName");
    }

error:
    return(hr);
}


HRESULT
pkcsBuildSubjectFromNamesTable(
    IN ICertDBRow *prow,
    OUT CERT_NAME_BLOB *pSubject)
{
    HRESULT hr;
    DWORD cbData = 0;
    DWORD i;
    DWORD cAttr;
    DWORD cAttrT;
    CERT_RDN_ATTR rgAttr[CSUBJECTRDNMAX];
    SUBJECTTABLE const * const *ppSubject;
    WCHAR *pwszData = NULL;

    pSubject->pbData = NULL;
    CSASSERT(NULL != pkcs_ppSubjectLast);

    cAttr = 0;
    for (
	ppSubject = pkcs_ppSubjectLast;
	ppSubject >= pkcs_apSubject;
	ppSubject--)
    {
	hr = PKCSGetProperty(
		prow,
		(*ppSubject)->pwszPropName,
		PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		&cbData,
		(BYTE **) &pwszData);
	if (S_OK != hr)
	{
	    continue;
	}
	if (0 != cbData)
	{

	    // Allocates memory for each RDN component filled in:

	    hr = pkcsSplitRDNComponents(
				*ppSubject,
				pwszData,
				ARRAYSIZE(rgAttr) - cAttr,
				&cAttrT,
				&rgAttr[cAttr]);
	    _JumpIfError(hr, error, "SplitRDNComponents");

	    cAttr += cAttrT;
	}
	LocalFree(pwszData);
	pwszData = NULL;
    }

    // done building string of subject entries, time to encode

    hr = pkcsEncodeSubjectName(
		    prow,
		    rgAttr,
		    cAttr,
		    &pSubject->pbData,
		    &pSubject->cbData);
    _JumpIfError(hr, error, "pkcsEncodeSubjectName");

    hr = prow->SetProperty(
		g_wszPropSubjectRawName,
		PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		pSubject->cbData,
		pSubject->pbData);
    _JumpIfError(hr, error, "SetProperty");

    pkcsSetDistinguishedName(prow, PROPTABLE_CERTIFICATE, pSubject);

error:
    for (i = 0; i < cAttr; i++)
    {
	LocalFree(rgAttr[i].Value.pbData);
    }
    if (NULL != pwszData)
    {
	LocalFree(pwszData);
    }
    return(hr);
}


HRESULT
pkcsCheck7f(
    IN ICertDBRow *prow,
    IN BYTE const *pbCert,
    IN DWORD cbCert,
    OUT BOOL *pfErrorLogged)
{
    HRESULT hr;
    DWORD cbProp;
    WCHAR awcSubject[1024];
    WCHAR wszDword[2+8+1];
    WCHAR wszRequestId[11+1];
    WCHAR const *pwszDword;
    WORD cString = 0;
    WCHAR const *apwsz[4];

    DWORD State;
    DWORD Index1;
    DWORD Index2;
    DWORD cwcField;
    WCHAR wszField[128];
    DWORD cwcObjectId;
    WCHAR wszObjectId[128];
    WCHAR const *pwszObjectIdDescription = NULL;
	WCHAR *wszBuf=NULL;
    const DWORD dwDefaultBufSize = 2048*sizeof(WCHAR);

    *pfErrorLogged = FALSE;
    cwcField = sizeof(wszField)/sizeof(wszField[0]);
    cwcObjectId = sizeof(wszObjectId)/sizeof(wszObjectId[0]);
    hr = myCheck7f(
		pbCert,
		cbCert,
		FALSE,
		&State,
		&Index1,
		&Index2,
		&cwcField,
		wszField,
		&cwcObjectId,
		wszObjectId,
		&pwszObjectIdDescription);	// Static: do not free!
    _JumpIfError(hr, error, "myCheck7f");

    if (CHECK7F_NONE != State)
    {
	DWORD ReqId;

    wszBuf = (WCHAR*)LocalAlloc(LMEM_FIXED, dwDefaultBufSize);
    if (NULL == wszBuf)
    {
	hr = E_OUTOFMEMORY;
	    _JumpError(hr, error, "LocalAlloc");
    }

	prow->GetRowId(&ReqId);
	wsprintf(wszRequestId, L"%u", ReqId);
	apwsz[cString++] = wszRequestId;
	apwsz[cString++] = wszDword;

	cbProp = sizeof(awcSubject);
	hr = prow->GetProperty(
		g_wszPropSubjectDistinguishedName,
		PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		&cbProp,
		(BYTE *) awcSubject);
	if (S_OK != hr)
	{
	    _PrintError(hr, "GetProperty(DN)");
	    wcscpy(awcSubject, L"???");
	}
	apwsz[cString++] = awcSubject;

	wcscpy(wszBuf, wszField);
	if (0 != Index1)
	{
	    wsprintf(
		&wszBuf[wcslen(wszBuf)],
		0 != Index2? L"[%u,%u]" : L"[%u]",
		Index1 - 1,
		Index2 - 1);
	}

	if (0 != cwcObjectId)
	{
	    wcscat(wszBuf, L" ObjectId=");
	    wcscat(wszBuf, wszObjectId);
	}
	if (NULL != pwszObjectIdDescription)
	{
	// If buffer too small, reallocate enough space for old buffer,
	// OID description, () and trailing zero
	DWORD dwBufLen = (wcslen(wszBuf)+wcslen(pwszObjectIdDescription)+3)*
			 sizeof(WCHAR);
	if(dwDefaultBufSize<dwBufLen)
	{
	    WCHAR *pTempBuf = (WCHAR*)LocalReAlloc(
		wszBuf,
		dwBufLen,
		LMEM_MOVEABLE);
	    if(NULL == pTempBuf)
	    {
		hr = E_OUTOFMEMORY;
		_JumpError(hr, error, "LocalReAlloc");
	    }
	    wszBuf = pTempBuf;
	}

	wcscat(wszBuf, L" (");
	    wcscat(wszBuf, pwszObjectIdDescription);
	    wcscat(wszBuf, L")");
	}
	apwsz[cString++] = wszBuf;

	hr = CERTSRV_E_ENCODING_LENGTH;
	wsprintf(wszDword, L"0x%x", hr);

	if (CERTLOG_ERROR <= g_dwLogLevel)
	{
	    LogEvent(
		EVENTLOG_ERROR_TYPE,
		MSG_E_BADCERTLENGTHFIELD,
		cString,
		apwsz);
	}

	CONSOLEPRINT4((
		    DBG_SS_CERTSRV,
		    "CertSrv Request %u: rc=%x: Bad encoded length detected: %ws \"%ws\"\n",
		    ReqId,
		    hr,
		    wszBuf,
		    awcSubject));
	*pfErrorLogged = TRUE;
    }
error:

    if (NULL != wszBuf)
    {
	    LocalFree(wszBuf);
    }
    return(hr);
}


HRESULT
pkcsCreateCertSerialNumber(
    IN ICertDBRow *prow,
    IN CACTX const *pCAContext,
    OUT BSTR *pstrSerialNumber)
{
    HRESULT hr;
    DWORD dw;
    USHORT us;
    BYTE abRandom[8];
    BYTE abSerial[max(
      sizeof(dw) + sizeof(us) + sizeof(dw),
      sizeof(dw) + sizeof(us) + sizeof(abRandom) + sizeof(dw) + sizeof(BYTE))];
    BSTR strSerialNumber = NULL;
    DWORD cbSerial;
    BYTE *pb;
    DWORD cb;
//#define TEST_SPECIAL_SERIAL_NUMBERS
#ifdef TEST_SPECIAL_SERIAL_NUMBERS
    BOOL fAddZeroByte = FALSE;
#endif

    *pstrSerialNumber = NULL;
    pb = abSerial;

    prow->GetRowId(&dw);
    CopyMemory(pb, &dw, sizeof(dw));
    pb += sizeof(dw);

    us = (USHORT) pCAContext->iCert;
    CopyMemory(pb, &us, sizeof(us));
    pb += sizeof(us);

    if (0 != g_dwHighSerial)
    {
	if (!CryptGenRandom(
		    g_pCAContextCurrent->hProvCA,
		    ARRAYSIZE(abRandom),
		    abRandom))
	{
	    hr = myHLastError();
	    _PrintError(hr, "CryptGenRandom");
	    memset(abRandom, g_dwHighSerial, sizeof(abRandom));
	}
	CopyMemory(pb, abRandom, sizeof(abRandom));
	pb += sizeof(abRandom);

	CopyMemory(pb, &dw, sizeof(dw));
	pb += sizeof(dw);

	*pb++ = (BYTE) g_dwHighSerial;
    }
    else
    {
	dw = GetTickCount();
	CopyMemory(pb, &dw, sizeof(dw));
	pb += sizeof(dw);
    }
    cbSerial = SAFE_SUBTRACT_POINTERS(pb, abSerial);

    // Make sure the sreial number doesn't overflow the buffer:

    CSASSERT(sizeof(abSerial) >= cbSerial);

    // IETF max serial number length is 20 bytes:

    CSASSERT(20 >= cbSerial);

    pb--;
    if (0 == *pb)
    {
	*pb = 'a';
    }
    else if (0 == (0xf0 & *pb))
    {
	*pb |= 0x10;	// make high nibble non-zero
    }
    *pb &= 0x7f;	// Some clients can't handle negative serial numbers:
#ifdef TEST_SPECIAL_SERIAL_NUMBERS
    if (1 & abSerial[0])
    {
	*pb |= 0x80;	// Test negative serial numbers:
	if (2 & abSerial[0])
	{
	    *pb-- = 0;		// Test high zero byte serial numbers:
	    *pb |= 0x80;	// Test negative serial numbers:
	    fAddZeroByte = TRUE;
	}
    }
#endif

    hr = MultiByteIntegerToBstr(FALSE, cbSerial, abSerial, &strSerialNumber);
    _JumpIfError(hr, error, "MultiByteIntegerToBstr");

#ifdef TEST_SPECIAL_SERIAL_NUMBERS
    if (fAddZeroByte)
    {
	BSTR str = NULL;

	str = SysAllocStringLen(NULL, 2 + wcslen(strSerialNumber));
	if (NULL != str)
	{
	    wcscpy(str, L"00");
	    wcscat(str, strSerialNumber);
	    SysFreeString(strSerialNumber);
	    strSerialNumber = str;
	}
    }
#endif

    *pstrSerialNumber = strSerialNumber;
    strSerialNumber = NULL;
    hr = S_OK;

error:
    if (NULL != strSerialNumber)
    {
	SysFreeString(strSerialNumber);
    }
    return(hr);
}


HRESULT
PKCSVerifySubjectRDN(
    IN ICertDBRow *prow,
    IN WCHAR const *pwszPropertyName,
    OPTIONAL IN WCHAR const *pwszPropertyValue,
    OUT BOOL *pfSubjectDot)
{
    HRESULT hr;
    WCHAR const *pwsz;
    WCHAR const *pwszName = pwszPropertyName;
    WCHAR wszPrefix[ARRAYSIZE(wszPROPSUBJECTDOT)];
    SUBJECTTABLE const *pSubjectTable;
    DWORD i;
    DWORD cAttr = 0;
    CERT_RDN_ATTR rgAttr[CSUBJECTRDNMAX];
    WCHAR *pwszValue = NULL;
    DWORD cbData;
    BYTE *pbData = NULL;

    hr = S_OK;
    *pfSubjectDot = FALSE;

    // Check to see if the request is for L"Subject.".

    pwsz = wcschr(pwszName, L'.');
    if (NULL != pwsz &&
	SAFE_SUBTRACT_POINTERS(pwsz, pwszName) + 2 == ARRAYSIZE(wszPrefix))
    {
	pwsz++;		// skip past L'.'

	CopyMemory(
	    wszPrefix,
	    pwszName,
	    (SAFE_SUBTRACT_POINTERS(pwsz, pwszName) * sizeof(WCHAR)));
	wszPrefix[ARRAYSIZE(wszPrefix) - 1] = L'\0';

	if (0 == lstrcmpi(wszPrefix, wszPROPSUBJECTDOT))
	{
	    pwszName = pwsz;
	    if (L'\0' == *pwszName)
	    {
		*pfSubjectDot = TRUE;
	    }
	}
    }

    if (!*pfSubjectDot)
    {
	for (pSubjectTable = pkcs_subject; ; pSubjectTable++)
	{
	    WCHAR const * const *ppwsz;

	    if (NULL == pSubjectTable->pwszPropName)
	    {
		goto error;
	    }

	    // Check for matching full name without "Subject." prefix:

	    pwsz = wcschr(pSubjectTable->pwszPropName, L'.');
	    if (NULL != pwsz && 0 == lstrcmpi(pwszName, &pwsz[1]))
	    {
		break;
	    }

	    // Check for matching OID:

	    if (!iswdigit(*pwszName))
	    {
		continue;
	    }
	    for (
		ppwsz = pSubjectTable->apwszAttributeName;
		NULL != *ppwsz;
		ppwsz++)
	    {
		if (*pwszName == **ppwsz && 0 == lstrcmp(pwszName, *ppwsz))
		{
		    break;
		}
	    }
	    if (NULL != *ppwsz)
	    {
		break;
	    }
	}
    }

    // It's a valid Certificate Table Subject RDN.  Call pkcsSplitRDNComponents
    // to split the string into individual RDN components and optionally
    // enforce each component is under the maximum length.

    DBGPRINT((
	    DBG_SS_CERTSRVI,
	    "PKCSVerifySubjectRDN(%ws) --> '%ws'\n",
	    pwszPropertyName,
	    pwszName));

    if (!*pfSubjectDot && NULL != pwszPropertyValue)
    {
	pwszValue = (WCHAR *) LocalAlloc(
			    LMEM_FIXED,
			    (wcslen(pwszPropertyValue) + 1) * sizeof(WCHAR));
	if (NULL == pwszValue)
	{
	    hr = E_OUTOFMEMORY;
	    _JumpError(hr, error, "LocalAlloc");
	}
	wcscpy(pwszValue, pwszPropertyValue);

	hr = pkcsSplitRDNComponents(
			    pSubjectTable,
			    pwszValue,
			    ARRAYSIZE(rgAttr),
			    &cAttr,
			    rgAttr);
	_JumpIfError(hr, error, "SplitRDNComponents");

	// Call myEncodeName merely to test for valid string data.
	// Some RDN OIDs are restricted to IA5 strings.

	hr = pkcsEncodeSubjectName(prow, rgAttr, cAttr, &pbData, &cbData);
	_JumpIfError(hr, error, "pkcsEncodeSubjectName");
    }
    hr = PKCSSetRequestFlags(prow, FALSE, CR_FLG_SUBJECTUNMODIFIED);
    _JumpIfError(hr, error, "PKCSSetRequestFlags");

error:
    for (i = 0; i < cAttr; i++)
    {
	LocalFree(rgAttr[i].Value.pbData);
    }
    if (NULL != pbData)
    {
	LocalFree(pbData);
    }
    if (NULL != pwszValue)
    {
	LocalFree(pwszValue);
    }
    return(hr);
}


HRESULT
PKCSDeleteAllSubjectRDNs(
    IN ICertDBRow *prow,
    IN DWORD Flags)
{
    HRESULT hr;
    SUBJECTTABLE const *pSubjectTable;
    WCHAR const *pwszPropName = NULL;

    for (pSubjectTable = pkcs_subject; ; pSubjectTable++)
    {
	if (NULL == pSubjectTable->pwszPropName)
	{
	    break;
	}
	hr = prow->SetProperty(pSubjectTable->pwszPropName, Flags, 0, NULL);
	_JumpIfError(hr, error, "SetProperty");
    }
    hr = S_OK;

error:
    return(hr);
}


HRESULT
pkcsverifyIssuedPolices(
    IN CERT_CONTEXT const *pcc,
    IN CHAR const *pszObjId,
    OPTIONAL IN WCHAR const *pwszzPolicies)
{
    HRESULT hr;
    CERT_EXTENSION const *pExt;
    CERT_POLICIES_INFO *pcpsi = NULL;
    DWORD cb;
    DWORD i;
    WCHAR const *pwsz;
    WCHAR *pwszObjId = NULL;

    if (NULL == pwszzPolicies)
    {
	hr = S_OK;
	goto error;
    }
    pExt = CertFindExtension(
			pszObjId,
			pcc->pCertInfo->cExtension,
			pcc->pCertInfo->rgExtension);
    if (NULL == pExt)
    {
	hr = S_OK;
	goto error;
    }
    if (!myDecodeObject(
		    X509_ASN_ENCODING,
		    X509_CERT_POLICIES,
		    pExt->Value.pbData,
		    pExt->Value.cbData,
		    CERTLIB_USE_LOCALALLOC,
		    (VOID **) &pcpsi,
		    &cb))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myDecodeObject");
    }

    for (i = 0; i < pcpsi->cPolicyInfo; i++)
    {
	CSASSERT(NULL == pwszObjId);

	if (!myConvertSzToWsz(
			&pwszObjId,
			pcpsi->rgPolicyInfo[i].pszPolicyIdentifier,
			-1))
	{
	    hr = E_OUTOFMEMORY;
	    _JumpError(hr, error, "myConvertSzToWsz(ObjId)");
	}
	for (pwsz = pwszzPolicies; ; pwsz += wcslen(pwsz) + 1)
	{
	    if (L'\0' == *pwsz)
	    {
		hr = CERT_E_INVALID_POLICY;
		_JumpErrorStr(hr, error, "Chain invalidates policy", pwszObjId);
	    }
	    if (0 == lstrcmp(pwsz, pwszObjId))
	    {
		break;
	    }
	}
	LocalFree(pwszObjId);
	pwszObjId = NULL;
    }
    hr = S_OK;

error:
    if (NULL != pcpsi)
    {
	LocalFree(pcpsi);
    }
    if (NULL != pwszObjId)
    {
	LocalFree(pwszObjId);
    }
    return(hr);
}


HRESULT
pkcsEncodeSubjectCert(
    IN ICertDBRow *prow,
    IN CACTX const *pCAContext,
    OUT BYTE **ppbEncoded,  // CoTaskMem*
    OUT DWORD *pcbEncoded,
    OUT BOOL *pfErrorLogged)
{
    HRESULT hr;
    HRESULT hrValidate = S_OK;
    BYTE *pbCertEncoded = NULL;
    DWORD cbCertEncoded;
    DWORD ExtFlags;
    BSTR strSerialNumber = NULL;
    IEnumCERTDBNAME *penum = NULL;
    CERTDBNAME cdbn;
    FILETIME ftNotBefore;
    DWORD dwRequestFlags;
    WCHAR *pwszIssuer = NULL;
    WCHAR *pwszSubject = NULL;

    CERT_INFO Cert;
    CERT_EXTENSION *pExt = NULL;
    DWORD           cExt = INCREMENT_EXTENSIONS;

    DWORD cbprop;
    DWORD i;
    CHAR *pChar;
    CHAR szObjId[MAX_PATH];
    BYTE *pb;
    CERT_CONTEXT const *pcc = NULL;
    WCHAR *pwszzIssuancePolicies = NULL;
    WCHAR *pwszzApplicationPolicies = NULL;

    cdbn.pwszName = NULL;
    *pfErrorLogged = FALSE;

    // CERT
    ZeroMemory(&Cert, sizeof(Cert));
    pExt = (CERT_EXTENSION *) LocalAlloc(
				    LMEM_FIXED | LMEM_ZEROINIT,
				    cExt * sizeof(*pExt));
    if (NULL == pExt)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }

    Cert.dwVersion = CERT_V3;

    hr = pkcsCreateCertSerialNumber(prow, pCAContext, &strSerialNumber);
    _JumpIfError(hr, error, "pkcsCreateCertSerialNumber");

    // convert to int
    hr = WszToMultiByteInteger(
			    FALSE,
			    strSerialNumber,
			    &Cert.SerialNumber.cbData,
			    &Cert.SerialNumber.pbData);
    _JumpIfError(hr, error, "WszToMultiByteInteger");


    Cert.SignatureAlgorithm.pszObjId = pCAContext->pszObjIdSignatureAlgorithm;
    Cert.Issuer = pCAContext->pccCA->pCertInfo->Subject;


    cbprop = sizeof(Cert.NotBefore);
    hr = prow->GetProperty(
		    g_wszPropCertificateNotBeforeDate,
		    PROPTYPE_DATE | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		    &cbprop,
		    (BYTE *) &Cert.NotBefore);
    _JumpIfError(hr, error, "GetProperty");

    CSASSERT(sizeof(Cert.NotBefore) == cbprop);

    cbprop = sizeof(Cert.NotAfter);
    hr = prow->GetProperty(
		    g_wszPropCertificateNotAfterDate,
		    PROPTYPE_DATE | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		    &cbprop,
		    (BYTE *) &Cert.NotAfter);
    _JumpIfError(hr, error, "GetProperty");

    CSASSERT(sizeof(Cert.NotAfter) == cbprop);

    CSASSERT(NULL == Cert.Subject.pbData);

    cbprop = sizeof(dwRequestFlags);
    hr = prow->GetProperty(
		g_wszPropRequestFlags,
		PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		&cbprop,
		(BYTE *) &dwRequestFlags);
    _JumpIfError(hr, error, "GetProperty");

    if (!pkcsfSubjectTemplate ||
	((CRLF_REBUILD_MODIFIED_SUBJECT_ONLY & g_dwCRLFlags) &&
	 (CR_FLG_SUBJECTUNMODIFIED & dwRequestFlags)))
    {
	hr = PKCSGetProperty(
		    prow,
		    g_wszPropSubjectRawName,
		    PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		    &Cert.Subject.cbData,
		    &Cert.Subject.pbData);
	if (S_OK == hr &&
	    0 == Cert.Subject.cbData &&
	    NULL != Cert.Subject.pbData)
	{
	    LocalFree(Cert.Subject.pbData);
	    Cert.Subject.pbData = NULL;
	}
    }

    if (NULL == Cert.Subject.pbData)
    {
	hr = pkcsBuildSubjectFromNamesTable(prow, &Cert.Subject);
	_JumpIfError(hr, error, "pkcsBuildSubjectFromNamesTable");
    }

    if (CertCompareCertificateName(
			    X509_ASN_ENCODING,
			    &Cert.Issuer,
			    &Cert.Subject))
    {
	hr = CERTSRV_E_BAD_REQUESTSUBJECT;
	_JumpError(hr, error, "Subject matches Issuer");
    }
    hr = myCertNameToStr(
		X509_ASN_ENCODING,
		&Cert.Issuer,
		CERT_X500_NAME_STR | CERT_NAME_STR_REVERSE_FLAG,
		&pwszIssuer);
    _JumpIfError(hr, error, "myCertNameToStr");

    hr = myCertNameToStr(
		X509_ASN_ENCODING,
		&Cert.Subject,
		CERT_X500_NAME_STR | CERT_NAME_STR_REVERSE_FLAG,
		&pwszSubject);
    _JumpIfError(hr, error, "myCertNameToStr");

    if (0 == lstrcmpi(pwszIssuer, pwszSubject))
    {
	hr = CERTSRV_E_BAD_REQUESTSUBJECT;
	_JumpError(hr, error, "Subject string matches Issuer");
    }

    hr = pkcsGetPublicKeyInfo(prow, &Cert.SubjectPublicKeyInfo);
    _JumpIfError(hr, error, "pkcsGetPublicKeyInfo");

    Cert.rgExtension = pExt;
    i = 0;

    hr = prow->EnumCertDBName(CIE_TABLE_EXTENSIONS, &penum);
    _JumpIfError(hr, error, "EnumCertDBName");

    hr = CERTSRV_E_PROPERTY_EMPTY;
    while (TRUE)
    {
	ULONG celtFetched;

	if (cExt == i)
	{
	    CERT_EXTENSION *pExtT;

	    // reached max, increse size
	    cExt += INCREMENT_EXTENSIONS;
	    pExtT = (CERT_EXTENSION *) LocalReAlloc(
						pExt,
						cExt * sizeof(*pExt),
						LMEM_ZEROINIT | LMEM_MOVEABLE);
	    if (NULL == pExtT)
	    {
		hr = E_OUTOFMEMORY;
		_JumpError(hr, error, "LocalReAlloc");
	    }
	    pExt = pExtT;
	    Cert.rgExtension = pExt;
	}

	hr = penum->Next(1, &cdbn, &celtFetched);
	if (S_FALSE == hr)
	{
	    break;
	}
	_JumpIfError(hr, error, "Next");

	CSASSERT(1 == celtFetched);
	CSASSERT(NULL != cdbn.pwszName);

	if (!ConvertWszToSz(
			&Cert.rgExtension[i].pszObjId,
			cdbn.pwszName,
			-1))
	{
	    hr = E_OUTOFMEMORY;
	    _JumpError(hr, error, "ConvertWszToSz(ExtObjId)");
	}

	hr = PropGetExtension(
			prow,
			PROPTYPE_BINARY | PROPCALLER_SERVER,
			cdbn.pwszName,
			&ExtFlags,
			&Cert.rgExtension[i].Value.cbData,
			&Cert.rgExtension[i].Value.pbData);
	_JumpIfError(hr, error, "PropGetExtension");

	DBGPRINT((
		DBG_SS_CERTSRVI,
		"pkcsEncodeSubjectCert: Ext=%ws, ExtFlags=%x, len=%x\n",
		cdbn.pwszName,
		ExtFlags,
		Cert.rgExtension[i].Value.cbData));

	Cert.rgExtension[i].fCritical =
	    (EXTENSION_CRITICAL_FLAG & ExtFlags)? TRUE : FALSE;

	CoTaskMemFree(cdbn.pwszName);
	cdbn.pwszName = NULL;

	if (EXTENSION_DISABLE_FLAG & ExtFlags)
	{
	    if (NULL != pExt[i].pszObjId)
	    {
		LocalFree(pExt[i].pszObjId);
		pExt[i].pszObjId = NULL;
	    }
	    if (NULL != pExt[i].Value.pbData)
	    {
		LocalFree(pExt[i].Value.pbData);
		pExt[i].Value.pbData = NULL;
	    }
	    continue;
	}
	i++;
    }

    Cert.cExtension = i;

    // encode the cert contents

    if (!myEncodeObject(
		    X509_ASN_ENCODING,
		    X509_CERT_TO_BE_SIGNED,
		    &Cert,
		    0,
		    CERTLIB_USE_LOCALALLOC,
		    &pbCertEncoded,
		    &cbCertEncoded))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myEncodeObject");
    }

    // sign the cert, then encode the signed info
    hr = myEncodeSignedContent(
			pCAContext->hProvCA,
			X509_ASN_ENCODING,
			Cert.SignatureAlgorithm.pszObjId,
			pbCertEncoded,
			cbCertEncoded,
			CERTLIB_USE_COTASKMEMALLOC,
			ppbEncoded,
			pcbEncoded); // use CoTaskMem*
    _JumpIfError(hr, error, "myEncodeSignedContent");

    pcc = CertCreateCertificateContext(
				X509_ASN_ENCODING,
				*ppbEncoded,
				*pcbEncoded);
    if (NULL == pcc)
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertCreateCertificateContext");
    }

    if (g_fCertEnrollCompatible)
    {
	hr = pkcsCheck7f(
		    prow,
		    *ppbEncoded,
		    *pcbEncoded,
		    pfErrorLogged);
	if (S_OK != hr)
	{
	    CoTaskMemFree(*ppbEncoded);
	    *ppbEncoded = NULL;
	    _JumpError(hr, error, "pkcsCheck7f");
	}
    }

    ftNotBefore = pcc->pCertInfo->NotBefore;
    myMakeExprDateTime(&ftNotBefore, g_dwClockSkewMinutes, ENUM_PERIOD_MINUTES);

    hr = myVerifyCertContextEx(
			pcc,			// pCert
			(CRLF_REVCHECK_IGNORE_OFFLINE & g_dwCRLFlags)?
			    CA_VERIFY_FLAGS_IGNORE_OFFLINE : 0,
						// dwFlags
			0,			// cUsageOids
			NULL,			// apszUsageOids
			HCCE_LOCAL_MACHINE,	// hChainEngine
			&ftNotBefore,		// pft
			NULL,			// hAdditionalStore
			NULL,			// ppwszMissingIssuer
			&pwszzIssuancePolicies,
			&pwszzApplicationPolicies);
    _PrintIfError(hr, "myVerifyCertContextEx");
    if (S_OK != hr)
    {
	if (0 == (CRLF_SAVE_FAILED_CERTS & g_dwCRLFlags))
	{
	    goto error;
	}
	hrValidate = hr;
    }

    if (S_OK == hrValidate &&
	0 == (CRLF_IGNORE_INVALID_POLICIES & g_dwCRLFlags))
    {
	hr = pkcsverifyIssuedPolices(
				pcc,
				szOID_CERT_POLICIES,
				pwszzIssuancePolicies);
	_PrintIfError(hr, "pkcsverifyIssuedPolices");
	if (S_OK != hr)
	{
	    if (0 == (CRLF_SAVE_FAILED_CERTS & g_dwCRLFlags))
	    {
		goto error;
	    }
	    if (S_OK == hrValidate)
	    {
		hrValidate = hr;
	    }
	}

	hr = pkcsverifyIssuedPolices(
				pcc,
				szOID_APPLICATION_CERT_POLICIES,
				pwszzApplicationPolicies);
	_PrintIfError(hr, "pkcsverifyIssuedPolices");
	if (S_OK != hr)
	{
	    if (0 == (CRLF_SAVE_FAILED_CERTS & g_dwCRLFlags))
	    {
		goto error;
	    }
	    if (S_OK == hrValidate)
	    {
		hrValidate = hr;
	    }
	}
    }

    hr = pkcsSetCertAndKeyHashes(prow, pcc);
    _JumpIfError(hr, error, "pkcsSetCertAndKeyHashes");

    hr = prow->SetProperty(
		    g_wszPropCertificateIssuerNameID,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		    sizeof(pCAContext->NameId),
		    (BYTE *) &pCAContext->NameId);
    _JumpIfError(hr, error, "SetProperty");

    hr = prow->SetProperty(
		    g_wszPropCertificateSerialNumber,
		    PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		    MAXDWORD,
		    (BYTE *) strSerialNumber);
    _JumpIfError(hr, error, "SetProperty");

#ifdef TEST_SPECIAL_SERIAL_NUMBERS
    if (L'0' == strSerialNumber[0] && L'0' == strSerialNumber[1])
    {
	hr = prow->SetProperty(
		    g_wszPropCertificateSerialNumber,
		    PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		    MAXDWORD,
		    (BYTE *) &strSerialNumber[2]);
	_JumpIfError(hr, error, "SetProperty");
    }
#endif

error:
    if (S_OK != hrValidate)
    {
	hr = hrValidate;
    }
    if (NULL != pwszIssuer)
    {
	LocalFree(pwszIssuer);
    }
    if (NULL != pwszSubject)
    {
	LocalFree(pwszSubject);
    }
    if (NULL != pwszzIssuancePolicies)
    {
	LocalFree(pwszzIssuancePolicies);
    }
    if (NULL != pwszzApplicationPolicies)
    {
	LocalFree(pwszzApplicationPolicies);
    }
    if (NULL != pcc)
    {
	CertFreeCertificateContext(pcc);
    }
    if (NULL != pExt)
    {
	i = 0;
	if (NULL != cdbn.pwszName)
	{
	    CoTaskMemFree(cdbn.pwszName);
	}
	while (cExt != i)
	{
	    if (NULL != pExt[i].pszObjId)
	    {
		LocalFree(pExt[i].pszObjId);
	    }
	    if (NULL != pExt[i].Value.pbData)
	    {
		LocalFree(pExt[i].Value.pbData);
	    }
	    i++;
	}
	LocalFree(pExt);
    }
    if (NULL != penum)
    {
	penum->Release();
    }
    if (NULL != Cert.SerialNumber.pbData)
    {
	LocalFree(Cert.SerialNumber.pbData);
    }
    if (NULL != Cert.Subject.pbData)
    {
	LocalFree(Cert.Subject.pbData);
    }
    pkcsFreePublicKeyInfo(&Cert.SubjectPublicKeyInfo);
    if (NULL != pbCertEncoded)
    {
	LocalFree(pbCertEncoded);
    }
    if (NULL != strSerialNumber)
    {
	SysFreeString(strSerialNumber);
    }
    return(hr);
}


VOID
pkcsFreeCRLChain(
    IN DWORD cCert,
    OPTIONAL IN OUT CERT_BLOB *prgCertBlob,
    OPTIONAL IN OUT CERT_CONTEXT const **rgCert,
    IN DWORD cCRL,
    OPTIONAL IN OUT CRL_BLOB *rgCRLBlob,
    OPTIONAL IN OUT CRL_CONTEXT const **rgCRL)
{
    DWORD i;

    if (NULL != prgCertBlob)
    {
	LocalFree(prgCertBlob);
    }
    if (NULL != rgCert)
    {
	for (i = 0; i < cCert; i++)
	{
	    if (NULL != rgCert[i])
	    {
		CertFreeCertificateContext(rgCert[i]);
	    }
	}
	LocalFree(rgCert);
    }
    if (NULL != rgCRLBlob)
    {
	LocalFree(rgCRLBlob);
    }
    if (NULL != rgCRL)
    {
	for (i = 0; i < cCRL; i++)
	{
	    if (NULL != rgCRL[i])
	    {
		CertFreeCRLContext(rgCRL[i]);
	    }
	}
	LocalFree(rgCRL);
    }
}


// Build the CA's cert chain and collect all paremt CA CRLs.
// Add in the optional passed leaf cert and the CA's CRLs.
// This ensures that the chain includes at least this CA's correct cert & CRLs.


HRESULT
pkcsBuildCRLChain(
    OPTIONAL IN CACTX *pCAContext,
    OPTIONAL IN BYTE const *pbCertLeaf,
    IN DWORD cbCertLeaf,
    IN BOOL fIncludeCRLs,
    OUT DWORD *pcCert,
    OPTIONAL OUT CERT_BLOB **prgCertBlob,
    OUT CERT_CONTEXT const ***prgCert,
    OUT DWORD *pcCRLBlob,
    OPTIONAL OUT CRL_BLOB **prgCRLBlob,
    OUT CRL_CONTEXT const ***prgCRL)
{
    HRESULT hr;
    CERT_CHAIN_PARA ChainParams;
    CERT_CHAIN_CONTEXT const *pChainContext = NULL;
    DWORD cElement;
    CERT_CHAIN_ELEMENT **rgpElement;
    DWORD cCert;
    CERT_CONTEXT const **rgpCert = NULL;
    CERT_CONTEXT const *pccCertLeaf = NULL;
    CERT_BLOB *rgCertBlob = NULL;
    DWORD cCRL;
    CRL_CONTEXT const **rgpCRL = NULL;
    CRL_BLOB *rgCRLBlob = NULL;
    DWORD i;
    DWORD iCert;
    DWORD iCRL;

    if (NULL != prgCertBlob)
    {
	*prgCertBlob = NULL;
    }
    *prgCert = NULL;
    if (NULL != prgCRLBlob)
    {
	*prgCRLBlob = NULL;
    }
    *prgCRL = NULL;

    if (NULL != pbCertLeaf)
    {
	pccCertLeaf = CertCreateCertificateContext(
						X509_ASN_ENCODING,
						pbCertLeaf,
						cbCertLeaf);
	if (NULL == pccCertLeaf)
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "CertCreateCertificateContext");
	}
    }
    CSASSERT(NULL != pCAContext || NULL != pccCertLeaf);
    if (NULL == pCAContext || fIncludeCRLs)
    {
	// Get the CA cert chain and parent CA CRLs:

	ZeroMemory(&ChainParams, sizeof(ChainParams));
	ChainParams.cbSize = sizeof(ChainParams);
	//ChainParams.RequestedUsage.dwType = USAGE_MATCH_TYPE_AND;
	//ChainParams.RequestedUsage.Usage.cUsageIdentifier = 0;
	//ChainParams.RequestedUsage.Usage.rgpszUsageIdentifier = NULL;

	if (!CertGetCertificateChain(
				HCCE_LOCAL_MACHINE,	// hChainEngine
				NULL != pCAContext?
				    pCAContext->pccCA : pccCertLeaf,
				NULL,		// pTime
				NULL,		// hAdditionalStore
				&ChainParams,	// pChainPara
				CERT_CHAIN_REVOCATION_CHECK_END_CERT |
				     CERT_CHAIN_REVOCATION_CHECK_CHAIN,
				NULL,		// pvReserved
				&pChainContext))	// ppChainContext
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "CertGetCertificateChain");
	}
	if (0 == pChainContext->cChain ||
	    0 == pChainContext->rgpChain[0]->cElement)
	{
	    hr = CRYPT_E_NOT_FOUND;
	    _JumpError(hr, error, "No chain");
	}
	cElement = pChainContext->rgpChain[0]->cElement;
	rgpElement = pChainContext->rgpChain[0]->rgpElement;
    }
    else
    {
	cElement = pCAContext->cCACertChain;
    }
    cCert = cElement;
    cCRL = 2 * (cCert + 1);	// Worst case.  *Always* include this CA's CRLs
    if (NULL != pbCertLeaf)
    {
	cCert++;
    }
    rgpCert = (CERT_CONTEXT const **) LocalAlloc(
					    LMEM_FIXED | LMEM_ZEROINIT,
					    cCert * sizeof(rgpCert[0]));
    if (NULL == rgpCert)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }
    if (fIncludeCRLs)
    {
	rgpCRL = (CRL_CONTEXT const **) LocalAlloc(
					    LMEM_FIXED | LMEM_ZEROINIT,
					    cCRL * sizeof(rgpCRL[0]));
	if (NULL == rgpCRL)
	{
	    hr = E_OUTOFMEMORY;
	    _JumpError(hr, error, "LocalAlloc");
	}
    }

    iCert = 0;
    iCRL = 0;

    // Add parent CA certs and CRLs:

    if (NULL == pCAContext || fIncludeCRLs)
    {
	for (i = 0; i < cElement; i++)
	{
	    CERT_CHAIN_ELEMENT const *pElement = rgpElement[i];
	    CERT_REVOCATION_INFO *pRevocationInfo;

	    rgpCert[iCert] = CertDuplicateCertificateContext(
						    pElement->pCertContext);
	    if (NULL != rgpCert[iCert])
	    {
		iCert++;
	    }
	    pRevocationInfo = pElement->pRevocationInfo;

	    if (fIncludeCRLs &&
		NULL != pRevocationInfo &&
		CCSIZEOF_STRUCT(CERT_REVOCATION_INFO, pCrlInfo) <=
		    pRevocationInfo->cbSize &&
		NULL != pRevocationInfo->pCrlInfo)
	    {
		CERT_REVOCATION_CRL_INFO *pCrlInfo;

		pCrlInfo = pRevocationInfo->pCrlInfo;
		if (NULL != pCrlInfo)
		{
		    if (NULL != pCrlInfo->pBaseCrlContext)
		    {
			rgpCRL[iCRL] = CertDuplicateCRLContext(
						pCrlInfo->pBaseCrlContext);
			if (NULL != rgpCRL[iCRL])
			{
			    iCRL++;
			}
		    }
		    if (NULL != pCrlInfo->pDeltaCrlContext)
		    {
			rgpCRL[iCRL] = CertDuplicateCRLContext(
						pCrlInfo->pDeltaCrlContext);
			if (NULL != rgpCRL[iCRL])
			{
			    iCRL++;
			}
		    }
		}
	    }
	}
    }
    else
    {
	for (i = 0; i < pCAContext->cCACertChain; i++)
	{
	    rgpCert[iCert] = CertDuplicateCertificateContext(
					    pCAContext->apCACertChain[i]);
	    if (NULL != rgpCert[iCert])
	    {
		iCert++;
	    }
	}
    }

    if (NULL != pCAContext)
    {
	// Add issued cert at the end -- optional Leaf cert:

	if (NULL != pbCertLeaf)
	{
	    for (i = 0; i < iCert; i++)
	    {
		if (cbCertLeaf == rgpCert[i]->cbCertEncoded &&
		    0 == memcmp(
			    pbCertLeaf,
			    rgpCert[i]->pbCertEncoded,
			    cbCertLeaf))
		{
		    break;
		}
	    }
	    if (i == iCert)	// if not found in existing array
	    {
		rgpCert[iCert] = CertDuplicateCertificateContext(pccCertLeaf);
		if (NULL != rgpCert[iCert])
		{
		    iCert++;
		}
	    }
	}

	// Add current CA's Base and delta CRLs:

	if (fIncludeCRLs)
	{
	    hr = CRLGetCRL(
			pCAContext->iKey,
			FALSE,		// fDelta
			&rgpCRL[iCRL],
			NULL);		// pdwCRLPublishFlags
	    _JumpIfError(hr, error, "CRLGetCRL(base)"); // Base CRL must exist

	    iCRL++;

	    hr = CRLGetCRL(
			pCAContext->iKey,
			TRUE,		// fDelta
			&rgpCRL[iCRL],
			NULL);		// pdwCRLPublishFlags
	    _PrintIfError(hr, "CRLGetCRL(delta)");	// Delta CRL might not exist
	    if (S_OK == hr)
	    {
		iCRL++;
	    }
	}
    }
    CSASSERT(iCert <= cCert);
    CSASSERT(iCRL <= cCRL);

    if (NULL != prgCertBlob)
    {
	rgCertBlob = (CERT_BLOB *) LocalAlloc(
					LMEM_FIXED,
					iCert * sizeof(rgCertBlob[0]));
	if (NULL == rgCertBlob)
	{
	    hr = E_OUTOFMEMORY;
	    _JumpError(hr, error, "LocalAlloc");
	}
	for (i = 0; i < iCert; i++)
	{
	    rgCertBlob[i].cbData = rgpCert[i]->cbCertEncoded;
	    rgCertBlob[i].pbData = rgpCert[i]->pbCertEncoded;
	}
    }
    if (NULL != prgCRLBlob && 0 != iCRL)
    {
	rgCRLBlob = (CERT_BLOB *) LocalAlloc(
					LMEM_FIXED,
					iCRL * sizeof(rgCRLBlob[0]));
	if (NULL == rgCRLBlob)
	{
	    hr = E_OUTOFMEMORY;
	    _JumpError(hr, error, "LocalAlloc");
	}
	for (i = 0; i < iCRL; i++)
	{
	    rgCRLBlob[i].cbData = rgpCRL[i]->cbCrlEncoded;
	    rgCRLBlob[i].pbData = rgpCRL[i]->pbCrlEncoded;
	}
    }
    *pcCert = iCert;
    *prgCert = rgpCert;
    rgpCert = NULL;
    if (NULL != prgCertBlob)
    {
	*prgCertBlob = rgCertBlob;
	rgCertBlob = NULL;
    }

    *pcCRLBlob = iCRL;
    *prgCRL = rgpCRL;
    rgpCRL = NULL;
    if (NULL != prgCRLBlob)
    {
	*prgCRLBlob = rgCRLBlob;
	rgCRLBlob = NULL;
    }

    hr = S_OK;

error:
    pkcsFreeCRLChain(cCert, rgCertBlob, rgpCert, cCRL, rgCRLBlob, rgpCRL);
    if (NULL != pccCertLeaf)
    {
        CertFreeCertificateContext(pccCertLeaf);
    }
    if (NULL != pChainContext)
    {
        CertFreeCertificateChain(pChainContext);
    }
    return(hr);
}


// Build a PKCS7 CMC response

HRESULT
PKCSEncodeFullResponse(
    OPTIONAL IN ICertDBRow *prow,
    IN CERTSRV_RESULT_CONTEXT const *pResult,
    IN HRESULT hrRequest,
    IN WCHAR *pwszDispositionString,
    OPTIONAL IN CACTX *pCAContext,
    OPTIONAL IN BYTE const *pbCertLeaf,
    IN DWORD cbCertLeaf,
    IN BOOL fIncludeCRLs,
    OUT BYTE **ppbResponse,    // CoTaskMem*
    OUT DWORD *pcbResponse)
{
    HRESULT hr;
    CMC_RESPONSE_INFO Response;
    CMC_STATUS_INFO Status;
    BYTE *pbContent = NULL;
    DWORD cbContent;
    DWORD dwBodyPartIdOfRequest = 1;
    DWORD dwCMCDataReference = 0;
    DWORD dwBodyPartId = 1;
    CMC_TAGGED_ATTRIBUTE aTaggedAttribute[5];
    DWORD ita = 0;
    CRYPT_ATTRIBUTE aAttr[2];
    DWORD iAttr = 0;
    CRYPT_ATTR_BLOB aAttrBlob[7];
    DWORD iblob = 0;
    CMSG_SIGNER_ENCODE_INFO SignerEncodeInfo;
    CMSG_SIGNED_ENCODE_INFO SignedMsgEncodeInfo;
    CMC_PEND_INFO PendInfo;
    DWORD ReqId;
    DWORD dwRequestFlags;
    DWORD cb;
    DWORD i;
    HCRYPTMSG hMsg = NULL;
    CERT_CONTEXT const **prgCert = NULL;
    CRL_CONTEXT const **prgCRL = NULL;
    CHAR szNonce[(11 + 1) + (8 + 1) * 3];

    ZeroMemory(aAttrBlob, sizeof(aAttrBlob));
    ZeroMemory(&Status, sizeof(Status));
    ZeroMemory(&Response, sizeof(Response));

    ZeroMemory(&SignedMsgEncodeInfo, sizeof(SignedMsgEncodeInfo));
    SignedMsgEncodeInfo.cbSize = sizeof(SignedMsgEncodeInfo);
    SignedMsgEncodeInfo.cSigners = 1;
    SignedMsgEncodeInfo.rgSigners = &SignerEncodeInfo;
    //SignedMsgEncodeInfo.cCertEncoded = 0;
    //SignedMsgEncodeInfo.rgCertEncoded = NULL;
    //SignedMsgEncodeInfo.cCrlEncoded = 0;
    //SignedMsgEncodeInfo.rgCrlEncoded = NULL;

    Status.cBodyList = 1;
    Status.dwOtherInfoChoice = CMC_OTHER_INFO_NO_CHOICE;
    Status.rgdwBodyList = &dwBodyPartIdOfRequest;
    Status.pwszStatusString = pwszDispositionString;

    switch (*pResult->pdwDisposition)
    {
	case CR_DISP_ISSUED:
	case CR_DISP_ISSUED_OUT_OF_BAND:
	case CR_DISP_REVOKED:	// map revoked to CMC_STATUS_FAILED?
	    Status.dwStatus = CMC_STATUS_SUCCESS;
	    break;

	case CR_DISP_UNDER_SUBMISSION:
	    Status.dwStatus = CMC_STATUS_PENDING;
	    Status.dwOtherInfoChoice = CMC_OTHER_INFO_PEND_CHOICE;
	    Status.pPendInfo = &PendInfo;

	    CSASSERT(NULL != prow);
	    prow->GetRowId(&ReqId);

	    PendInfo.PendToken.cbData = sizeof(ReqId);
	    PendInfo.PendToken.pbData = (BYTE *) &ReqId;

	    cb = sizeof(PendInfo.PendTime);
	    hr = prow->GetProperty(
			g_wszPropRequestSubmittedWhen,
			PROPTYPE_DATE | PROPCALLER_SERVER | PROPTABLE_REQUEST,
			&cb,
			(BYTE *) &PendInfo.PendTime);
	    _JumpIfError(hr, error, "GetProperty");

	    break;

	//case CR_DISP_INCOMPLETE:
	//case CR_DISP_ERROR:
	//case CR_DISP_DENIED:
	default:
	    Status.dwStatus = CMC_STATUS_FAILED;
	    if (NULL != prow)
	    {
		cb = sizeof(hrRequest);
		hr = prow->GetProperty(
			g_wszPropRequestStatusCode,
			PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
			&cb,
			(BYTE *) &hrRequest);
		_JumpIfError(hr, error, "GetProperty(status code)");
	    }
	    switch (hrRequest)
	    {
		case CERTSRV_E_BAD_REQUESTSUBJECT:
		    Status.dwFailInfo = CMC_FAIL_BAD_REQUEST;
		    Status.dwOtherInfoChoice = CMC_OTHER_INFO_FAIL_CHOICE;
		    break;
	    }
	    break;
    }

    // Encode control attributes for Status, Transaction Id, Sender and
    // Recipient Nonces and Issued Cert Hash.

    ZeroMemory(aTaggedAttribute, sizeof(aTaggedAttribute));

    // Status:

    if (!myEncodeObject(
		    X509_ASN_ENCODING,
		    CMC_STATUS,
		    &Status,
		    0,
		    CERTLIB_USE_LOCALALLOC,
		    &aAttrBlob[iblob].pbData,
		    &aAttrBlob[iblob].cbData))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myEncodeObject");
    }

    aTaggedAttribute[ita].dwBodyPartID = dwBodyPartId++;
    aTaggedAttribute[ita].Attribute.pszObjId = szOID_CMC_STATUS_INFO;
    aTaggedAttribute[ita].Attribute.cValue = 1;
    aTaggedAttribute[ita].Attribute.rgValue = &aAttrBlob[iblob];
    iblob++;
    ita++;

    // Transaction Id:

    if (pResult->fTransactionId)
    {
	if (!myEncodeObject(
			X509_ASN_ENCODING,
			X509_INTEGER,
			&pResult->dwTransactionId,
			0,
			CERTLIB_USE_LOCALALLOC,
			&aAttrBlob[iblob].pbData,
			&aAttrBlob[iblob].cbData))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "myEncodeObject");
	}
	aTaggedAttribute[ita].dwBodyPartID = dwBodyPartId++;
	aTaggedAttribute[ita].Attribute.pszObjId = szOID_CMC_TRANSACTION_ID;
	aTaggedAttribute[ita].Attribute.cValue = 1;
	aTaggedAttribute[ita].Attribute.rgValue = &aAttrBlob[iblob];
	iblob++;
	ita++;
    }

    if (NULL != pResult->pbSenderNonce && 0 != pResult->cbSenderNonce)
    {
	CRYPT_DATA_BLOB Blob;
	FILETIME ft;
	DWORD dw;
	DWORD cch;

	// Recipient Nonce:

	Blob.pbData = const_cast<BYTE *>(pResult->pbSenderNonce);
	Blob.cbData = pResult->cbSenderNonce;

	if (!myEncodeObject(
			X509_ASN_ENCODING,
			X509_OCTET_STRING,
			&Blob,
			0,
			CERTLIB_USE_LOCALALLOC,
			&aAttrBlob[iblob].pbData,
			&aAttrBlob[iblob].cbData))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "myEncodeObject");
	}
	aTaggedAttribute[ita].dwBodyPartID = dwBodyPartId++;
	aTaggedAttribute[ita].Attribute.pszObjId = szOID_CMC_RECIPIENT_NONCE;
	aTaggedAttribute[ita].Attribute.cValue = 1;
	aTaggedAttribute[ita].Attribute.rgValue = &aAttrBlob[iblob];
	iblob++;
	ita++;

	// Sender Nonce:

	GetSystemTimeAsFileTime(&ft);
	dw = GetTickCount();

	cch = sprintf(
		    szNonce,
		    "%u %08lx %08lx-%08lx",
		    *pResult->pdwRequestId,
		    dw,
		    ft.dwHighDateTime,
		    ft.dwLowDateTime);
	CSASSERT(ARRAYSIZE(szNonce) > cch);

	Blob.pbData = (BYTE *) szNonce;
	Blob.cbData = cch;

	if (!myEncodeObject(
			X509_ASN_ENCODING,
			X509_OCTET_STRING,
			&Blob,
			0,
			CERTLIB_USE_LOCALALLOC,
			&aAttrBlob[iblob].pbData,
			&aAttrBlob[iblob].cbData))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "myEncodeObject");
	}
	aTaggedAttribute[ita].dwBodyPartID = dwBodyPartId++;
	aTaggedAttribute[ita].Attribute.pszObjId = szOID_CMC_SENDER_NONCE;
	aTaggedAttribute[ita].Attribute.cValue = 1;
	aTaggedAttribute[ita].Attribute.rgValue = &aAttrBlob[iblob];
	iblob++;
	ita++;
    }

    // Issued Cert Hash:

    if (NULL != pbCertLeaf)
    {
	CSASSERT(NULL != prow);
	hr = pkcsGetHashAsOctet(
			prow,
			&aAttrBlob[iblob].pbData,
			&aAttrBlob[iblob].cbData);
	_JumpIfError(hr, error, "pkcsGetHashAsOctet");

	aAttr[iAttr].pszObjId = szOID_ISSUED_CERT_HASH;
	aAttr[iAttr].cValue = 1;
	aAttr[iAttr].rgValue = &aAttrBlob[iblob];
	iblob++;
	iAttr++;
    }

    // Computed hash of private key encrypted to this CA, for client
    // confirmation.

    if (NULL != pResult->pbKeyHashOut)
    {
	CRYPT_DATA_BLOB Blob;

	Blob.pbData = pResult->pbKeyHashOut;
	Blob.cbData = pResult->cbKeyHashOut;
	if (!myEncodeObject(
			X509_ASN_ENCODING,
			X509_OCTET_STRING,
			&Blob,
			0,
			CERTLIB_USE_LOCALALLOC,
			&aAttrBlob[iblob].pbData,
			&aAttrBlob[iblob].cbData))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "myEncodeObject");
	}
	aAttr[iAttr].pszObjId = szOID_ENCRYPTED_KEY_HASH;
	aAttr[iAttr].cValue = 1;
	aAttr[iAttr].rgValue = &aAttrBlob[iblob];
	iblob++;
	iAttr++;
    }

    if (0 != iAttr)
    {
	hr = BuildCMCAttributes(
			iAttr,		// cAttribute
			aAttr,		// rgAttribute
			dwCMCDataReference,
			dwBodyPartIdOfRequest,
			dwBodyPartId++,
			&aTaggedAttribute[ita],
			&aAttrBlob[iblob]);
	_JumpIfError(hr, error, "BuildCMCAttributes");

	iblob++;
	ita++;
    }

    CSASSERT(ARRAYSIZE(aTaggedAttribute) >= ita);
    CSASSERT(ARRAYSIZE(aAttr) >= iAttr);
    CSASSERT(ARRAYSIZE(aAttrBlob) >= iblob);

    Response.cTaggedAttribute = ita;
    Response.rgTaggedAttribute = aTaggedAttribute;

    if (!myEncodeObject(
		    X509_ASN_ENCODING,
		    CMC_RESPONSE,
		    &Response,
		    0,
		    CERTLIB_USE_LOCALALLOC,
		    &pbContent,
		    &cbContent))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myEncodeObject");
    }

    if (NULL == pCAContext)
    {
	pCAContext = g_pCAContextCurrent;
    }
    ZeroMemory(&SignerEncodeInfo, sizeof(SignerEncodeInfo));
    SignerEncodeInfo.cbSize = sizeof(SignerEncodeInfo);
    SignerEncodeInfo.pCertInfo = pCAContext->pccCA->pCertInfo;
    SignerEncodeInfo.hCryptProv = pCAContext->hProvCA;
    SignerEncodeInfo.dwKeySpec = AT_SIGNATURE;
    SignerEncodeInfo.HashAlgorithm.pszObjId = szOID_OIWSEC_sha1;
    //SignerEncodeInfo.pvHashAuxInfo = NULL;
    //SignerEncodeInfo.cAuthAttr = 0;
    //SignerEncodeInfo.rgAuthAttr = NULL;
    //SignerEncodeInfo.cUnauthAttr = 0;
    //SignerEncodeInfo.rgUnauthAttr = NULL;

    if (NULL != pbCertLeaf)
    {
	hr = pkcsBuildCRLChain(
			pCAContext,
			pbCertLeaf,
			cbCertLeaf,
			fIncludeCRLs,
			&SignedMsgEncodeInfo.cCertEncoded,
			&SignedMsgEncodeInfo.rgCertEncoded,
			&prgCert,
			&SignedMsgEncodeInfo.cCrlEncoded,
			&SignedMsgEncodeInfo.rgCrlEncoded,
			&prgCRL);
	_JumpIfError(hr, error, "pkcsBuildCRLChain");
    }

    dwRequestFlags = 0;
    if (NULL != prow)
    {
	cb = sizeof(dwRequestFlags);
	hr = prow->GetProperty(
		    g_wszPropRequestFlags,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		    &cb,
		    (BYTE *) &dwRequestFlags);
	_JumpIfError(hr, error, "GetProperty");
    }

#define szOID_CT_PKI_RESPONSE_OLDRFC "1.3.6.1.5.5.7.5.3" // BUGBUG: temporary!
    hMsg = CryptMsgOpenToEncode(
			PKCS_7_ASN_ENCODING | X509_ASN_ENCODING,
			CMSG_CMS_ENCAPSULATED_CONTENT_FLAG,	// dwFlags
			CMSG_SIGNED,
			&SignedMsgEncodeInfo,
			(CR_FLG_OLDRFCCMC & dwRequestFlags)?
			    szOID_CT_PKI_RESPONSE_OLDRFC :
			    szOID_CT_PKI_RESPONSE,
			NULL);		// pStreamInfo
    if (NULL == hMsg)
    {
	hr = myHLastError();
	_JumpError(hr, error, "CryptMsgOpenToEncode");
    }

    if (!CryptMsgUpdate(hMsg, pbContent, cbContent, TRUE))
    {
	hr = myHLastError();
	_JumpError(hr, error, "CryptMsgUpdate");
    }

    // Return the encoded and signed content.
    // Use CMSG_CONTENT_PARAM to get the signed message.

    hr = myCryptMsgGetParam(
		    hMsg,
		    CMSG_CONTENT_PARAM,
		    0,
		    CERTLIB_USE_COTASKMEMALLOC,
		    (VOID **) ppbResponse,
		    pcbResponse);
    _JumpIfError(hr, error, "myCryptMsgGetParam");

error:
    pkcsFreeCRLChain(
		SignedMsgEncodeInfo.cCertEncoded,
		SignedMsgEncodeInfo.rgCertEncoded,
		prgCert,
		SignedMsgEncodeInfo.cCrlEncoded,
		SignedMsgEncodeInfo.rgCrlEncoded,
		prgCRL);
    for (i = 0; i < ARRAYSIZE(aAttrBlob); i++)
    {
	if (NULL != aAttrBlob[i].pbData)
	{
	    LocalFree(aAttrBlob[i].pbData);
	}
    }
    if (NULL != hMsg)
    {
	CryptMsgClose(hMsg);
    }
    if (NULL != pbContent)
    {
	LocalFree(pbContent);
    }
    return(hr);
}


// Build a PKCS7 NULL signature with encapsulated certs

HRESULT
pkcsEncodeCertChain(
    OPTIONAL IN CACTX *pCAContext,
    OPTIONAL IN BYTE const *pbCertLeaf,
    IN DWORD cbCertLeaf,
    IN BYTE const *pbToBeSigned,
    IN DWORD cbToBeSigned,
    IN BOOL fIncludeCRLs,
    OUT BYTE **ppbCertChain,    // CoTaskMem*
    OUT DWORD *pcbCertChain)
{
    HRESULT hr;
    CRYPT_SIGN_MESSAGE_PARA csmp;
    CRYPT_ALGORITHM_IDENTIFIER DigestAlgorithm = { szOID_OIWSEC_sha1, 0, 0 };

    // init csmp for empty signature

    ZeroMemory(&csmp, sizeof(csmp));
    csmp.cbSize = sizeof(csmp);
    csmp.dwMsgEncodingType = PKCS_7_ASN_ENCODING;
    //csmp.pSigningCert = NULL;
    csmp.HashAlgorithm = DigestAlgorithm;
    //csmp.cMsgCert = 0;
    //csmp.rgpMsgCert = NULL;
    //csmp.cMsgCrl = 0;
    //csmp.rgpMsgCrl = NULL;

    hr = pkcsBuildCRLChain(
		    pCAContext,
		    pbCertLeaf,
		    cbCertLeaf,
		    fIncludeCRLs,
		    &csmp.cMsgCert,
		    NULL,
		    &csmp.rgpMsgCert,
		    &csmp.cMsgCrl,
		    NULL,
		    &csmp.rgpMsgCrl);
    _JumpIfError(hr, error, "pkcsBuildCRLChain");

    if (!myCryptSignMessage(
			&csmp,
			pbToBeSigned,
			cbToBeSigned,
			CERTLIB_USE_COTASKMEMALLOC,
			ppbCertChain,
			pcbCertChain))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myCryptSignMessage");
    }
    hr = S_OK;

error:
    pkcsFreeCRLChain(
		csmp.cMsgCert,
		NULL,
		csmp.rgpMsgCert,
		csmp.cMsgCrl,
		NULL,
		csmp.rgpMsgCrl);
    return(hr);
}


HRESULT
PKCSGetCACert(
    IN DWORD iCert,
    OUT BYTE **ppbCACert,
    OUT DWORD *pcbCACert)
{
    HRESULT hr;
    DWORD State;
    CACTX *pCAContext;

    hr = PKCSMapCertIndex(iCert, &iCert, &State);
    _JumpIfError(hr, error, "PKCSMapCertIndex");

    // Now we know iCert is a valid Cert Index:

    pCAContext = &g_aCAContext[iCert];
    if (NULL == pCAContext->pccCA)
    {
	hr = E_INVALIDARG;
	_JumpError(hr, error, "invalid cert");
    }
    *pcbCACert = pCAContext->pccCA->cbCertEncoded;
    *ppbCACert = pCAContext->pccCA->pbCertEncoded;

error:
    return(hr);
}


HRESULT
PKCSGetCAChain(
    IN DWORD iCert,
    IN BOOL fIncludeCRLs,
    OUT BYTE **ppbCAChain, // CoTaskMem*
    OUT DWORD *pcbCAChain)
{
    HRESULT hr;
    DWORD State;
    CACTX *pCAContext;

    hr = PKCSMapCertIndex(iCert, &iCert, &State);
    _JumpIfError(hr, error, "PKCSMapCertIndex");

    // Now we know iCert is a valid Cert Index:

    pCAContext = &g_aCAContext[iCert];
    if (NULL == pCAContext->pccCA)
    {
	hr = E_INVALIDARG;
	_JumpError(hr, error, "invalid cert");
    }
    hr = pkcsEncodeCertChain(
			pCAContext,
			NULL,				  // pbCertLeaf
			0,				  // cbCertLeaf
			pCAContext->pccCA->pbCertEncoded, // pbToBeSigned
			pCAContext->pccCA->cbCertEncoded, // cbToBeSigned
			fIncludeCRLs,
			ppbCAChain,			  // CoTaskMem*
			pcbCAChain);
    _JumpIfError(hr, error, "PKCSEncodeCertChain");

error:
    return(hr);
}


HRESULT
pkcsFormXchgKeyContainerName(
    IN DWORD dwRequestId,
    OUT WCHAR **ppwszKeyContainer)
{
    HRESULT hr;
    DWORD cwcSuffix;
    DWORD cwcName;
    WCHAR wszSuffix[32];
    WCHAR wszKeyContainer[MAX_PATH];

    *ppwszKeyContainer = NULL;

    cwcSuffix = wsprintf(wszSuffix, L"%ws(%u)", g_wszCNXchgSuffix, dwRequestId);
    CSASSERT(ARRAYSIZE(wszSuffix) > cwcSuffix);

    cwcName = wcslen(g_wszSanitizedName);
    if (cwcName > MAX_PATH - cwcSuffix)
    {
	cwcName = MAX_PATH - cwcSuffix;
    }
    CSASSERT(ARRAYSIZE(wszKeyContainer) > cwcName);
    wcscpy(wszKeyContainer, g_wszSanitizedName);
    wcscpy(&wszKeyContainer[cwcName], wszSuffix);

    hr = myDupString(wszKeyContainer, ppwszKeyContainer);
    _JumpIfError(hr, error, "myDupString");

    DBGPRINT((
	DBG_SS_CERTSRV,
	"pkcsFormXchgKeyContainerName: %ws\n",
	*ppwszKeyContainer));

error:
    return(hr);
}


HRESULT
pkcsAcquireKey(
    OPTIONAL IN WCHAR const *pwszKeyContainer,
    OUT HCRYPTPROV *phProv)
{
    HRESULT hr;

    *phProv = NULL;
    if (!CryptAcquireContext(
			phProv,
			pwszKeyContainer,
			g_pwszXchgProvName,
			g_dwXchgProvType,
			g_fXchgMachineKeyset? CRYPT_MACHINE_KEYSET : 0))
    {
	hr = myHLastError();
	_JumpError(hr, error, "CryptAcquireContext");
    }
    hr = S_OK;

error:
    return(hr);
}


VOID
pkcsDeleteKey(
    OPTIONAL IN WCHAR const *pwszKeyContainer)
{
    HRESULT hr;
    HCRYPTPROV hProv;

    if (NULL != pwszKeyContainer)
    {
	if (!CryptAcquireContext(
			    &hProv,
			    pwszKeyContainer,
			    g_pwszXchgProvName,
			    g_dwXchgProvType,
			    CRYPT_DELETEKEYSET |
			     (g_fXchgMachineKeyset? CRYPT_MACHINE_KEYSET : 0)))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "CryptAcquireContext");
	}
    }
error:
    ;
}


VOID
pkcsLoadCAXchgCSPInfo(
    IN BOOL fSetDefaults)
{
    HRESULT hr = S_FALSE;

    if (NULL != g_pwszXchgProvName)
    {
	LocalFree(g_pwszXchgProvName);
	g_pwszXchgProvName = NULL;
    }
    if (!fSetDefaults)
    {
	hr = myGetCertSrvCSP(
			TRUE,	// fEncryptionCSP
			g_wszSanitizedName,
			&g_dwXchgProvType,
			&g_pwszXchgProvName,
			&g_XchgidAlg,
			&g_fXchgMachineKeyset,
			&g_dwXchgKeySize);
	if (S_OK != hr)
	{
	    _PrintError(hr, "myGetCertSrvCSP(CAXchg)");
	}
    }
    if (S_OK != hr)
    {
	g_dwXchgProvType = PROV_RSA_FULL;
	g_pwszXchgProvName = NULL;
	g_XchgidAlg = CALG_3DES;
	g_fXchgMachineKeyset = TRUE;
	g_dwXchgKeySize = 0;
    }
    if (0 == g_dwXchgKeySize)
    {
	g_dwXchgKeySize = 1024;
    }
}


HRESULT
pkcsCreateNewCAXchgCert(
    IN WCHAR const *pwszUserName)
{
    HRESULT hr;
    ICertDBRow *prow = NULL;
    DWORD dwRequestFlags = CR_FLG_CAXCHGCERT;
    BOOL fSubjectNameSet;
    BOOL fErrorLogged;
    CERT_PUBLIC_KEY_INFO *pPubKey = NULL;
    DWORD cb;
    CAXCHGCTX CAXchgContext;
    CAXCHGCTX *rgCAXchgContext;
    CERT_EXTENSION aExt[4];
    DWORD cExt;
    DWORD i;
    CERTTRANSBLOB ctbCert;		// CoTaskMem*
    CERTSRV_RESULT_CONTEXT Result;
    WCHAR *pwszDisposition = NULL;
    WCHAR *pwszMachineRequesterName = NULL;
    BOOL fCommitted = FALSE;
    static char *s_apszObjId[] =
    {
	szOID_KP_CA_EXCHANGE,
    };

    ZeroMemory(&CAXchgContext, sizeof(CAXchgContext));
    ZeroMemory(&aExt, sizeof(aExt));
    ZeroMemory(&ctbCert, sizeof(ctbCert));

    hr = g_pCertDB->OpenRow(PROPTABLE_REQCERT, 0, NULL, &prow);
    _JumpIfError(hr, error, "OpenRow");

    prow->GetRowId(&CAXchgContext.ReqId);

    hr = myGetComputerObjectName(NameSamCompatible, &pwszMachineRequesterName);
    if (S_OK != hr)
    {
	_PrintError(hr, "myGetComputerObjectName");

	hr = myGetUserNameEx(NameSamCompatible, &pwszMachineRequesterName);
	_JumpIfError(hr, error, "myGetUserNameEx");
    }

    hr = prow->SetProperty(
		g_wszPropRequesterName,
		PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		MAXDWORD,
		(BYTE const *) pwszMachineRequesterName);
    _JumpIfError(hr, error, "SetProperty");

    hr = prow->SetProperty(
		g_wszPropCallerName,
		PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		MAXDWORD,
		(BYTE const *) pwszUserName);
    _JumpIfError(hr, error, "SetProperty");

    hr = prow->SetProperty(
		wszPROPCERTIFICATETEMPLATE,
		PROPTYPE_STRING | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		MAXDWORD,
		(BYTE const *) wszCERTTYPE_CA_EXCHANGE);
    _JumpIfError(hr, error, "SetProperty");

    hr = pkcsFormXchgKeyContainerName(
				CAXchgContext.ReqId,
				&CAXchgContext.pwszKeyContainerName);
    _JumpIfError(hr, error, "pkcsFormXchgKeyContainerName");

    for (i = 0; ; i++)
    {
	hr = myGenerateKeys(
			CAXchgContext.pwszKeyContainerName,
			g_pwszXchgProvName,
			g_fXchgMachineKeyset,
			AT_KEYEXCHANGE,
			g_dwXchgProvType,
			g_dwXchgKeySize,
			&CAXchgContext.hProvCA);
	if (S_OK == hr)
	{
	    break;
	}
	_PrintErrorStr(hr, "myGenerateKeys", g_pwszXchgProvName);
	LogEventHResult(
		    EVENTLOG_ERROR_TYPE,
		    NULL == g_pwszXchgProvName?
			MSG_E_BAD_DEFAULT_CA_XCHG_CSP :
			MSG_E_BAD_REGISTRY_CA_XCHG_CSP,
		    hr);
	if (0 != i || NULL == g_pwszXchgProvName)
	{
	    _JumpError(hr, error, "myGenerateKeys");
	}
	pkcsLoadCAXchgCSPInfo(TRUE);	// switch to default CSP
    }
    if (0 != i)
    {
	hr = LogEvent(
		    EVENTLOG_WARNING_TYPE,
		    MSG_E_USE_DEFAULT_CA_XCHG_CSP,
		    0,			// cpwsz
		    NULL);		// apwsz
	_PrintIfError(hr, "LogEvent");
    }

    if (!myCryptExportPublicKeyInfo(
				CAXchgContext.hProvCA,
				AT_KEYEXCHANGE,
				CERTLIB_USE_LOCALALLOC,
				&pPubKey,
				&cb))
    {
	hr = myHLastError();
	_JumpError(hr, error, "myCryptExportPublicKeyInfo");
    }

    hr = PropSetRequestTimeProperty(prow, g_wszPropRequestSubmittedWhen);
    _JumpIfError(hr, error, "PropSetRequestTimeProperty");

    hr = CoreSetDisposition(prow, DB_DISP_ACTIVE);
    _JumpIfError(hr, error, "CoreSetDisposition");

    hr = pkcsSetRequestNameInfo(
			prow,
			&g_pCAContextCurrent->pccCA->pCertInfo->Subject,
			g_wszCNXchgSuffix,
			&dwRequestFlags,
			&fSubjectNameSet);
    _JumpIfError(hr, error, "pkcsSetRequestNameInfo");

    hr = prow->SetProperty(
		    g_wszPropRequestFlags,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		    sizeof(dwRequestFlags),
		    (BYTE const *) &dwRequestFlags);
    _JumpIfError(hr, error, "SetProperty(RequestFlags)");

    CSASSERT(fSubjectNameSet);

    hr = pkcsSetPublicKeyProperties(prow, pPubKey);
    _JumpIfError(hr, error, "pkcsSetPublicKeyProperties");

    hr = prow->CopyRequestNames();
    _JumpIfError(hr, error, "CopyRequestNames");

    hr = PKCSSetServerProperties(
			prow,
			g_lCAXchgValidityPeriodCount,
			g_enumCAXchgValidityPeriod);
    _JumpIfError(hr, error, "PKCSSetServerProperties");

    cExt = 0;

    // szOID_KEY_USAGE
    {
	CRYPT_BIT_BLOB KeyUsage;
	BYTE abKeyUsage[1] =
	    { CERT_KEY_ENCIPHERMENT_KEY_USAGE | CERT_KEY_AGREEMENT_KEY_USAGE };

	KeyUsage.pbData = abKeyUsage;
	KeyUsage.cbData = sizeof(abKeyUsage);
	KeyUsage.cUnusedBits = 0;

	if (!myEncodeKeyUsage(
			X509_ASN_ENCODING,
			&KeyUsage,
			CERTLIB_USE_LOCALALLOC,
			&aExt[cExt].Value.pbData,
			&aExt[cExt].Value.cbData))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "myEncodeKeyUsage");
	}
    }
    hr = PropSetExtension(
		    prow,
		    PROPTYPE_BINARY | PROPCALLER_SERVER,
		    TEXT(szOID_KEY_USAGE),
		    0,			// ExtFlags
		    aExt[cExt].Value.cbData,
		    aExt[cExt].Value.pbData);
    _JumpIfError(hr, error, "PropSetExtension");

    cExt++;

    // szOID_ENHANCED_KEY_USAGE
    {
	CERT_ENHKEY_USAGE eku;

	eku.cUsageIdentifier = ARRAYSIZE(s_apszObjId);
	eku.rgpszUsageIdentifier = s_apszObjId;

	if (!myEncodeObject(
			X509_ASN_ENCODING,
			X509_ENHANCED_KEY_USAGE,
			&eku,
			0,
			CERTLIB_USE_LOCALALLOC,
			&aExt[cExt].Value.pbData,
			&aExt[cExt].Value.cbData))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "myEncodeObject");
	}
    }
    hr = PropSetExtension(
		    prow,
		    PROPTYPE_BINARY | PROPCALLER_SERVER,
		    TEXT(szOID_ENHANCED_KEY_USAGE),
		    0,			// ExtFlags
		    aExt[cExt].Value.cbData,
		    aExt[cExt].Value.pbData);
    _JumpIfError(hr, error, "PropSetExtension");

    cExt++;

    // szOID_APPLICATION_CERT_POLICIES
    {
	CERT_POLICY_INFO acpi[ARRAYSIZE(s_apszObjId)];
	CERT_POLICIES_INFO cps;

	ZeroMemory(&acpi, sizeof(acpi));
	cps.cPolicyInfo = ARRAYSIZE(s_apszObjId);
	cps.rgPolicyInfo = acpi;
	for (i = 0; i < ARRAYSIZE(s_apszObjId); i++)
	{
	    acpi[i].pszPolicyIdentifier = s_apszObjId[i];
	}
	if (!myEncodeObject(
			X509_ASN_ENCODING,
			X509_CERT_POLICIES,
			&cps,
			0,
			CERTLIB_USE_LOCALALLOC,
			&aExt[cExt].Value.pbData,
			&aExt[cExt].Value.cbData))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "myEncodeObject");
	}
    }
    hr = PropSetExtension(
		    prow,
		    PROPTYPE_BINARY | PROPCALLER_SERVER,
		    TEXT(szOID_APPLICATION_CERT_POLICIES),
		    0,			// ExtFlags
		    aExt[cExt].Value.cbData,
		    aExt[cExt].Value.pbData);
    _JumpIfError(hr, error, "PropSetExtension");

    cExt++;

    // szOID_ENROLL_CERTTYPE_EXTENSION

    hr = myBuildCertTypeExtension(wszCERTTYPE_CA_EXCHANGE, &aExt[cExt]);
    _JumpIfError(hr, error, "myBuildCertTypeExtension");

    hr = PropSetExtension(
		    prow,
		    PROPTYPE_BINARY | PROPCALLER_SERVER,
		    TEXT(szOID_ENROLL_CERTTYPE_EXTENSION),
		    0,			// ExtFlags
		    aExt[cExt].Value.cbData,
		    aExt[cExt].Value.pbData);
    _JumpIfError(hr, error, "PropSetExtension");

    cExt++;
    CSASSERT(cExt == ARRAYSIZE(aExt));

    ZeroMemory(&Result, sizeof(Result));
    Result.pctbCert = &ctbCert;
    hr = PKCSCreateCertificate(
			prow,
			DB_DISP_ISSUED,
			FALSE,
			&fErrorLogged,
			NULL,
			&Result);
    _JumpIfError(hr, error, "PKCSCreateCertificate");

    CAXchgContext.pccCA = CertCreateCertificateContext(
					    X509_ASN_ENCODING,
					    ctbCert.pb,
					    ctbCert.cb);
    if (NULL == CAXchgContext.pccCA)
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertCreateCertificateContext");
    }

    if (NULL == g_aCAXchgContext)
    {
	CSASSERT(0 == g_cCAXchgCerts);
	rgCAXchgContext = (CAXCHGCTX *) LocalAlloc(
					    LMEM_FIXED,
					    sizeof(rgCAXchgContext[0]));
    }
    else
    {
	rgCAXchgContext = (CAXCHGCTX *) LocalReAlloc(
			    g_aCAXchgContext,
			    (g_cCAXchgCerts + 1) * sizeof(rgCAXchgContext[0]),
			    LMEM_MOVEABLE);
    }
    if (NULL == rgCAXchgContext)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc/ReAlloc");
    }
    g_aCAXchgContext = rgCAXchgContext;
    g_aCAXchgContext[g_cCAXchgCerts] = CAXchgContext;

    pwszDisposition = CoreBuildDispositionString(
					g_pwszRequestedBy,
					pwszUserName,
					NULL,
					NULL,
					S_OK,
					FALSE);

    hr = CoreSetRequestDispositionFields(
				prow,
				S_OK,
				DB_DISP_ISSUED,
				pwszDisposition);
    _JumpIfError(hr, error, "CoreSetRequestDispositionFields");

    hr = prow->CommitTransaction(TRUE);
    _JumpIfError(hr, error, "CommitTransaction");

    fCommitted = TRUE;

    g_pCAXchgContextCurrent = &g_aCAXchgContext[g_cCAXchgCerts];

    g_cCAXchgCerts++;
    ZeroMemory(&CAXchgContext, sizeof(CAXchgContext));

error:
    if (NULL != pwszMachineRequesterName)
    {
        LocalFree(pwszMachineRequesterName);
    }
    if (NULL != pwszDisposition)
    {
        LocalFree(pwszDisposition);
    }
    for (i = 0; i < ARRAYSIZE(aExt); i++)
    {
	if (NULL != aExt[i].Value.pbData)
	{
	    LocalFree(aExt[i].Value.pbData);
	}
    }
    if (NULL != prow)
    {
	if (S_OK != hr && !fCommitted)
	{
	    HRESULT hr2 = prow->CommitTransaction(FALSE);
	    _PrintIfError(hr2, "CommitTransaction");
	}
	prow->Release();
    }
    if (NULL != ctbCert.pb)
    {
	CoTaskMemFree(ctbCert.pb);
    }
    if (NULL != pPubKey)
    {
	LocalFree(pPubKey);
    }
    if (NULL != CAXchgContext.pccCA)
    {
	CertFreeCertificateContext(CAXchgContext.pccCA);
    }
    if (NULL != CAXchgContext.hProvCA)
    {
	CryptReleaseContext(CAXchgContext.hProvCA, 0);
	pkcsDeleteKey(CAXchgContext.pwszKeyContainerName);
    }
    if (NULL != CAXchgContext.pwszKeyContainerName)
    {
	LocalFree(CAXchgContext.pwszKeyContainerName);
    }
    return(hr);
}


VOID
pkcsReleaseCAXchgContext(
    IN OUT CAXCHGCTX *pCAXchgContext)
{
    if (NULL != pCAXchgContext->hProvCA)
    {
	CryptReleaseContext(pCAXchgContext->hProvCA, 0);
	pCAXchgContext->hProvCA = NULL;
    }
    if (NULL != pCAXchgContext->pccCA)
    {
	CertFreeCertificateContext(pCAXchgContext->pccCA);
	pCAXchgContext->pccCA = NULL;
    }
    if (NULL != pCAXchgContext->pwszKeyContainerName)
    {
	LocalFree(pCAXchgContext->pwszKeyContainerName);
	pCAXchgContext->pwszKeyContainerName = NULL;
    }
}


VOID
pkcsReleaseCAXchgContextArray()
{
    DWORD i;

    if (NULL != g_aCAXchgContext)
    {
	for (i = 0; i < g_cCAXchgCerts; i++)
	{
	    pkcsReleaseCAXchgContext(&g_aCAXchgContext[i]);
	}
	LocalFree(g_aCAXchgContext);
	g_aCAXchgContext = NULL;
    }
    g_cCAXchgCerts = 0;
    g_pCAContextCurrent = NULL;
}


HRESULT
pkcsLoadCAXchgContext(
    IN DWORD iHash)
{
    HRESULT hr;
    CAXCHGCTX *pCAXchgContext;
    DWORD dwRequestFlags;
    DWORD NameId;
    HCRYPTPROV hProv = NULL;
    WCHAR *pwszKeyContainer = NULL;
    WCHAR *pwszHash = NULL;
    BYTE abHash[CBMAX_CRYPT_HASH_LEN];
    BYTE *pbHash = NULL;
    DWORD cbHash;
    BYTE *pbCert = NULL;
    DWORD cbCert;
    DWORD cb;
    BSTR strHash = NULL;
    ICertDBRow *prow = NULL;
    DWORD dwRequestId;
    CERT_CONTEXT const *pcc = NULL;
    BOOL fDeleteKey = FALSE;
    DWORD i;

    hr = myGetCARegHash(
		g_wszSanitizedName,
		CSRH_CAXCHGCERT,
		iHash,
		&pbHash,
		&cbHash);
    _JumpIfError2(hr, error, "myGetCARegHash", S_FALSE);

    hr = MultiByteIntegerToBstr(TRUE, cbHash, pbHash, &strHash);
    _JumpIfError(hr, error, "MultiByteIntegerToBstr");

    DBGPRINT((
	DBG_SS_CERTSRV,
	"Reloading Xchg CAContext[%u]:\n    %ws\n",
	iHash,
	strHash));

    hr = g_pCertDB->OpenRow(
		    PROPOPEN_READONLY | PROPOPEN_CERTHASH | PROPTABLE_REQCERT,
		    0,
		    strHash,
		    &prow);
    _JumpIfError(hr, error, "OpenRow(xchg cert)");

    prow->GetRowId(&dwRequestId);

    hr = pkcsFormXchgKeyContainerName(dwRequestId, &pwszKeyContainer);
    _JumpIfError(hr, error, "pkcsFormXchgKeyContainerName");

    cb = sizeof(dwRequestFlags);
    hr = prow->GetProperty(
		    g_wszPropRequestFlags,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		    &cb,
		    (BYTE *) &dwRequestFlags);
    _JumpIfError(hr, error, "GetProperty(RequestFlags)");

    if (0 == (CR_FLG_CAXCHGCERT & dwRequestFlags))
    {
	hr = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
	_JumpError(hr, error, "Not a CA Xchg cert");
    }

    cb = sizeof(NameId);
    hr = prow->GetProperty(
		    g_wszPropCertificateIssuerNameID,
		    PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		    &cb,
		    (BYTE *) &NameId);
    _JumpIfError(hr, error, "GetProperty");

    hr = PKCSGetProperty(
		prow,
		g_wszPropRawCertificate,
		PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		&cbCert,
		(BYTE **) &pbCert);
    _JumpIfError(hr, error, "PKCSGetProperty(xchg cert)");

    pcc = CertCreateCertificateContext(X509_ASN_ENCODING, pbCert, cbCert);
    if (NULL == pcc)
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertCreateCertificateContext");
    }

    for (i = 0; ; i++)
    {
	hr = pkcsAcquireKey(pwszKeyContainer, &hProv);
	_PrintIfErrorStr(hr, "pkcsAcquireKey", g_pwszXchgProvName);

	if (S_OK == hr)
	{
	    hr = myValidateKeyForEncrypting(
				    hProv,
				    &pcc->pCertInfo->SubjectPublicKeyInfo,
				    CALG_3DES);
	    _PrintIfErrorStr(hr, "myValidateKeyForEncrypting", g_pwszXchgProvName);
	}
	if (S_OK == hr)
	{
	    break;
	}
	LogEventHResult(
		    EVENTLOG_ERROR_TYPE,
		    NULL == g_pwszXchgProvName?
			MSG_E_BAD_DEFAULT_CA_XCHG_CSP :
			MSG_E_BAD_REGISTRY_CA_XCHG_CSP,
		    hr);
	if (0 != i || NULL == g_pwszXchgProvName)
	{
	    fDeleteKey = TRUE;
	    _JumpError(hr, error, "pkcsAcquireKey/myValidateKeyForEncrypting");
	}
	pkcsLoadCAXchgCSPInfo(TRUE);	// switch to default CSP
    }
    if (0 != i)
    {
	hr = LogEvent(
		    EVENTLOG_WARNING_TYPE,
		    MSG_E_USE_DEFAULT_CA_XCHG_CSP,
		    0,			// cpwsz
		    NULL);		// apwsz
	_PrintIfError(hr, "LogEvent");
    }

    hr = pkcsVerifyCertContext(NULL, FALSE, pcc);
    if (S_OK != hr)
    {
	fDeleteKey = TRUE;
	_JumpErrorStr(hr, error, "pkcsVerifyCertContext", L"CAXchg cert invalid");
    }

    pCAXchgContext = &g_aCAXchgContext[g_cCAXchgCerts];
    ZeroMemory(pCAXchgContext, sizeof(*pCAXchgContext));

    pCAXchgContext->ReqId = dwRequestId;

    pCAXchgContext->pccCA = pcc;
    pcc = NULL;

    pCAXchgContext->hProvCA = hProv;
    hProv = NULL;

    pCAXchgContext->pwszKeyContainerName = pwszKeyContainer;
    pwszKeyContainer = NULL;

    pCAXchgContext->iCertSig = CANAMEIDTOICERT(NameId);
    g_cCAXchgCerts++;
    hr = S_OK;

error:
    if (NULL != hProv)
    {
	CryptReleaseContext(hProv, 0);
    }
    if (fDeleteKey)
    {
	pkcsDeleteKey(pwszKeyContainer);
    }
    if (NULL != prow)
    {
	prow->Release();
    }
    if (NULL != pbCert)
    {
	LocalFree(pbCert);
    }
    if (NULL != pcc)
    {
	CertFreeCertificateContext(pcc);
    }
    if (NULL != pwszKeyContainer)
    {
	LocalFree(pwszKeyContainer);
    }
    if (NULL != pbHash)
    {
	LocalFree(pbHash);
    }
    if (NULL != strHash)
    {
	SysFreeString(strHash);
    }
    return(hr);
}


HRESULT
pkcsLoadCAXchgContextArray(
    OUT BOOL *pfIncompleteLoad)
{
    HRESULT hr;
    DWORD cCAXchgCerts;
    DWORD iHash;
    DWORD i;

    // get provider name, etc.

    pkcsLoadCAXchgCSPInfo(FALSE);

    // find & load CA Xchg certs, etc.

    *pfIncompleteLoad = TRUE;
    hr = myGetCARegHashCount(
			g_wszSanitizedName,
			CSRH_CAXCHGCERT,
			&cCAXchgCerts);
    if (S_OK == hr && 0 == cCAXchgCerts)
    {
	hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
    }
    _JumpIfError(hr, error, "myGetCARegHashCount");

    g_aCAXchgContext = (CAXCHGCTX *) LocalAlloc(
				LMEM_FIXED | LMEM_ZEROINIT,
				cCAXchgCerts * sizeof(g_aCAXchgContext[0]));
    if (NULL == g_aCAXchgContext)
    {
	hr = E_OUTOFMEMORY;
	_JumpError(hr, error, "LocalAlloc");
    }

    for (iHash = 0; iHash < cCAXchgCerts; iHash++)
    {
	hr = pkcsLoadCAXchgContext(iHash);
	_PrintIfError(hr, "pkcsLoadCAXchgContext");
    }
    if (0 == g_cCAXchgCerts)
    {
	hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
	_JumpError(hr, error, "g_cCAXchgCerts");
    }
    g_pCAXchgContextCurrent = &g_aCAXchgContext[0];
    for (i = 1; i < g_cCAXchgCerts; i++)
    {
	if (0 < CompareFileTime(
			&g_aCAXchgContext[i].pccCA->pCertInfo->NotAfter,
			&g_pCAXchgContextCurrent->pccCA->pCertInfo->NotAfter))
	{
	    g_pCAXchgContextCurrent = &g_aCAXchgContext[i];
	}
    }
    if (cCAXchgCerts == g_cCAXchgCerts)
    {
	*pfIncompleteLoad = FALSE;
    }
    hr = S_OK;

error:
    if (S_OK != hr)
    {
	if (NULL != g_aCAXchgContext)
	{
	    LocalFree(g_aCAXchgContext);
	    g_aCAXchgContext = NULL;
	}
	g_cCAXchgCerts = 0;
	g_pCAXchgContextCurrent = NULL;
    }
    return(hr);
}


HRESULT
pkcsUpdateCAXchgStoreAndRegistry(
    IN BOOL fUpdateRegistry)
{
    HRESULT hr;
    DWORD i;
    DWORD iHash;
    CAXCHGCTX *pCAXchgContext;
    HCERTSTORE hStore = NULL;
    CERT_KEY_CONTEXT ckc;
    CERT_CONTEXT const *pccStore = NULL;

    hStore = CertOpenStore(
		       CERT_STORE_PROV_MEMORY,
		       X509_ASN_ENCODING,
		       NULL,			// hProv
		       0,			// dwFlags
		       NULL);			// pvPara
    if (NULL == hStore)
    {
	hr = myHLastError();
	_JumpError(hr, error, "CertOpenStore");
    }
    if (fUpdateRegistry)
    {
	hr = myDeleteCertRegValue(
			    g_wszSanitizedName,
			    NULL,
			    NULL,
			    g_wszRegCAXchgCertHash);
	_PrintIfError(hr, "myDeleteCertRegValue");
    }

    ZeroMemory(&ckc, sizeof(ckc));
    ckc.cbSize = sizeof(ckc);
    ckc.dwKeySpec = AT_KEYEXCHANGE;

    iHash = 0;
    for (i = 0; i < g_cCAXchgCerts; i++)
    {
	pCAXchgContext = &g_aCAXchgContext[i];
	if (CTXF_EXPIRED & pCAXchgContext->Flags)
	{
	    continue;
	}

	// Add as encoded blob to avoid all properties, key prov info, etc.

	if (!CertAddEncodedCertificateToStore(
			hStore,
			X509_ASN_ENCODING,
			pCAXchgContext->pccCA->pbCertEncoded,
			pCAXchgContext->pccCA->cbCertEncoded,
			CERT_STORE_ADD_REPLACE_EXISTING,
			&pccStore))			// ppCertContext
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "CertAddEncodedCertificateToStore");
	}
	ckc.hCryptProv = pCAXchgContext->hProvCA;
	if (!CertSetCertificateContextProperty(
					pccStore,
					CERT_KEY_CONTEXT_PROP_ID,
					CERT_STORE_NO_CRYPT_RELEASE_FLAG,
					&ckc))
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "CertSetCertificateContextProperty");
	}
	CertFreeCertificateContext(pccStore);
	pccStore = NULL;

	DBGPRINT((
            DBG_SS_CERTSRV,
	    "Add to CA Xchg memory store: '%ws'\n",
	    pCAXchgContext->pwszKeyContainerName));

	if (fUpdateRegistry)
	{
	    hr = mySetCARegHash(
			    g_wszSanitizedName,
			    CSRH_CAXCHGCERT,
			    iHash,
			    pCAXchgContext->pccCA);
	    if (S_OK != hr)
	    {
		_PrintError(hr, "mySetCARegHash");
		continue;
	    }
	}
	iHash++;
    }
    if (NULL != g_hStoreCAXchg)
    {
	CertCloseStore(g_hStoreCAXchg, CERT_CLOSE_STORE_CHECK_FLAG);
    }
    g_hStoreCAXchg = hStore;
    hStore = NULL;
    hr = S_OK;

error:
    if (NULL != pccStore)
    {
	CertFreeCertificateContext(pccStore);
    }
    if (NULL != hStore)
    {
	CertCloseStore(hStore, CERT_CLOSE_STORE_CHECK_FLAG);
    }
    return(hr);
}


HRESULT
PKCSIsRevoked(
    IN DWORD RequestId,
    OPTIONAL IN WCHAR const *pwszSerialNumber,
    OUT LONG *pRevocationReason,
    OUT LONG *pDisposition)
{
    HRESULT hr;
    ICertDBRow *prow = NULL;
    BYTE *pbHash = NULL;
    DWORD cbHash;
    BSTR strHash = NULL;
    DWORD Disposition;
    DWORD cbProp;
    FILETIME ftRevoked;
    FILETIME ftCurrent;

    *pRevocationReason = CRL_REASON_UNSPECIFIED;
    *pDisposition = CA_DISP_INVALID;

    hr = g_pCertDB->OpenRow(
			PROPOPEN_READONLY | PROPTABLE_REQCERT,
			RequestId,
			pwszSerialNumber,
			&prow);
    _PrintIfErrorStr2(hr, "OpenRow", pwszSerialNumber, CERTSRV_E_PROPERTY_EMPTY);

    if (CERTSRV_E_PROPERTY_EMPTY == hr && NULL != pwszSerialNumber)
    {
	_PrintErrorStr2(
		hr,
		"OpenRow(serial)",
		pwszSerialNumber,
		CERTSRV_E_PROPERTY_EMPTY);

	hr = WszToMultiByteInteger(TRUE, pwszSerialNumber, &cbHash, &pbHash);
	_JumpIfError(hr, error, "WszToMultiByteInteger");

	hr = MultiByteIntegerToBstr(TRUE, cbHash, pbHash, &strHash);
	_JumpIfError(hr, error, "MultiByteIntegerToBstr");

	hr = g_pCertDB->OpenRow(
			PROPOPEN_READONLY |
			    PROPOPEN_CERTHASH |
			    PROPTABLE_REQCERT,
			RequestId,
			strHash,
			&prow);
	_PrintIfErrorStr2(hr, "OpenRow", strHash, CERTSRV_E_PROPERTY_EMPTY);
    }
    if (S_OK != hr)
    {
	if (CERTSRV_E_PROPERTY_EMPTY == hr)
	{
	    hr = S_OK; // disposition indicates cert is invalid
	}
	goto error;
    }

    cbProp = sizeof(Disposition);
    hr = prow->GetProperty(
		   g_wszPropRequestDisposition,
		   PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		   &cbProp,
		   (BYTE *) &Disposition);
    _JumpIfError(hr, error, "GetProperty(Disposition)");

    if (DB_DISP_ISSUED == Disposition ||
	(DB_DISP_CA_CERT == Disposition && IsRootCA(g_CAType)))
    {
	*pDisposition = CA_DISP_VALID;
	goto error;
    }

    if (DB_DISP_REVOKED != Disposition)
    {
	goto error;
    }

    cbProp = sizeof(ftRevoked);
    hr = prow->GetProperty(
		    g_wszPropRequestRevokedEffectiveWhen,
		    PROPTYPE_DATE | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		    &cbProp,
		    (BYTE *) &ftRevoked);

    if (CERTSRV_E_PROPERTY_EMPTY == hr)
    {
	*pDisposition = CA_DISP_VALID;
	hr = S_OK;
	goto error;
    }
    _JumpIfError(hr, error, "GetProperty(RevokedEffectiveWhen)");

    GetSystemTimeAsFileTime(&ftCurrent);
    if (0 < CompareFileTime(&ftRevoked, &ftCurrent))
    {
	*pDisposition = CA_DISP_VALID;
	goto error;
    }

    cbProp = sizeof(*pRevocationReason);
    hr = prow->GetProperty(
		   g_wszPropRequestRevokedReason,
		   PROPTYPE_LONG | PROPCALLER_SERVER | PROPTABLE_REQUEST,
		   &cbProp,
		   (BYTE *) pRevocationReason);
    _JumpIfError(hr, error, "GetProperty(RevokedReason)");

    *pDisposition = CA_DISP_REVOKED;

error:
    if (NULL != pbHash)
    {
	LocalFree(pbHash);
    }
    if (NULL != strHash)
    {
	SysFreeString(strHash);
    }
    if (NULL != prow)
    {
	prow->Release();
    }
    return(hr);
}


HRESULT
PKCSGetCAXchgCert(
    IN DWORD iCert,
    IN WCHAR const *pwszUserName,
    OUT DWORD *piCertSig,
    OUT BYTE **ppbCACert,
    OUT DWORD *pcbCACert)
{
    HRESULT hr;
    DWORD State;
    BOOL fNewCert = FALSE;
    BOOL fIncompleteLoad = FALSE;
    FILETIME ft;

    if (MAXDWORD != iCert && 0 != iCert)
    {
	hr = E_INVALIDARG;
	_JumpError(hr, error, "bad Xchg CertIndex");
    }
    if (NULL == g_pCAXchgContextCurrent ||
	NULL == g_pCAXchgContextCurrent->pccCA)
    {
	hr = pkcsLoadCAXchgContextArray(&fIncompleteLoad);
	_PrintIfError(hr, "pkcsLoadCAXchgContextArray");

	if (S_OK != hr)
	{
	    fNewCert = TRUE;
	}
    }
    if (NULL != g_pCAXchgContextCurrent &&
	NULL != g_pCAXchgContextCurrent->pccCA)
    {
	CERT_INFO const *pCertInfo = g_pCAXchgContextCurrent->pccCA->pCertInfo;
	
	GetSystemTimeAsFileTime(&ft);

	if (0 < CompareFileTime(&ft, &pCertInfo->NotAfter))
	{
	    g_pCAXchgContextCurrent->Flags |= CTXF_EXPIRED;
	    hr = CERT_E_EXPIRED;
	    _PrintError(hr, "CA Xchg certificate is expired -- delete key");

	    pkcsDeleteKey(g_pCAXchgContextCurrent->pwszKeyContainerName);
	    fNewCert = TRUE;
	}
	else
	if (0 > CompareFileTime(&ft, &pCertInfo->NotBefore))
	{
	    hr = CERT_E_EXPIRED;
	    _PrintError(hr, "CA Xchg certificate not yet valid");
	    fNewCert = TRUE;
	}
	else
	{
	    myMakeExprDateTime(
			&ft,
			g_lCAXchgOverlapPeriodCount,
			g_enumCAXchgOverlapPeriod);

	    if (0 < CompareFileTime(&ft, &pCertInfo->NotAfter))
	    {
		hr = CERT_E_EXPIRED;
		_PrintError(hr, "CA Xchg certificate expires too soon");
		fNewCert = TRUE;
	    }
	    else
	    {
		hr = pkcsVerifyCertIssuer(
				g_pCAXchgContextCurrent->pccCA,
				g_pCAContextCurrent);
		if (S_OK != hr)
		{
		    _PrintError(hr, "CA Xchg cert not issued by current CA");
		    fNewCert = TRUE;
		}
		else
		{
		    LONG RevocationReason;
		    LONG Disposition;

		    hr = PKCSIsRevoked(
				g_pCAXchgContextCurrent->ReqId,
				NULL,		// pwszSerialNumber
				&RevocationReason,
				&Disposition);
		    if (S_OK != hr)
		    {
			_PrintError(hr, "PKCSIsRevoked");
			fNewCert = TRUE;
		    }
		    else
		    if (CA_DISP_VALID != Disposition)
		    {
			hr = CRYPT_E_REVOKED;
			_PrintError(hr, "revoked or bad CA Xchg certificate");
			fNewCert = TRUE;
		    }
		}
	    }
	}
    }
    if (fNewCert)
    {
	hr = pkcsCreateNewCAXchgCert(pwszUserName);
	_JumpIfError(hr, error, "pkcsCreateNewCAXchgCert");
    }
    hr = pkcsUpdateCAXchgStoreAndRegistry(fNewCert || fIncompleteLoad);
    _JumpIfError(hr, error, "pkcsUpdateCAXchgStoreAndRegistry");

    *piCertSig = g_pCAXchgContextCurrent->iCertSig;
    *pcbCACert = g_pCAXchgContextCurrent->pccCA->cbCertEncoded;
    *ppbCACert = g_pCAXchgContextCurrent->pccCA->pbCertEncoded;
    hr = S_OK;

error:
    return(hr);
}


HRESULT
PKCSGetCAXchgChain(
    IN DWORD iCert,
    IN WCHAR const *pwszUserName,
    IN BOOL fIncludeCRLs,
    OUT BYTE **ppbCAChain, // CoTaskMem*
    OUT DWORD *pcbCAChain)
{
    HRESULT hr;
    BYTE *pbCACert;
    DWORD cbCACert;
    CACTX *pCAContext;

    hr = PKCSGetCAXchgCert(iCert, pwszUserName, &iCert, &pbCACert, &cbCACert);
    _JumpIfError(hr, error, "PKCSGetCAXchgCert");

    // iCert now indexes the signature cert that signed the current Xchg cert

    pCAContext = &g_aCAContext[iCert];
    if (NULL == pCAContext->pccCA)
    {
	hr = E_INVALIDARG;
	_JumpError(hr, error, "invalid cert");
    }
    hr = pkcsEncodeCertChain(
			pCAContext,
			pbCACert,	// pbCertLeaf
			cbCACert,	// cbCertLeaf
			pbCACert,	// pbToBeSigned
			cbCACert,	// cbToBeSigned
			fIncludeCRLs,
			ppbCAChain,	// CoTaskMem*
			pcbCAChain);
    _JumpIfError(hr, error, "PKCSEncodeCertChain");

error:
    return(hr);
}


VOID
PKCSTerminate(VOID)
{
    pkcsReleaseCAContextArray();
    pkcsReleaseCAXchgContextArray();
    if (NULL != g_hStoreCAXchg)
    {
	CertCloseStore(g_hStoreCAXchg, CERT_CLOSE_STORE_CHECK_FLAG);
	g_hStoreCAXchg = NULL;
    }
    pkcsLoadCAXchgCSPInfo(TRUE);
    pkcsReleaseKRACertArray();

    pkcsFreeTemplates(&g_paRevURL, &g_caRevURL);
    pkcsFreeTemplates(&g_paCACertURL, &g_caCACertURL);
    if (NULL != g_pwszKRAPublishURL)
    {
	LocalFree(g_pwszKRAPublishURL);
	g_pwszKRAPublishURL = NULL;
    }
    if (NULL != g_pwszAIACrossCertPublishURL)
    {
	LocalFree(g_pwszAIACrossCertPublishURL);
	g_pwszAIACrossCertPublishURL = NULL;
    }
    if (NULL != g_pwszRootTrustCrossCertPublishURL)
    {
	LocalFree(g_pwszRootTrustCrossCertPublishURL);
	g_pwszRootTrustCrossCertPublishURL = NULL;
    }
    if (NULL != g_strDomainDN)
    {
	SysFreeString(g_strDomainDN);
	g_strDomainDN = NULL;
    }
    if (NULL != g_strConfigDN)
    {
	SysFreeString(g_strConfigDN);
	g_strConfigDN = NULL;
    }
}


// PKCSCreateCertificate -- Create certificate & build PKCS 7 or Full Response.
//
// If pResult->pctbCert is non-NULL and pResult->pctbCert->pb is NULL:
// CR_IN_NEW:
//	Build, store and return cert
//	Use current CA Context
//	Build and return PKCS 7 or Full Response
//
// If pResult->pctbCert is non-NULL and pResult->pctbCert->pb is non-NULL:
// CR_IN_RETRIEVEPENDING:
//	Use passed cert
//	Find matching CA Context
//	Build and return PKCS 7 or Full Response
//
// If pResult->pctbCert is NULL:
// CR_IN_RESUBMIT:
//	Build and store cert -- don't return cert
//	Use current CA Context
//	Don't build or return PKCS 7 or Full Response


HRESULT
PKCSCreateCertificate(
    IN ICertDBRow *prow,
    IN DWORD Disposition,
    IN BOOL fIncludeCRLs,
    OUT BOOL *pfErrorLogged,
    OPTIONAL OUT CACTX **ppCAContext,
    IN OUT CERTSRV_RESULT_CONTEXT *pResult)	// CoTaskMem*
{
    HRESULT hr;
    BYTE *pbCert = NULL;
    DWORD cbCert;
    BYTE *pbCertChain = NULL;
    DWORD cbCertChain;
    DWORD cCert;
    BOOL fCreated = FALSE;
    DWORD i;
    CACTX *pCAContext;
    CERT_CONTEXT const *pcc = NULL;

    if (NULL != ppCAContext)
    {
	*ppCAContext = NULL;
    }
    *pfErrorLogged = FALSE;
    CSASSERT(NULL == pResult->pctbCertChain || NULL == pResult->pctbCertChain->pb);
    CSASSERT(NULL == pResult->pctbFullResponse || NULL == pResult->pctbFullResponse->pb);

    if (NULL != pResult->pctbCert && NULL != pResult->pctbCert->pb)
    {
	pbCert = pResult->pctbCert->pb;
	cbCert = pResult->pctbCert->cb;

	pcc = CertCreateCertificateContext(X509_ASN_ENCODING, pbCert, cbCert);
	if (NULL == pcc)
	{
	    hr = myHLastError();
	    _JumpError(hr, error, "CertCreateCertificateContext");
	}
	pCAContext = NULL;
	if (DB_DISP_CA_CERT != Disposition &&
	    DB_DISP_CA_CERT_CHAIN != Disposition)
	{
	    hr = PKCSVerifyIssuedCertificate(pcc, &pCAContext);
	    _JumpIfError(hr, error, "PKCSVerifyIssuedCertificate");
	}
    }
    else
    {
	pCAContext = g_pCAContextCurrent;
	cbCert = 0;
	hr = pkcsEncodeSubjectCert(
			    prow,
			    pCAContext,
			    &pbCert,	// CoTaskMem*
			    &cbCert,
			    pfErrorLogged);
	_JumpIfError(hr, error, "pkcsEncodeSubjectCert");

	fCreated = TRUE;

	hr = prow->SetProperty(
		    g_wszPropRawCertificate,
		    PROPTYPE_BINARY | PROPCALLER_SERVER | PROPTABLE_CERTIFICATE,
		    cbCert,
		    pbCert);
	_JumpIfError(hr, error, "SetProperty");
    }

    if (NULL != pResult->pctbCertChain)
    {
	hr = pkcsEncodeCertChain(
			    pCAContext,
			    pbCert,		// pbCertLeaf
			    cbCert,		// cbCertLeaf
			    pbCert,		// pbToBeSigned
			    cbCert,		// cbToBeSigned
			    fIncludeCRLs,
			    &pbCertChain,	// CoTaskMem*
			    &cbCertChain);
	_JumpIfError(hr, error, "pkcsEncodeCertChain");
    }
    if (fCreated && NULL != pResult->pctbCert)
    {
	pResult->pctbCert->pb = pbCert;
	pResult->pctbCert->cb = cbCert;
	pbCert = NULL;
    }
    if (NULL != pResult->pctbCertChain)
    {
	pResult->pctbCertChain->pb = pbCertChain;
	pResult->pctbCertChain->cb = cbCertChain;
	pbCertChain = NULL;
    }
    if (NULL != ppCAContext)
    {
	*ppCAContext = pCAContext;
    }
    hr = S_OK;

error:
    if (NULL != pcc)
    {
	CertFreeCertificateContext(pcc);
    }
    if (fCreated && NULL != pbCert)
    {
	CoTaskMemFree(pbCert);
    }
    if (fCreated && NULL != pbCertChain)
    {
	CoTaskMemFree(pbCertChain);
    }
    CSASSERT(
	NULL == pResult->pctbCertChain ||
	((S_OK == hr) ^ (NULL == pResult->pctbCertChain->pb)));
    return(hr);
}


HRESULT
PKCSGetKRACert(
    IN DWORD iCert,
    OUT BYTE **ppbCert,
    OUT DWORD *pcbCert)
{
    HRESULT hr = S_OK;
    DWORD State;

    if (MAXDWORD == iCert)
    {
        iCert = g_iKRACerts;
    }
    if (iCert >= g_cKRACerts)
    {
        hr = E_INVALIDARG;
        _JumpError(hr, error, "bad CertIndex");
    }

    *pcbCert = g_rgKRACerts[iCert]->cbCertEncoded;
    *ppbCert = g_rgKRACerts[iCert]->pbCertEncoded;

error:
    return(hr);
}