src/security/cert/FSecCert_CertChain.cpp

   1 //
   2 // Copyright (c) 2012 Samsung Electronics Co., Ltd.
   3 //
   4 // Licensed under the Apache License, Version 2.0 (the License);
   5 // you may not use this file except in compliance with the License.
   6 // You may obtain a copy of the License at
   7 //
   8 //     http://www.apache.org/licenses/LICENSE-2.0
   9 //
  10 // Unless required by applicable law or agreed to in writing, software
  11 // distributed under the License is distributed on an "AS IS" BASIS,
  12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 // See the License for the specific language governing permissions and
  14 // limitations under the License.
  15 //
  16
  17 /**
  18  * @file                FSecCert_CertChain.cpp
  19  * @brief               This file contains implementation of X509 Certificate Chains.
  20 */
  21
  22 #include <stdio.h>
  23 #include <string.h>
  24 #include <stdlib.h>
  25 #include <error.h>
  26 #include <new>
  27 #include <sys/stat.h>
  28 #include <assert.h>
  29 #include <dirent.h>
  30 #include <openssl/x509.h>
  31 #include <openssl/x509_vfy.h>
  32 #include <FBaseSysLog.h>
  33 #include <FBaseByteBuffer.h>
  34 #include <FBaseResult.h>
  35 #include "FSecCert_CertChain.h"
  36 #include "FSecCert_CertDbManager.h"
  37
  38 namespace Tizen { namespace Security { namespace Cert
  39 {
  40
  41 _CertChain::_CertChain(void)
  42         : __pos(0)
  43         , __pPrivateKey(null)
  44         , __certFormat(_CERT_X509)
  45         , __rootCertType(_CERT_TYPE_NOT_BOUNDED)
  46         , __contextType(_CERT_CONTEXT_CERT)
  47         , __checkValidity(true)
  48 {
  49         __certChain.Construct();
  50 }
  51
  52 _CertChain::~_CertChain(void)
  53 {
  54         Clear();
  55 }
  56
  57 void
  58 _CertChain::Clear(void)
  59 {
  60         __certChain.RemoveAll(true);
  61 }
  62
  63 result
  64 _CertChain::AddCertificate(_CertFormat certFormat, char* pFileName)      //added pCert format
  65 {
  66         result r = E_SUCCESS;
  67
  68         SysTryReturnResult(NID_SEC_CERT, pFileName != null, E_INVALID_ARG, "Input file path is null.");
  69         SysTryReturnResult(NID_SEC_CERT, certFormat == _CERT_X509, E_INVALID_ARG, "Input cert format is not X509.");
  70
  71         std::unique_ptr< _X509Certificate > pCert(new (std::nothrow) _X509Certificate());
  72         SysTryReturnResult(NID_SEC_CERT, pCert != null, E_OUT_OF_MEMORY, "Failed to allocate memory.");
  73
  74         r = pCert->Parse(pFileName);
  75         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Parsing of certificate failed.", GetErrorMessage(r));
  76
  77         r = __certChain.Add(*pCert.release());
  78         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[r] Failed to add certificate in chain.", GetErrorMessage(r));
  79         __certFormat = certFormat;
  80
  81         return r;
  82 }
  83
  84 result
  85 _CertChain::AddCertificate(_CertFormat certFormat, byte* pBuf, int bufSize) //added certFormat
  86 {
  87         result r = E_SUCCESS;
  88
  89         SysTryReturnResult(NID_SEC_CERT, pBuf != null, E_INVALID_ARG, "Invalid input certificate buffer, input buffer must not be null.");
  90
  91         SysTryReturnResult(NID_SEC_CERT, certFormat == _CERT_X509, E_INVALID_ARG, "Input cert format is not X509.");
  92
  93         std::unique_ptr< _X509Certificate > pCert(new (std::nothrow) _X509Certificate());
  94         SysTryReturnResult(NID_SEC_CERT, pCert != null, E_OUT_OF_MEMORY, "Failed to allocate memory");
  95
  96         r = pCert->Parse(pBuf, bufSize);
  97         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Parsing of certificate failed.", GetErrorMessage(r));
  98
  99         r = __certChain.Add(*pCert.release());
 100         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[r] Failed to add certificatein chain.", GetErrorMessage(r));
 101
 102         __certFormat = certFormat;
 103
 104         return r;
 105 }
 106
 107 result
 108 _CertChain::AddCertificate(_X509Certificate* pCert)
 109 {
 110         result r = E_SUCCESS;
 111
 112         SysTryReturnResult(NID_SEC_CERT, pCert != null, E_INVALID_ARG, "Invalid input certificate buffer, input buffer must not be null.");
 113
 114         r = __certChain.Add(*pCert);
 115         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to add certificate in chain.", GetErrorMessage(r));
 116
 117         __certFormat = _CERT_X509;
 118
 119         return r;
 120 }
 121
 122 result
 123 _CertChain::AddPrivateKey(char* pPKeyPath)
 124 {
 125         SysTryReturnResult(NID_SEC_CERT, pPKeyPath != null, E_INVALID_ARG, "Input key buffer is null.");
 126
 127         __pPrivateKey.reset(null);
 128
 129         __pPrivateKey = std::unique_ptr< _CertPrivateKeyInfo >(new (std::nothrow) _CertPrivateKeyInfo(pPKeyPath));
 130         SysTryReturnResult(NID_SEC_CERT, __pPrivateKey != null, E_OUT_OF_MEMORY, "Failed to allocate memory.");
 131
 132         return E_SUCCESS;
 133 }
 134
 135 result
 136 _CertChain::AddPrivateKey(byte* pBuf, int bufSize)
 137 {
 138         SysTryReturnResult(NID_SEC_CERT, pBuf != null, E_INVALID_ARG, "Input parameters are not correct.");
 139         SysTryReturnResult(NID_SEC_CERT, bufSize > 0, E_INVALID_ARG, "Input buffer size must be greater than zero.");
 140
 141         __pPrivateKey.reset(null);
 142
 143         __pPrivateKey = std::unique_ptr< _CertPrivateKeyInfo >(new (std::nothrow) _CertPrivateKeyInfo(pBuf, bufSize));
 144         SysTryReturnResult(NID_SEC_CERT, __pPrivateKey != null, E_OUT_OF_MEMORY, "Failed to allocate memory.");
 145
 146         return E_SUCCESS;
 147 }
 148
 149 _CertPrivateKeyInfo*
 150 _CertChain::GetPrivateKey(void)
 151 {
 152         return __pPrivateKey.get();
 153 }
 154
 155 result
 156 _CertChain::MoveNext(void)
 157 {
 158         SysTryReturnResult(NID_SEC_CERT, __certChain.GetCount() > 0, E_SYSTEM, "No certificate is present in chain, failed to move to tail of certificate chain.");
 159         SysTryReturnResult(NID_SEC_CERT, __pos < (__certChain.GetCount() - 1), E_SYSTEM, "Position is at last certificate, failed to move to next certificate in chain.");
 160
 161         __pos++;
 162         return E_SUCCESS;
 163 }
 164
 165 result
 166 _CertChain::MovePrev(void)
 167 {
 168         SysTryReturnResult(NID_SEC_CERT, __pos > 0, E_SYSTEM, "Position is already at zero, failed to move to previous certificate in chain.");
 169         __pos--;
 170         return E_SUCCESS;
 171 }
 172
 173 result
 174 _CertChain::MoveHead(void)
 175 {
 176         __pos = 0;
 177         return E_SUCCESS;
 178 }
 179
 180 result
 181 _CertChain::MoveTail(void)
 182 {
 183         SysTryReturnResult(NID_SEC_CERT, __certChain.GetCount() > 0, E_SYSTEM, "No certificate is present in chain, failed to move to tail of certificate chain.");
 184         __pos = __certChain.GetCount() - 1;
 185
 186         return E_SUCCESS;
 187 }
 188
 189 _CertDomainType
 190 _CertChain::GetCertTypeByDomain(void)
 191 {
 192         _CertDomainType r;
 193
 194         switch (__rootCertType)
 195         {
 196         case _CERT_TYPE_SIM_ROOT_DOMAIN1:
 197         //fall through
 198         case _CERT_TYPE_ROOT_DOMAIN1:
 199         //fall through
 200         case _CERT_TYPE_DEV_ROOT_DOMAIN1:
 201                 r = _CERT_DOMAIN1_TRUSTED;
 202                 break;
 203
 204         case _CERT_TYPE_ROOT_DOMAIN2:
 205         //fall through
 206         case _CERT_TYPE_DEV_ROOT_DOMAIN2:
 207                 r = _CERT_DOMAIN2_TRUSTED;
 208                 break;
 209
 210         case _CERT_TYPE_ROOT_DOMAIN3:
 211         //fall through
 212         case _CERT_TYPE_SIM_ROOT_DOMAIN3:
 213         //fall through
 214         case _CERT_TYPE_DEV_ROOT_DOMAIN3:
 215                 r = _CERT_DOMAIN3_TRUSTED;
 216                 break;
 217
 218         case _CERT_TYPE_WRT:
 219                 r = _CERT_WRT_TRUSTED;
 220                 break;
 221
 222         default:
 223                 r = _CERT_INVALID_DOMAIN;
 224                 break;
 225         }
 226
 227         return r;
 228 }
 229
 230 _X509Certificate*
 231 _CertChain::GetCurrentCertificate(void)
 232 {
 233         SysTryReturn(NID_SEC_CERT, __certChain.GetCount() > 0, null, E_SYSTEM, "[E_SYSTEM] There is no certifcate present in chain.");
 234         SysTryReturn(NID_SEC_CERT, __pos >= 0, null, E_SYSTEM, "[E_SYSTEM] Failed to get certificate object from chain.");
 235         return reinterpret_cast< _X509Certificate* >(__certChain.GetAt(__pos));
 236 }
 237
 238
 239 result
 240 _CertChain::Verify(void)
 241 {
 242         result r = E_SUCCESS;
 243         const unsigned char* pCertContent = null;
 244         int certSize = 0;
 245         int certCount = __certChain.GetCount();
 246         STACK_OF(X509)* pTrustedChain = null;
 247         STACK_OF(X509)* pInterimChain = null;
 248         X509_STORE_CTX* pStoreCtx = NULL;
 249         byte* pCertBuffer = null;
 250         _X509Certificate* pCert = null;
 251         X509** ppInterimCerts = null;
 252         X509* pX509UserCert = null;
 253
 254         SysTryReturnResult(NID_SEC_CERT, certCount > 0, E_SYSTEM, "No certificates are present in certificate chain.");
 255         SysTryReturnResult(NID_SEC_CERT, __certFormat == _CERT_X509, E_SYSTEM, "Certificate chain is not of type X509.");
 256
 257         pCert = reinterpret_cast< _X509Certificate* >(__certChain.GetAt(0));
 258         SysTryReturnResult(NID_SEC_CERT, pCert != null, E_SYSTEM, "Failed to get first certificate in chain.");
 259
 260         certCount--; //user certificate is added.
 261
 262         if (certCount == 0) //only root cert to verify
 263         {
 264                 SysTryReturnResult(NID_SEC_CERT, pCert->IsSelfSigned(), E_DATA_NOT_FOUND, "Failed to get root certificate in chain.");
 265                 return pCert->VerifySignature(null, 0);
 266         }
 267
 268         pCert->GetCertBuffer(pCertBuffer, certSize);
 269         SysTryReturnResult(NID_SEC_CERT, pCertBuffer != null, E_SYSTEM, "Failed to get encoded buffer of first certificate.");
 270
 271         pCertContent = const_cast< const unsigned char* >(pCertBuffer);
 272
 273         d2i_X509(&pX509UserCert, &pCertContent, certSize);
 274         SysTryReturnResult(NID_SEC_CERT, pX509UserCert != null, E_SYSTEM, "Failed to parse user certificate.");
 275
 276         pTrustedChain = sk_X509_new_null();
 277         SysTryCatch(NID_SEC_CERT, pTrustedChain != null, r = E_OUT_OF_MEMORY, E_OUT_OF_MEMORY, "[E_OUT_OF_MEMORY]Failed to allocate trusted root ca certificate chain.");
 278
 279         pInterimChain = sk_X509_new_null();
 280         SysTryCatch(NID_SEC_CERT, pInterimChain != null, r = E_OUT_OF_MEMORY, E_OUT_OF_MEMORY, "[E_OUT_OF_MEMORY]Failed to allocate intermediate ca certificate chain.");
 281
 282         ppInterimCerts = (X509**) new X509*[certCount];
 283         memset(ppInterimCerts, 0, (sizeof(X509*) * certCount));
 284
 285         for (int i = 0; i < certCount; i++)
 286         {
 287                 certSize = 0;
 288                 pCertContent = null;
 289                 pCertBuffer = null;
 290
 291                 pCert = reinterpret_cast< _X509Certificate* >(__certChain.GetAt(i + 1));
 292                 SysTryCatch(NID_SEC_CERT, pCert != null, r = E_SYSTEM, E_SYSTEM, "[E_SYSTEM] Failed to get certificate at index (%d).", i + 1);
 293
 294                 pCert->GetCertBuffer(pCertBuffer, certSize);
 295                 SysTryCatch(NID_SEC_CERT, pCertBuffer != null, r = E_SYSTEM, E_SYSTEM, "[E_SYSTEM] Failed to get buffer of certificate at index (%d).", i + 1);
 296
 297                 pCertContent = const_cast< const unsigned char* >(pCertBuffer);
 298
 299                 d2i_X509(&ppInterimCerts[i], &pCertContent, certSize);
 300                 SysTryCatch(NID_SEC_CERT, ppInterimCerts[i] != null, r = E_SYSTEM, E_SYSTEM, "[E_SYSTEM] Failed to parse certificate at index (%d).", i + 1);
 301
 302                 if (pCert->IsSelfSigned())
 303                 {
 304                         /* verify */
 305                         // insert root certificate into trusted chain
 306                         if (!(sk_X509_push(pTrustedChain, ppInterimCerts[i])))
 307                         {
 308                                 SysLog(NID_SEC_CERT, "Fail to push root ca certificate into openssl stack.");
 309                                 r = E_SYSTEM;
 310                                 goto CATCH;
 311                         }
 312                 }
 313                 else
 314                 {
 315                         if (!(sk_X509_push(pInterimChain, ppInterimCerts[i])))
 316                         {
 317                                 SysLog(NID_SEC_CERT, "Fail to push intermediate ca certificate into openssl stack.");
 318                                 r = E_SYSTEM;
 319                                 goto CATCH;
 320                         }
 321
 322                 }
 323         }
 324
 325         SysTryCatch(NID_SEC_CERT, sk_X509_num(pTrustedChain) > 0, r = E_DATA_NOT_FOUND, E_DATA_NOT_FOUND, "[E_DATA_NOT_FOUND] Failed to get root certificate in chain.");
 326
 327         // initialize store and store context
 328         pStoreCtx = X509_STORE_CTX_new();
 329
 330         // construct store context
 331         if (!X509_STORE_CTX_init(pStoreCtx, 0, pX509UserCert, pInterimChain))
 332         {
 333                 SysLog(NID_SEC_CERT, "Fail to initialize X509 store context.");
 334                 r = E_SYSTEM;
 335                 goto CATCH;
 336         }
 337
 338         X509_STORE_CTX_trusted_stack(pStoreCtx, pTrustedChain);
 339
 340         // verify
 341         if (X509_verify_cert(pStoreCtx) != 1)
 342         {
 343                 SysLog(NID_SEC_CERT, "Fail to verify certificate chain.");
 344                 switch (X509_STORE_CTX_get_error(pStoreCtx))
 345                 {
 346                 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
 347                         r = E_DATA_NOT_FOUND;
 348                         break;
 349
 350                 case X509_V_ERR_CERT_HAS_EXPIRED:
 351                 //fall though
 352                 case X509_V_ERR_CERT_NOT_YET_VALID:
 353                         r = E_INVALID_CERTIFICATE;
 354                         break;
 355
 356                 case X509_V_ERR_CERT_SIGNATURE_FAILURE:
 357                         r = E_CERTIFICATE_VERIFICATION_FAILED;
 358                         break;
 359
 360                 default:
 361                         r = E_SYSTEM;
 362                         break;
 363                 }
 364                 SysLog(NID_SEC_CERT, "error number = %d", X509_STORE_CTX_get_error(pStoreCtx));
 365                 goto CATCH;
 366
 367         }
 368
 369 CATCH:
 370
 371         if (ppInterimCerts != null)
 372         {
 373                 for (int i = 0; i < certCount; i++)
 374                 {
 375                         if (ppInterimCerts[i] != null)
 376                         {
 377                                 X509_free(ppInterimCerts[i]);
 378                         }
 379                 }
 380
 381                 delete[] ppInterimCerts;
 382         }
 383
 384         if (pX509UserCert != null)
 385         {
 386                 X509_free(pX509UserCert);
 387         }
 388
 389         if (pStoreCtx != null)
 390         {
 391                 X509_STORE_CTX_free(pStoreCtx);
 392         }
 393
 394         if (pTrustedChain != null)
 395         {
 396                 sk_X509_free(pTrustedChain);
 397         }
 398
 399         if (pInterimChain != null)
 400         {
 401                 sk_X509_free(pInterimChain);
 402         }
 403         return r;
 404 }
 405
 406
 407 result
 408 _CertChain::VerifyUsingOpenSsl(void)
 409 {
 410         result r = E_SUCCESS;
 411         int keyLen = 0;
 412         int count = 0;
 413
 414         r = MoveTail();
 415         SysTryReturnResult(NID_SEC_CERT, !IsFailed(r), E_SYSTEM, "No certificate is present in certificate chain, failed to validate certificate chain.");
 416
 417         if (__certFormat == _CERT_X509)
 418         {
 419                 _X509Certificate* pCert = null;
 420                 _X509Certificate* pPrevCert = null;
 421                 _X509TbsCert* pTbsCert = null;
 422                 _X509TbsCert* pPrevTbsCert = null;
 423
 424                 do
 425                 {
 426                         pPrevCert = GetCurrentCertificate();
 427                         SysTryReturnResult(NID_SEC_CERT, pPrevCert != null, E_SYSTEM, "Failed to get root certificate from chain, broken certificate chain.");
 428
 429                         if (pPrevCert->IsSelfSigned())
 430                         {
 431                                 // rootCA self verify
 432                                 if (__checkValidity)
 433                                 {
 434                                         pPrevTbsCert = pPrevCert->GetTbsCertInstance();
 435                                         SysTryReturnResult(NID_SEC_CERT, pPrevTbsCert != null, E_SYSTEM, "Failed to get root certificate to be signed instance.");
 436
 437                                         r = pPrevTbsCert->GetValidity();
 438                                         SysTryReturnResult(NID_SEC_CERT, !IsFailed(r), E_INVALID_CERTIFICATE, "Root certificate validation failed (subject name: %s).", pPrevTbsCert->GetSubjectName());
 439                                 }
 440
 441                                 r = pPrevCert->VerifySignature(null, 0);
 442                                 SysTryReturnResult(NID_SEC_CERT, !IsFailed(r), E_CERTIFICATE_VERIFICATION_FAILED, "Root certificate signature verification failed (subject name: %s).", pPrevTbsCert->GetSubjectName());
 443                         }
 444                         else
 445                         {
 446                                 if (MoveNext() == E_SUCCESS)
 447                                 {
 448                                         pPrevCert = GetCurrentCertificate();
 449                                 }
 450                                 count++;
 451                                 break;
 452                         }
 453                 }
 454                 while (MovePrev() == E_SUCCESS);
 455
 456                 while (MovePrev() == E_SUCCESS)
 457                 {
 458                         byte* pKey = null;
 459                         count++;
 460
 461                         pCert = GetCurrentCertificate();
 462                         SysTryReturnResult(NID_SEC_CERT, pCert != null, E_SYSTEM, "Failed to get certificate from chain, broken certificate chain.");
 463
 464                         pPrevTbsCert = pPrevCert->GetTbsCertInstance();
 465                         SysTryReturnResult(NID_SEC_CERT, pPrevTbsCert != null, E_SYSTEM, "Failed to get certificate to be signed instance.");
 466
 467                         pTbsCert = pCert->GetTbsCertInstance();
 468                         SysTryReturnResult(NID_SEC_CERT, pTbsCert != null, E_SYSTEM, "Failed to get certificate to be signed instance.");
 469
 470                         if (__checkValidity)
 471                         {
 472                                 r = pPrevTbsCert->GetValidity();
 473                                 SysTryReturnResult(NID_SEC_CERT, !IsFailed(r), E_INVALID_CERTIFICATE, "Certificate validation failed (subject name: %s).", pPrevTbsCert->GetSubjectName());
 474                         }
 475
 476
 477                         SysTryReturnResult(NID_SEC_CERT, pCert->IsIssuer(pPrevCert), E_SYSTEM, "Certificate is not in sorted order or parent certificate is missing in chain, certificate chain is broken (subject name: %s).", pPrevTbsCert->GetSubjectName());
 478
 479                         r = pPrevTbsCert->GetPublicKeyInfoN(keyLen, &pKey);
 480                         SysTryReturnResult(NID_SEC_CERT, pKey != null, E_SYSTEM, "Failed to public key from certificate (subject name: %s).", pPrevTbsCert->GetSubjectName());
 481
 482                         std::unique_ptr< byte[] > pKeyAuto(pKey);
 483
 484                         r = pCert->VerifySignature(pKey, keyLen);
 485
 486                         SysTryReturnResult(NID_SEC_CERT, !IsFailed(r), E_CERTIFICATE_VERIFICATION_FAILED, "Certificate signature verification failed (subject name: %s).", pTbsCert->GetSubjectName());
 487
 488                         pPrevCert = pCert;
 489                 }
 490         }
 491
 492         return E_SUCCESS;
 493 }
 494
 495 result
 496 _CertChain::VerifyCertChainWithDb(void)
 497 {
 498         result r = E_SUCCESS;
 499         _CertDbManager* pCertDb = null;
 500         byte* pCert = null;
 501         int certLen = 0;
 502         _CaCertType certType = _CERT_TYPE_NOT_BOUNDED;
 503
 504         r = MoveTail();
 505         SysTryReturnResult(NID_SEC_CERT, !IsFailed(r), E_SYSTEM, "No certificate is present in certificate chain, failed to validate certificate chain.");
 506
 507         pCertDb = _CertDbManager::GetInstance();
 508         SysTryReturnResult(NID_SEC_CERT, pCertDb != null, E_SYSTEM, "Failed to get instance of certificate database manager.");
 509
 510         if (__certFormat == _CERT_X509)
 511         {
 512                 _X509Certificate* pLastCert = null;
 513                 _X509TbsCert* pTbsCert = null;
 514                 pLastCert = GetCurrentCertificate();
 515                 SysTryReturnResult(NID_SEC_CERT, pLastCert != null, E_SYSTEM, "Failed to get certificate to be signed instance.");
 516
 517                 if (pLastCert->IsSelfSigned())
 518                 {
 519                         pCertDb = _CertDbManager::GetInstance();
 520                         SysTryReturnResult(NID_SEC_CERT, pCertDb != null, E_SYSTEM, "Failed to get instance of certificate database manager.");
 521
 522                         pTbsCert = pLastCert->GetTbsCertInstance();
 523                         SysTryReturnResult(NID_SEC_CERT, pTbsCert != null, E_SYSTEM, "Failed to get root certificate to be signed instance.");
 524
 525                         if (GetContextType() == _CERT_CONTEXT_SSL)
 526                         {
 527                                 certType = _CERT_TYPE_ROOT_CA;
 528                                 __checkValidity = true;
 529
 530                                 if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 531                                 {
 532                                         certType = _CERT_TYPE_ROOT_CA_BY_USER;
 533                                         __checkValidity = true;
 534
 535                                         r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 536                                         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetSubjectName());
 537                                 }
 538                         }
 539                         else if (GetContextType() == _CERT_CONTEXT_MIDP || GetContextType() == _CERT_CONTEXT_DOMAIN || GetContextType() == _CERT_CONTEXT_DOMAIN_NO_VALIDITY)
 540                         {
 541                                 if (GetContextType() == _CERT_CONTEXT_DOMAIN_NO_VALIDITY)
 542                                 {
 543                                         __checkValidity = false;
 544                                 }
 545                                 else
 546                                 {
 547                                         __checkValidity = true;
 548                                 }
 549
 550                                 certType = _CERT_TYPE_ROOT_DOMAIN1;
 551                                 if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 552                                 {
 553                                         certType = _CERT_TYPE_ROOT_DOMAIN2;
 554                                         if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 555                                         {
 556                                                 certType = _CERT_TYPE_ROOT_DOMAIN3;
 557                                                 if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 558                                                 {
 559                                                         certType = _CERT_TYPE_DEV_ROOT_DOMAIN1;
 560                                                         if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 561                                                         {
 562                                                                 certType = _CERT_TYPE_DEV_ROOT_DOMAIN3;
 563                                                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 564                                                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetSubjectName());
 565                                                         }
 566                                                 }
 567                                         }
 568                                 }
 569                         }
 570                         else if (GetContextType() == _CERT_CONTEXT_CERT || GetContextType() == _CERT_CONTEXT_CERT_NO_VALIDITY)
 571                         {
 572                                 if (GetContextType() == _CERT_CONTEXT_CERT)
 573                                 {
 574                                         __checkValidity = true;
 575                                 }
 576                                 else if (GetContextType() == _CERT_CONTEXT_CERT_NO_VALIDITY)
 577                                 {
 578                                         __checkValidity = false;
 579                                 }
 580
 581                                 certType = _CERT_TYPE_TRUSTED_CA;
 582                         }
 583                         else if (GetContextType() == _CERT_CONTEXT_OSP_USER || GetContextType() == _CERT_CONTEXT_OSP_USER_NO_VALIDITY)
 584                         {
 585                                 if (GetContextType() == _CERT_CONTEXT_OSP_USER)
 586                                 {
 587                                         __checkValidity = true;
 588                                 }
 589                                 else if (GetContextType() == _CERT_CONTEXT_OSP_USER_NO_VALIDITY)
 590                                 {
 591                                         __checkValidity = false;
 592                                 }
 593
 594                                 certType = _CERT_TYPE_ROOT_CA_BY_USER;
 595
 596                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 597                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 598                         }
 599                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1_NO_VALIDITY)
 600                         {
 601                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1)
 602                                 {
 603                                         __checkValidity = true;
 604                                 }
 605                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1_NO_VALIDITY)
 606                                 {
 607                                         __checkValidity = false;
 608                                 }
 609
 610                                 certType = _CERT_TYPE_OSP_CRITICAL1;
 611
 612                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 613                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 614                         }
 615                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2_NO_VALIDITY)
 616                         {
 617                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2)
 618                                 {
 619                                         __checkValidity = true;
 620                                 }
 621                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2_NO_VALIDITY)
 622                                 {
 623                                         __checkValidity = false;
 624                                 }
 625
 626                                 certType = _CERT_TYPE_OSP_CRITICAL2;
 627                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 628                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 629                         }
 630                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3_NO_VALIDITY)
 631                         {
 632                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3)
 633                                 {
 634                                         __checkValidity = true;
 635                                 }
 636                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3_NO_VALIDITY)
 637                                 {
 638                                         __checkValidity = false;
 639                                 }
 640                                 certType = _CERT_TYPE_OSP_CRITICAL3;
 641
 642                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 643                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 644                         }
 645                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4_NO_VALIDITY)
 646                         {
 647                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4)
 648                                 {
 649                                         __checkValidity = true;
 650                                 }
 651                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4_NO_VALIDITY)
 652                                 {
 653                                         __checkValidity = false;
 654                                 }
 655                                 certType = _CERT_TYPE_OSP_CRITICAL4;
 656
 657                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 658                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 659                         }
 660                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5_NO_VALIDITY)
 661                         {
 662                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5)
 663                                 {
 664                                         __checkValidity = true;
 665                                 }
 666                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5_NO_VALIDITY)
 667                                 {
 668                                         __checkValidity = false;
 669                                 }
 670                                 certType = _CERT_TYPE_OSP_CRITICAL5;
 671
 672                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 673                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 674                         }
 675                         else if (GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP || GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP_NO_VALIDITY)
 676                         {
 677                                 if (GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP)
 678                                 {
 679                                         __checkValidity = true;
 680                                 }
 681                                 else if (GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP_NO_VALIDITY)
 682                                 {
 683                                         __checkValidity = false;
 684                                 }
 685                                 certType = _CERT_TYPE_OSP_PRELOAD_APP;
 686
 687                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 688                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 689                         }
 690                         else if (GetContextType() == _CERT_CONTEXT_WRT)
 691                         {
 692                                 __checkValidity = true;
 693                                 certType = _CERT_TYPE_WRT;
 694
 695                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 696                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 697                         }
 698                         else if (GetContextType() == _CERT_CONTEXT_TK)
 699                         {
 700                                 certType = _CERT_TYPE_ROOT_DOMAIN2;
 701                                 __checkValidity = true;
 702                                 if (!strcmp(_CERT_TK_ISSUER_NAME, reinterpret_cast< const char* >(pTbsCert->GetIssuerName())))
 703                                 {
 704                                         r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 705                                         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 706                                 }
 707                                 else
 708                                 {
 709                                         //if the issuerName of this certificate is not _CERT_TK_ISSUER_NAME then we should return some error
 710                                         SysTryReturnResult(NID_SEC_CERT, false, E_INACCESSIBLE_PATH, "Failed to access specified Path.");
 711                                 }
 712                         }
 713                         else
 714                         {
 715                                 SysTryReturnResult(NID_SEC_CERT, false, E_SYSTEM, "Invalid context type.");
 716                         }
 717                         if (!IsFailed(r))
 718                         {
 719                                 //Set the format of root certificate
 720                                 __rootCertType = certType;
 721                         }
 722
 723                         delete[] pCert;
 724                         return Verify();
 725                 }
 726                 else
 727                 {
 728                         //Otherwise extract root certificate from Db and add in tail and then verify.
 729                         pTbsCert = pLastCert->GetTbsCertInstance();
 730                         SysTryReturnResult(NID_SEC_CERT, pTbsCert != null, E_SYSTEM, "Failed to get to be signed object from cerificate.");
 731
 732
 733                         //If the conetxt type is SSL then root certiifcate should be searched in DefaultROOCACert directory.
 734                         //It should not search in any other directory
 735                         //Similarily, if context type is MIDP then root certificate should be searched in Domain1, Domain2 & Domain3 directory.
 736                         //If not found report error.
 737                         if (GetContextType() == _CERT_CONTEXT_SSL)
 738                         {
 739                                 certType = _CERT_TYPE_ROOT_CA;
 740                                 __checkValidity = true;
 741                                 if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 742                                 {
 743                                         certType = _CERT_TYPE_ROOT_CA_BY_USER;
 744                                         __checkValidity = true;
 745
 746                                         r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 747                                         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 748                                 }
 749                         }
 750                         else if (GetContextType() == _CERT_CONTEXT_MIDP || GetContextType() == _CERT_CONTEXT_DOMAIN || GetContextType() == _CERT_CONTEXT_DOMAIN_NO_VALIDITY)
 751                         {
 752                                 if (GetContextType() == _CERT_CONTEXT_DOMAIN_NO_VALIDITY)
 753                                 {
 754                                         __checkValidity = false;
 755                                 }
 756                                 else
 757                                 {
 758                                         __checkValidity = true;
 759                                 }
 760                                 certType = _CERT_TYPE_ROOT_DOMAIN1;
 761                                 if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 762                                 {
 763                                         certType = _CERT_TYPE_ROOT_DOMAIN2;
 764                                         if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 765                                         {
 766                                                 certType = _CERT_TYPE_ROOT_DOMAIN3;
 767                                                 if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 768                                                 {
 769                                                         certType = _CERT_TYPE_DEV_ROOT_DOMAIN1;
 770                                                         if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 771                                                         {
 772                                                                 certType = _CERT_TYPE_DEV_ROOT_DOMAIN3;
 773
 774                                                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 775                                                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 776                                                         }
 777                                                 }
 778                                         }
 779                                 }
 780                         }
 781                         else if (GetContextType() == _CERT_CONTEXT_CERT || GetContextType() == _CERT_CONTEXT_CERT_NO_VALIDITY)
 782                         {
 783                                 if (GetContextType() == _CERT_CONTEXT_CERT)
 784                                 {
 785                                         __checkValidity = true;
 786                                 }
 787                                 else if (GetContextType() == _CERT_CONTEXT_CERT_NO_VALIDITY)
 788                                 {
 789                                         __checkValidity = false;
 790                                 }
 791
 792                                 r = pCertDb->FindIssuerCertificateAndTypeN(_CERT_X509, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen, certType);
 793                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 794                         }
 795                         else if (GetContextType() == _CERT_CONTEXT_OSP_USER || GetContextType() == _CERT_CONTEXT_OSP_USER_NO_VALIDITY)
 796                         {
 797                                 if (GetContextType() == _CERT_CONTEXT_OSP_USER)
 798                                 {
 799                                         __checkValidity = true;
 800                                 }
 801                                 else if (GetContextType() == _CERT_CONTEXT_OSP_USER_NO_VALIDITY)
 802                                 {
 803                                         __checkValidity = false;
 804                                 }
 805                                 certType = _CERT_TYPE_ROOT_CA_BY_USER;
 806
 807                                 r = (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen));
 808                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 809                         }
 810                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1_NO_VALIDITY)
 811                         {
 812                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1)
 813                                 {
 814                                         __checkValidity = true;
 815                                 }
 816                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1_NO_VALIDITY)
 817                                 {
 818                                         __checkValidity = false;
 819                                 }
 820                                 certType = _CERT_TYPE_OSP_CRITICAL1;
 821
 822                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 823                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 824                         }
 825                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2_NO_VALIDITY)
 826                         {
 827                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2)
 828                                 {
 829                                         __checkValidity = true;
 830                                 }
 831                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2_NO_VALIDITY)
 832                                 {
 833                                         __checkValidity = false;
 834                                 }
 835                                 certType = _CERT_TYPE_OSP_CRITICAL2;
 836
 837                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 838                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 839                         }
 840                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3_NO_VALIDITY)
 841                         {
 842                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3)
 843                                 {
 844                                         __checkValidity = true;
 845                                 }
 846                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3_NO_VALIDITY)
 847                                 {
 848                                         __checkValidity = false;
 849                                 }
 850                                 certType = _CERT_TYPE_OSP_CRITICAL3;
 851
 852                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 853                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 854                         }
 855                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4_NO_VALIDITY)
 856                         {
 857                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4)
 858                                 {
 859                                         __checkValidity = true;
 860                                 }
 861                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4_NO_VALIDITY)
 862                                 {
 863                                         __checkValidity = false;
 864                                 }
 865                                 certType = _CERT_TYPE_OSP_CRITICAL4;
 866
 867                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 868                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 869                         }
 870                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5_NO_VALIDITY)
 871                         {
 872                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5)
 873                                 {
 874                                         __checkValidity = true;
 875                                 }
 876                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5_NO_VALIDITY)
 877                                 {
 878                                         __checkValidity = false;
 879                                 }
 880                                 certType = _CERT_TYPE_OSP_CRITICAL5;
 881
 882                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 883                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 884                         }
 885                         else if (GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP || GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP_NO_VALIDITY)
 886                         {
 887                                 if (GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP)
 888                                 {
 889                                         __checkValidity = true;
 890                                 }
 891                                 else if (GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP_NO_VALIDITY)
 892                                 {
 893                                         __checkValidity = false;
 894                                 }
 895                                 certType = _CERT_TYPE_OSP_PRELOAD_APP;
 896
 897                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 898                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 899                         }
 900                         else if (GetContextType() == _CERT_CONTEXT_WRT)
 901                         {
 902                                 __checkValidity = true;
 903                                 certType = _CERT_TYPE_WRT;
 904
 905                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 906                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 907                         }
 908                         else if (GetContextType() == _CERT_CONTEXT_TK)
 909                         {
 910                                 certType = _CERT_TYPE_ROOT_DOMAIN2;
 911                                 __checkValidity = true;
 912
 913                                 if (!strcmp(_CERT_TK_ISSUER_NAME, reinterpret_cast< const char* >(pTbsCert->GetIssuerName())))
 914                                 {
 915                                         r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 916                                         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 917                                 }
 918                                 else
 919                                 {
 920                                         SysTryReturnResult(NID_SEC_CERT, false, E_INACCESSIBLE_PATH, "Failed to access specified certificate path.");
 921                                 }
 922                         }
 923                         else
 924                         {
 925                                 SysTryReturnResult(NID_SEC_CERT, false, E_SYSTEM, "Invalid context type.");
 926                         }
 927
 928                         if (pCert != null)
 929                         {
 930                                 std::unique_ptr< byte[] > pCertAuto(pCert);
 931
 932                                 //Add newly found root certificate in chain for verification.
 933                                 r = AddCertificate(__certFormat, reinterpret_cast< byte* >(pCert), certLen);
 934
 935                                 SysTryReturnResult(NID_SEC_CERT, !IsFailed(r), E_SYSTEM, "Failed to add parent certificate in chain.");
 936                                 //Verify certificate chain and return result to application
 937                                 r = Verify();
 938                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s]Failed to verify certificate chain.", GetErrorMessage(r));
 939                         }
 940                         else
 941                         {
 942                                 SysTryReturnResult(NID_SEC_CERT, false, E_DATA_NOT_FOUND, "Parent certificate not found in certificate database.");
 943                         }
 944
 945                         if (!IsFailed(r))
 946                         {
 947                                 //Set the format of root certificate
 948                                 __rootCertType = certType;
 949                         }
 950                 }
 951         }
 952
 953         return r;
 954 }
 955
 956 int
 957 _CertChain::GetCount(void)
 958 {
 959         return __certChain.GetCount();
 960 }
 961
 962 void
 963 _CertChain::SetContextType(_CertContextType type)
 964 {
 965         __contextType = type;
 966 }
 967
 968 _CertContextType
 969 _CertChain::GetContextType(void)
 970 {
 971         return __contextType;
 972 }
 973
 974 _CertFormat
 975 _CertChain::GetCertFormat(void)
 976 {
 977         return __certFormat;
 978 }
 979
 980 void
 981 _CertChain::RemoveHead(bool freeFlag)
 982 {
 983         __certChain.RemoveAt(0, freeFlag);
 984 }
 985
 986 void
 987 _CertChain::RemoveTail(bool freeFlag)
 988 {
 989         if (__certChain.GetCount() > 0)
 990         {
 991                 __certChain.RemoveAt(__certChain.GetCount() - 1, freeFlag);
 992         }
 993 }
 994
 995 } } } //Tizen::Security::Cert