src/security/cert/FSecCert_CertChain.cpp

   1 //
   2 // Open Service Platform
   3 // Copyright (c) 2012 Samsung Electronics Co., Ltd.
   4 //
   5 // Licensed under the Apache License, Version 2.0 (the License);
   6 // you may not use this file except in compliance with the License.
   7 // You may obtain a copy of the License at
   8 //
   9 //     http://www.apache.org/licenses/LICENSE-2.0
  10 //
  11 // Unless required by applicable law or agreed to in writing, software
  12 // distributed under the License is distributed on an "AS IS" BASIS,
  13 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14 // See the License for the specific language governing permissions and
  15 // limitations under the License.
  16 //
  17
  18 /**
  19  * @file                FSecCert_CertChain.cpp
  20  * @brief               This file contains implementation of X509 Certificate Chains.
  21 */
  22
  23 #include <stdio.h>
  24 #include <string.h>
  25 #include <stdlib.h>
  26 #include <error.h>
  27 #include <new>
  28 #include <sys/stat.h>
  29 #include <assert.h>
  30 #include <dirent.h>
  31 #include <openssl/x509.h>
  32 #include <openssl/x509_vfy.h>
  33 #include <FBaseSysLog.h>
  34 #include <FBaseByteBuffer.h>
  35 #include <FBaseResult.h>
  36 #include "FSecCert_CertChain.h"
  37 #include "FSecCert_CertDbManager.h"
  38
  39 namespace Tizen { namespace Security { namespace Cert
  40 {
  41
  42 _CertChain::_CertChain(void)
  43         : __pos(0)
  44         , __pPrivateKey(null)
  45         , __certFormat(_CERT_X509)
  46         , __rootCertType(_CERT_TYPE_NOT_BOUNDED)
  47         , __contextType(_CERT_CONTEXT_CERT)
  48         , __checkValidity(true)
  49 {
  50         __certChain.Construct();
  51 }
  52
  53 _CertChain::~_CertChain(void)
  54 {
  55         Clear();
  56 }
  57
  58 void
  59 _CertChain::Clear(void)
  60 {
  61         __certChain.RemoveAll(true);
  62 }
  63
  64 result
  65 _CertChain::AddCertificate(_CertFormat certFormat, char* pFileName)      //added pCert format
  66 {
  67         result r = E_SUCCESS;
  68
  69         SysTryReturnResult(NID_SEC_CERT, pFileName != null, E_INVALID_ARG, "Input file path is null.");
  70         SysTryReturnResult(NID_SEC_CERT, certFormat == _CERT_X509, E_INVALID_ARG, "Input cert format is not X509.");
  71
  72         std::unique_ptr<_X509Certificate> pCert(new (std::nothrow) _X509Certificate());
  73         SysTryReturnResult(NID_SEC_CERT, pCert != null, E_OUT_OF_MEMORY, "Failed to allocate memory.");
  74
  75         r = pCert->Parse(pFileName);
  76         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Parsing of certificate failed.", GetErrorMessage(r));
  77
  78         r = __certChain.Add(*pCert.release());
  79         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[r] Failed to add certificate in chain.", GetErrorMessage(r));
  80         __certFormat = certFormat;
  81
  82         return r;
  83 }
  84
  85 result
  86 _CertChain::AddCertificate(_CertFormat certFormat, byte* pBuf, int bufSize) //added certFormat
  87 {
  88         result r = E_SUCCESS;
  89
  90         SysTryReturnResult(NID_SEC_CERT, pBuf != null, E_INVALID_ARG, "Invalid input certificate buffer, input buffer must not be null.");
  91
  92         SysTryReturnResult(NID_SEC_CERT, certFormat == _CERT_X509, E_INVALID_ARG, "Input cert format is not X509.");
  93
  94         std::unique_ptr<_X509Certificate> pCert(new (std::nothrow) _X509Certificate());
  95         SysTryReturnResult(NID_SEC_CERT, pCert != null, E_OUT_OF_MEMORY, "Failed to allocate memory");
  96
  97         r = pCert->Parse(pBuf, bufSize);
  98         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Parsing of certificate failed.", GetErrorMessage(r));
  99
 100         r = __certChain.Add(*pCert.release());
 101         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[r] Failed to add certificatein chain.", GetErrorMessage(r));
 102
 103         __certFormat = certFormat;
 104
 105         return r;
 106 }
 107
 108 result
 109 _CertChain::AddCertificate(_X509Certificate* pCert)
 110 {
 111         result r = E_SUCCESS;
 112
 113         SysTryReturnResult(NID_SEC_CERT, pCert != null, E_INVALID_ARG, "Invalid input certificate buffer, input buffer must not be null.");
 114
 115         r = __certChain.Add(*pCert);
 116         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to add certificate in chain.", GetErrorMessage(r));
 117
 118         __certFormat = _CERT_X509;
 119
 120         return r;
 121 }
 122
 123 result
 124 _CertChain::AddPrivateKey(char* pPKeyPath)
 125 {
 126         SysTryReturnResult(NID_SEC_CERT, pPKeyPath != null, E_INVALID_ARG, "Input key buffer is null.");
 127
 128         __pPrivateKey.reset(null);
 129
 130         __pPrivateKey = std::unique_ptr<_CertPrivateKeyInfo> (new (std::nothrow) _CertPrivateKeyInfo(pPKeyPath));
 131         SysTryReturnResult(NID_SEC_CERT, __pPrivateKey != null, E_OUT_OF_MEMORY, "Failed to allocate memory.");
 132
 133         return E_SUCCESS;
 134 }
 135
 136 result
 137 _CertChain::AddPrivateKey(byte* pBuf, int bufSize)
 138 {
 139         SysTryReturnResult(NID_SEC_CERT, pBuf != null, E_INVALID_ARG, "Input parameters are not correct.");
 140         SysTryReturnResult(NID_SEC_CERT, bufSize > 0, E_INVALID_ARG, "Input buffer size must be greater than zero.");
 141
 142         __pPrivateKey.reset(null);
 143
 144         __pPrivateKey = std::unique_ptr<_CertPrivateKeyInfo>(new (std::nothrow) _CertPrivateKeyInfo(pBuf, bufSize));
 145         SysTryReturnResult(NID_SEC_CERT, __pPrivateKey != null, E_OUT_OF_MEMORY, "Failed to allocate memory.");
 146
 147         return E_SUCCESS;
 148 }
 149
 150 _CertPrivateKeyInfo*
 151 _CertChain::GetPrivateKey(void)
 152 {
 153         return __pPrivateKey.get();
 154 }
 155
 156 result
 157 _CertChain::MoveNext(void)
 158 {
 159         SysTryReturnResult(NID_SEC_CERT, __certChain.GetCount() > 0, E_SYSTEM, "No certificate is present in chain, failed to move to tail of certificate chain.");
 160         SysTryReturnResult(NID_SEC_CERT, __pos < (__certChain.GetCount() - 1), E_SYSTEM, "Position is at last certificate, failed to move to next certificate in chain.");
 161
 162         __pos++;
 163         return E_SUCCESS;
 164 }
 165
 166 result
 167 _CertChain::MovePrev(void)
 168 {
 169         SysTryReturnResult(NID_SEC_CERT, __pos > 0, E_SYSTEM, "Position is already at zero, failed to move to previous certificate in chain.");
 170         __pos--;
 171         return E_SUCCESS;
 172 }
 173
 174 result
 175 _CertChain::MoveHead(void)
 176 {
 177         __pos = 0;
 178         return E_SUCCESS;
 179 }
 180
 181 result
 182 _CertChain::MoveTail(void)
 183 {
 184         SysTryReturnResult(NID_SEC_CERT, __certChain.GetCount() > 0, E_SYSTEM, "No certificate is present in chain, failed to move to tail of certificate chain.");
 185         __pos = __certChain.GetCount() - 1;
 186
 187         return E_SUCCESS;
 188 }
 189
 190 _CertDomainType
 191 _CertChain::GetCertTypeByDomain(void)
 192 {
 193         _CertDomainType r;
 194
 195         switch (__rootCertType)
 196         {
 197         case _CERT_TYPE_SIM_ROOT_DOMAIN1:
 198         //fall through
 199         case _CERT_TYPE_ROOT_DOMAIN1:
 200         //fall through
 201         case _CERT_TYPE_DEV_ROOT_DOMAIN1:
 202                 r = _CERT_DOMAIN1_TRUSTED;
 203                 break;
 204
 205         case _CERT_TYPE_ROOT_DOMAIN2:
 206         //fall through
 207         case _CERT_TYPE_DEV_ROOT_DOMAIN2:
 208                 r = _CERT_DOMAIN2_TRUSTED;
 209                 break;
 210
 211         case _CERT_TYPE_ROOT_DOMAIN3:
 212         //fall through
 213         case _CERT_TYPE_SIM_ROOT_DOMAIN3:
 214         //fall through
 215         case _CERT_TYPE_DEV_ROOT_DOMAIN3:
 216                 r = _CERT_DOMAIN3_TRUSTED;
 217                 break;
 218
 219         case _CERT_TYPE_WRT:
 220                 r = _CERT_WRT_TRUSTED;
 221                 break;
 222
 223         default:
 224                 r = _CERT_INVALID_DOMAIN;
 225                 break;
 226         }
 227
 228         return r;
 229 }
 230
 231 _X509Certificate*
 232 _CertChain::GetCurrentCertificate(void)
 233 {
 234         SysTryReturn(NID_SEC_CERT, __certChain.GetCount() > 0, null, E_SYSTEM, "[E_SYSTEM] There is no certifcate present in chain.");
 235         SysTryReturn(NID_SEC_CERT, __pos >= 0, null, E_SYSTEM, "[E_SYSTEM] Failed to get certificate object from chain.");
 236         return reinterpret_cast< _X509Certificate* >(__certChain.GetAt(__pos));
 237 }
 238
 239
 240 result
 241 _CertChain::Verify(void)
 242 {
 243         result r = E_SUCCESS;
 244         const unsigned char* pCertContent = null;
 245         int certSize = 0;
 246         int certCount = __certChain.GetCount();
 247         STACK_OF(X509)* pTrustedChain = null;
 248         STACK_OF(X509)* pInterimChain = null;
 249         X509_STORE_CTX* pStoreCtx = NULL;
 250         byte* pCertBuffer = null;
 251         _X509Certificate* pCert = null;
 252         X509** ppInterimCerts = null;
 253         X509* pX509UserCert = null;
 254
 255         SysTryReturnResult(NID_SEC_CERT, certCount > 0, E_SYSTEM, "No certificates are present in certificate chain.");
 256         SysTryReturnResult(NID_SEC_CERT, __certFormat == _CERT_X509, E_SYSTEM, "Certificate chain is not of type X509.");
 257
 258         pCert = reinterpret_cast< _X509Certificate* >(__certChain.GetAt(0));
 259         SysTryReturnResult(NID_SEC_CERT, pCert != null, E_SYSTEM, "Failed to get first certificate in chain.");
 260
 261         certCount--; //user certificate is added.
 262
 263         if (certCount == 0) //only root cert to verify
 264         {
 265                 SysTryReturnResult(NID_SEC_CERT, pCert->IsSelfSigned(), E_DATA_NOT_FOUND, "Failed to get root certificate in chain.");
 266                 return pCert->VerifySignature(null, 0);
 267         }
 268
 269         pCert->GetCertBuffer(pCertBuffer, certSize);
 270         SysTryReturnResult(NID_SEC_CERT, pCertBuffer != null, E_SYSTEM, "Failed to get encoded buffer of first certificate.");
 271
 272         pCertContent = const_cast< const unsigned char* >(pCertBuffer);
 273
 274         d2i_X509(&pX509UserCert, &pCertContent, certSize);
 275         SysTryReturnResult(NID_SEC_CERT, pX509UserCert != null, E_SYSTEM, "Failed to parse user certificate.");
 276
 277         pTrustedChain = sk_X509_new_null();
 278         SysTryCatch(NID_SEC_CERT, pTrustedChain != null, r = E_OUT_OF_MEMORY, E_OUT_OF_MEMORY, "[E_OUT_OF_MEMORY]Failed to allocate trusted root ca certificate chain.");
 279
 280         pInterimChain = sk_X509_new_null();
 281         SysTryCatch(NID_SEC_CERT, pInterimChain != null, r = E_OUT_OF_MEMORY, E_OUT_OF_MEMORY, "[E_OUT_OF_MEMORY]Failed to allocate intermediate ca certificate chain.");
 282
 283         ppInterimCerts = (X509**) new X509*[certCount];
 284         memset(ppInterimCerts, 0, (sizeof(X509*) * certCount));
 285
 286         for (int i = 0; i < certCount; i++)
 287         {
 288                 certSize = 0;
 289                 pCertContent = null;
 290                 pCertBuffer = null;
 291
 292                 pCert = reinterpret_cast< _X509Certificate* >(__certChain.GetAt(i + 1));
 293                 SysTryCatch(NID_SEC_CERT, pCert != null, r = E_SYSTEM, E_SYSTEM, "[E_SYSTEM] Failed to get certificate at index (%d).", i + 1);
 294
 295                 pCert->GetCertBuffer(pCertBuffer, certSize);
 296                 SysTryCatch(NID_SEC_CERT, pCertBuffer != null, r = E_SYSTEM, E_SYSTEM, "[E_SYSTEM] Failed to get buffer of certificate at index (%d).", i + 1);
 297
 298                 pCertContent = const_cast< const unsigned char* >(pCertBuffer);
 299
 300                 d2i_X509(&ppInterimCerts[i], &pCertContent, certSize);
 301                 SysTryCatch(NID_SEC_CERT, ppInterimCerts[i] != null, r = E_SYSTEM, E_SYSTEM, "[E_SYSTEM] Failed to parse certificate at index (%d).", i + 1);
 302
 303                 if (pCert->IsSelfSigned())
 304                 {
 305                         /* verify */
 306                         // insert root certificate into trusted chain
 307                         if (!(sk_X509_push(pTrustedChain, ppInterimCerts[i])))
 308                         {
 309                                 SysLog(NID_SEC_CERT, "Fail to push root ca certificate into openssl stack.");
 310                                 r = E_SYSTEM;
 311                                 goto CATCH;
 312                         }
 313                 }
 314                 else
 315                 {
 316                         if (!(sk_X509_push(pInterimChain, ppInterimCerts[i])))
 317                         {
 318                                 SysLog(NID_SEC_CERT, "Fail to push intermediate ca certificate into openssl stack.");
 319                                 r = E_SYSTEM;
 320                                 goto CATCH;
 321                         }
 322
 323                 }
 324         }
 325
 326         SysTryCatch(NID_SEC_CERT, sk_X509_num(pTrustedChain) > 0, r = E_DATA_NOT_FOUND, E_DATA_NOT_FOUND, "[E_DATA_NOT_FOUND] Failed to get root certificate in chain.");
 327
 328         // initialize store and store context
 329         pStoreCtx = X509_STORE_CTX_new();
 330
 331         // construct store context
 332         if (!X509_STORE_CTX_init(pStoreCtx, 0, pX509UserCert, pInterimChain))
 333         {
 334                 SysLog(NID_SEC_CERT, "Fail to initialize X509 store context.");
 335                 r = E_SYSTEM;
 336                 goto CATCH;
 337         }
 338
 339         X509_STORE_CTX_trusted_stack(pStoreCtx, pTrustedChain);
 340
 341         // verify
 342         if (X509_verify_cert(pStoreCtx) != 1)
 343         {
 344                 SysLog(NID_SEC_CERT, "Fail to verify certificate chain.");
 345                 switch(X509_STORE_CTX_get_error(pStoreCtx))
 346                 {
 347                 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
 348                         r = E_DATA_NOT_FOUND;
 349                         break;
 350                 case X509_V_ERR_CERT_HAS_EXPIRED:
 351                 //fall though
 352                 case X509_V_ERR_CERT_NOT_YET_VALID:
 353                         r = E_INVALID_CERTIFICATE;
 354                         break;
 355                 case X509_V_ERR_CERT_SIGNATURE_FAILURE:
 356                         r = E_CERTIFICATE_VERIFICATION_FAILED;
 357                         break;
 358                 default:
 359                         r = E_SYSTEM;
 360                         break;
 361                 }
 362                 SysLog(NID_SEC_CERT, "error number = %d", X509_STORE_CTX_get_error(pStoreCtx));
 363                 goto CATCH;
 364
 365         }
 366
 367 CATCH:
 368
 369         if (ppInterimCerts != null)
 370         {
 371                 for(int i = 0; i < certCount; i++)
 372                 {
 373                         if (ppInterimCerts[i] != null)
 374                         {
 375                                 X509_free(ppInterimCerts[i]);
 376                         }
 377                 }
 378
 379                 delete[] ppInterimCerts;
 380         }
 381
 382         if (pX509UserCert != null)
 383         {
 384                 X509_free(pX509UserCert);
 385         }
 386
 387         if (pStoreCtx != null)
 388         {
 389                 X509_STORE_CTX_free(pStoreCtx);
 390         }
 391
 392         if (pTrustedChain != null)
 393         {
 394                 sk_X509_free(pTrustedChain);
 395         }
 396
 397         if (pInterimChain != null)
 398         {
 399                 sk_X509_free(pInterimChain);
 400         }
 401         return r;
 402 }
 403
 404
 405 result
 406 _CertChain::VerifyUsingOpenSsl(void)
 407 {
 408         result r = E_SUCCESS;
 409         int keyLen = 0;
 410         int count = 0;
 411
 412         r = MoveTail();
 413         SysTryReturnResult(NID_SEC_CERT, !IsFailed(r), E_SYSTEM, "No certificate is present in certificate chain, failed to validate certificate chain.");
 414
 415         if (__certFormat == _CERT_X509)
 416         {
 417                 _X509Certificate* pCert = null;
 418                 _X509Certificate* pPrevCert = null;
 419                 _X509TbsCert* pTbsCert = null;
 420                 _X509TbsCert* pPrevTbsCert = null;
 421
 422                 do
 423                 {
 424                         pPrevCert = GetCurrentCertificate();
 425                         SysTryReturnResult(NID_SEC_CERT, pPrevCert != null, E_SYSTEM, "Failed to get root certificate from chain, broken certificate chain.");
 426
 427                         if (pPrevCert->IsSelfSigned())
 428                         {
 429                                 // rootCA self verify
 430                                 if (__checkValidity)
 431                                 {
 432                                         pPrevTbsCert = pPrevCert->GetTbsCertInstance();
 433                                         SysTryReturnResult(NID_SEC_CERT, pPrevTbsCert != null, E_SYSTEM, "Failed to get root certificate to be signed instance.");
 434
 435                                         r = pPrevTbsCert->GetValidity();
 436                                         SysTryReturnResult(NID_SEC_CERT, !IsFailed(r), E_INVALID_CERTIFICATE, "Root certificate validation failed (subject name: %s).", pPrevTbsCert->GetSubjectName());
 437                                 }
 438
 439                                 r = pPrevCert->VerifySignature(null, 0);
 440                                 SysTryReturnResult(NID_SEC_CERT, !IsFailed(r), E_CERTIFICATE_VERIFICATION_FAILED, "Root certificate signature verification failed (subject name: %s).", pPrevTbsCert->GetSubjectName());
 441                         }
 442                         else
 443                         {
 444                                 if (MoveNext() == E_SUCCESS)
 445                                 {
 446                                         pPrevCert = GetCurrentCertificate();
 447                                 }
 448                                 count++;
 449                                 break;
 450                         }
 451                 }
 452                 while (MovePrev() == E_SUCCESS);
 453
 454                 while (MovePrev() == E_SUCCESS)
 455                 {
 456                         byte* pKey = null;
 457                         count++;
 458
 459                         pCert = GetCurrentCertificate();
 460                         SysTryReturnResult(NID_SEC_CERT, pCert != null, E_SYSTEM, "Failed to get certificate from chain, broken certificate chain.");
 461
 462                         pPrevTbsCert = pPrevCert->GetTbsCertInstance();
 463                         SysTryReturnResult(NID_SEC_CERT, pPrevTbsCert != null, E_SYSTEM, "Failed to get certificate to be signed instance.");
 464
 465                         pTbsCert = pCert->GetTbsCertInstance();
 466                         SysTryReturnResult(NID_SEC_CERT, pTbsCert != null, E_SYSTEM, "Failed to get certificate to be signed instance.");
 467
 468                         if (__checkValidity)
 469                         {
 470                                 r = pPrevTbsCert->GetValidity();
 471                                 SysTryReturnResult(NID_SEC_CERT, !IsFailed(r), E_INVALID_CERTIFICATE, "Certificate validation failed (subject name: %s).", pPrevTbsCert->GetSubjectName());
 472                         }
 473
 474
 475                         SysTryReturnResult(NID_SEC_CERT, pCert->IsIssuer(pPrevCert), E_SYSTEM, "Certificate is not in sorted order or parent certificate is missing in chain, certificate chain is broken (subject name: %s).", pPrevTbsCert->GetSubjectName());
 476
 477                         r = pPrevTbsCert->GetPublicKeyInfoN(keyLen, &pKey);
 478                         SysTryReturnResult(NID_SEC_CERT, pKey != null, E_SYSTEM, "Failed to public key from certificate (subject name: %s).", pPrevTbsCert->GetSubjectName());
 479
 480                         std::unique_ptr<byte[]> pKeyAuto(pKey);
 481
 482                         r = pCert->VerifySignature(pKey, keyLen);
 483
 484                         SysTryReturnResult(NID_SEC_CERT, !IsFailed(r), E_CERTIFICATE_VERIFICATION_FAILED, "Certificate signature verification failed (subject name: %s).", pTbsCert->GetSubjectName());
 485
 486                         pPrevCert = pCert;
 487                 }
 488         }
 489
 490         return E_SUCCESS;
 491 }
 492
 493 result
 494 _CertChain::VerifyCertChainWithDb(void)
 495 {
 496         result r = E_SUCCESS;
 497         _CertDbManager* pCertDb = null;
 498         byte* pCert = null;
 499         int certLen = 0;
 500         _CaCertType certType = _CERT_TYPE_NOT_BOUNDED;
 501
 502         r = MoveTail();
 503         SysTryReturnResult(NID_SEC_CERT, !IsFailed(r), E_SYSTEM, "No certificate is present in certificate chain, failed to validate certificate chain.");
 504
 505         pCertDb = _CertDbManager::GetInstance();
 506         SysTryReturnResult(NID_SEC_CERT, pCertDb != null, E_SYSTEM, "Failed to get instance of certificate database manager.");
 507
 508         if (__certFormat == _CERT_X509)
 509         {
 510                 _X509Certificate* pLastCert = null;
 511                 _X509TbsCert* pTbsCert = null;
 512                 pLastCert = GetCurrentCertificate();
 513                 SysTryReturnResult(NID_SEC_CERT, pLastCert != null, E_SYSTEM, "Failed to get certificate to be signed instance.");
 514
 515                 if (pLastCert->IsSelfSigned())
 516                 {
 517                         pCertDb = _CertDbManager::GetInstance();
 518                         SysTryReturnResult(NID_SEC_CERT, pCertDb != null, E_SYSTEM, "Failed to get instance of certificate database manager.");
 519
 520                         pTbsCert = pLastCert->GetTbsCertInstance();
 521                         SysTryReturnResult(NID_SEC_CERT, pTbsCert != null, E_SYSTEM, "Failed to get root certificate to be signed instance.");
 522
 523                         if (GetContextType() == _CERT_CONTEXT_SSL)
 524                         {
 525                                 certType = _CERT_TYPE_ROOT_CA;
 526                                 __checkValidity = true;
 527
 528                                 if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 529                                 {
 530                                         certType = _CERT_TYPE_ROOT_CA_BY_USER;
 531                                         __checkValidity = true;
 532
 533                                         r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 534                                         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetSubjectName());
 535                                 }
 536                         }
 537                         else if (GetContextType() == _CERT_CONTEXT_MIDP || GetContextType() == _CERT_CONTEXT_DOMAIN || GetContextType() == _CERT_CONTEXT_DOMAIN_NO_VALIDITY)
 538                         {
 539                                 if (GetContextType() == _CERT_CONTEXT_DOMAIN_NO_VALIDITY)
 540                                 {
 541                                         __checkValidity = false;
 542                                 }
 543                                 else
 544                                 {
 545                                         __checkValidity = true;
 546                                 }
 547
 548                                 certType = _CERT_TYPE_ROOT_DOMAIN1;
 549                                 if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 550                                 {
 551                                         certType = _CERT_TYPE_ROOT_DOMAIN2;
 552                                         if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 553                                         {
 554                                                 certType = _CERT_TYPE_ROOT_DOMAIN3;
 555                                                 if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 556                                                 {
 557                                                         certType = _CERT_TYPE_DEV_ROOT_DOMAIN1;
 558                                                         if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 559                                                         {
 560                                                                 certType = _CERT_TYPE_DEV_ROOT_DOMAIN3;
 561                                                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 562                                                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetSubjectName());
 563                                                         }
 564                                                 }
 565                                         }
 566                                 }
 567                         }
 568                         else if (GetContextType() == _CERT_CONTEXT_CERT || GetContextType() == _CERT_CONTEXT_CERT_NO_VALIDITY)
 569                         {
 570                                 if (GetContextType() == _CERT_CONTEXT_CERT)
 571                                 {
 572                                         __checkValidity = true;
 573                                 }
 574                                 else if (GetContextType() == _CERT_CONTEXT_CERT_NO_VALIDITY)
 575                                 {
 576                                         __checkValidity = false;
 577                                 }
 578
 579                                 certType = _CERT_TYPE_TRUSTED_CA;
 580                         }
 581                         else if (GetContextType() == _CERT_CONTEXT_OSP_USER || GetContextType() == _CERT_CONTEXT_OSP_USER_NO_VALIDITY)
 582                         {
 583                                 if (GetContextType() == _CERT_CONTEXT_OSP_USER)
 584                                 {
 585                                         __checkValidity = true;
 586                                 }
 587                                 else if (GetContextType() == _CERT_CONTEXT_OSP_USER_NO_VALIDITY)
 588                                 {
 589                                         __checkValidity = false;
 590                                 }
 591
 592                                 certType = _CERT_TYPE_ROOT_CA_BY_USER;
 593
 594                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 595                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 596                         }
 597                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1_NO_VALIDITY)
 598                         {
 599                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1)
 600                                 {
 601                                         __checkValidity = true;
 602                                 }
 603                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1_NO_VALIDITY)
 604                                 {
 605                                         __checkValidity = false;
 606                                 }
 607
 608                                 certType = _CERT_TYPE_OSP_CRITICAL1;
 609
 610                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 611                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 612                         }
 613                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2_NO_VALIDITY)
 614                         {
 615                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2)
 616                                 {
 617                                         __checkValidity = true;
 618                                 }
 619                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2_NO_VALIDITY)
 620                                 {
 621                                         __checkValidity = false;
 622                                 }
 623
 624                                 certType = _CERT_TYPE_OSP_CRITICAL2;
 625                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 626                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 627                         }
 628                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3_NO_VALIDITY)
 629                         {
 630                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3)
 631                                 {
 632                                         __checkValidity = true;
 633                                 }
 634                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3_NO_VALIDITY)
 635                                 {
 636                                         __checkValidity = false;
 637                                 }
 638                                 certType = _CERT_TYPE_OSP_CRITICAL3;
 639
 640                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 641                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 642                         }
 643                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4_NO_VALIDITY)
 644                         {
 645                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4)
 646                                 {
 647                                         __checkValidity = true;
 648                                 }
 649                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4_NO_VALIDITY)
 650                                 {
 651                                         __checkValidity = false;
 652                                 }
 653                                 certType = _CERT_TYPE_OSP_CRITICAL4;
 654
 655                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 656                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 657                         }
 658                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5_NO_VALIDITY)
 659                         {
 660                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5)
 661                                 {
 662                                         __checkValidity = true;
 663                                 }
 664                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5_NO_VALIDITY)
 665                                 {
 666                                         __checkValidity = false;
 667                                 }
 668                                 certType = _CERT_TYPE_OSP_CRITICAL5;
 669
 670                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 671                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 672                         }
 673                         else if (GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP || GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP_NO_VALIDITY)
 674                         {
 675                                 if (GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP)
 676                                 {
 677                                         __checkValidity = true;
 678                                 }
 679                                 else if (GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP_NO_VALIDITY)
 680                                 {
 681                                         __checkValidity = false;
 682                                 }
 683                                 certType = _CERT_TYPE_OSP_PRELOAD_APP;
 684
 685                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 686                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 687                         }
 688                         else if (GetContextType() == _CERT_CONTEXT_WRT)
 689                         {
 690                                 __checkValidity = true;
 691                                 certType = _CERT_TYPE_WRT;
 692
 693                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 694                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 695                         }
 696                         else if (GetContextType() == _CERT_CONTEXT_TK)
 697                         {
 698                                 certType = _CERT_TYPE_ROOT_DOMAIN2;
 699                                 __checkValidity = true;
 700                                 if (!strcmp(_CERT_TK_ISSUER_NAME, reinterpret_cast< const char* >(pTbsCert->GetIssuerName())))
 701                                 {
 702                                         r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 703                                         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 704                                 }
 705                                 else
 706                                 {
 707                                         //if the issuerName of this certificate is not _CERT_TK_ISSUER_NAME then we should return some error
 708                                         SysTryReturnResult(NID_SEC_CERT, false, E_INACCESSIBLE_PATH, "Failed to access specified Path.");
 709                                 }
 710                         }
 711                         else
 712                         {
 713                                 SysTryReturnResult(NID_SEC_CERT, false, E_SYSTEM, "Invalid context type.");
 714                         }
 715                         if (!IsFailed(r))
 716                         {
 717                                 //Set the format of root certificate
 718                                 __rootCertType = certType;
 719                         }
 720
 721                         delete[] pCert;
 722                         return Verify();
 723                 }
 724                 else
 725                 {
 726                         //Otherwise extract root certificate from Db and add in tail and then verify.
 727                         pTbsCert = pLastCert->GetTbsCertInstance();
 728                         SysTryReturnResult(NID_SEC_CERT, pTbsCert != null, E_SYSTEM, "Failed to get to be signed object from cerificate.");
 729
 730
 731                         //If the conetxt type is SSL then root certiifcate should be searched in DefaultROOCACert directory.
 732                         //It should not search in any other directory
 733                         //Similarily, if context type is MIDP then root certificate should be searched in Domain1, Domain2 & Domain3 directory.
 734                         //If not found report error.
 735                         if (GetContextType() == _CERT_CONTEXT_SSL)
 736                         {
 737                                 certType = _CERT_TYPE_ROOT_CA;
 738                                 __checkValidity = true;
 739                                 if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 740                                 {
 741                                         certType = _CERT_TYPE_ROOT_CA_BY_USER;
 742                                         __checkValidity = true;
 743
 744                                         r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 745                                         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 746                                 }
 747                         }
 748                         else if (GetContextType() == _CERT_CONTEXT_MIDP || GetContextType() == _CERT_CONTEXT_DOMAIN || GetContextType() == _CERT_CONTEXT_DOMAIN_NO_VALIDITY)
 749                         {
 750                                 if (GetContextType() == _CERT_CONTEXT_DOMAIN_NO_VALIDITY)
 751                                 {
 752                                         __checkValidity = false;
 753                                 }
 754                                 else
 755                                 {
 756                                         __checkValidity = true;
 757                                 }
 758                                 certType = _CERT_TYPE_ROOT_DOMAIN1;
 759                                 if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 760                                 {
 761                                         certType = _CERT_TYPE_ROOT_DOMAIN2;
 762                                         if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 763                                         {
 764                                                 certType = _CERT_TYPE_ROOT_DOMAIN3;
 765                                                 if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 766                                                 {
 767                                                         certType = _CERT_TYPE_DEV_ROOT_DOMAIN1;
 768                                                         if (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen) != E_SUCCESS)
 769                                                         {
 770                                                                 certType = _CERT_TYPE_DEV_ROOT_DOMAIN3;
 771
 772                                                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 773                                                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 774                                                         }
 775                                                 }
 776                                         }
 777                                 }
 778                         }
 779                         else if (GetContextType() == _CERT_CONTEXT_CERT || GetContextType() == _CERT_CONTEXT_CERT_NO_VALIDITY)
 780                         {
 781                                 if (GetContextType() == _CERT_CONTEXT_CERT)
 782                                 {
 783                                         __checkValidity = true;
 784                                 }
 785                                 else if (GetContextType() == _CERT_CONTEXT_CERT_NO_VALIDITY)
 786                                 {
 787                                         __checkValidity = false;
 788                                 }
 789
 790                                 r = pCertDb->FindIssuerCertificateAndTypeN(_CERT_X509, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen, certType);
 791                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 792                         }
 793                         else if (GetContextType() == _CERT_CONTEXT_OSP_USER || GetContextType() == _CERT_CONTEXT_OSP_USER_NO_VALIDITY)
 794                         {
 795                                 if (GetContextType() == _CERT_CONTEXT_OSP_USER)
 796                                 {
 797                                         __checkValidity = true;
 798                                 }
 799                                 else if (GetContextType() == _CERT_CONTEXT_OSP_USER_NO_VALIDITY)
 800                                 {
 801                                         __checkValidity = false;
 802                                 }
 803                                 certType = _CERT_TYPE_ROOT_CA_BY_USER;
 804
 805                                 r = (pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen));
 806                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 807                         }
 808                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1_NO_VALIDITY)
 809                         {
 810                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1)
 811                                 {
 812                                         __checkValidity = true;
 813                                 }
 814                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL1_NO_VALIDITY)
 815                                 {
 816                                         __checkValidity = false;
 817                                 }
 818                                 certType = _CERT_TYPE_OSP_CRITICAL1;
 819
 820                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 821                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 822                         }
 823                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2_NO_VALIDITY)
 824                         {
 825                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2)
 826                                 {
 827                                         __checkValidity = true;
 828                                 }
 829                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL2_NO_VALIDITY)
 830                                 {
 831                                         __checkValidity = false;
 832                                 }
 833                                 certType = _CERT_TYPE_OSP_CRITICAL2;
 834
 835                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 836                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 837                         }
 838                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3_NO_VALIDITY)
 839                         {
 840                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3)
 841                                 {
 842                                         __checkValidity = true;
 843                                 }
 844                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL3_NO_VALIDITY)
 845                                 {
 846                                         __checkValidity = false;
 847                                 }
 848                                 certType = _CERT_TYPE_OSP_CRITICAL3;
 849
 850                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 851                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 852                         }
 853                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4_NO_VALIDITY)
 854                         {
 855                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4)
 856                                 {
 857                                         __checkValidity = true;
 858                                 }
 859                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL4_NO_VALIDITY)
 860                                 {
 861                                         __checkValidity = false;
 862                                 }
 863                                 certType = _CERT_TYPE_OSP_CRITICAL4;
 864
 865                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 866                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 867                         }
 868                         else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5 || GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5_NO_VALIDITY)
 869                         {
 870                                 if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5)
 871                                 {
 872                                         __checkValidity = true;
 873                                 }
 874                                 else if (GetContextType() == _CERT_CONTEXT_OSP_CRITICAL5_NO_VALIDITY)
 875                                 {
 876                                         __checkValidity = false;
 877                                 }
 878                                 certType = _CERT_TYPE_OSP_CRITICAL5;
 879
 880                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 881                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 882                         }
 883                         else if (GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP || GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP_NO_VALIDITY)
 884                         {
 885                                 if (GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP)
 886                                 {
 887                                         __checkValidity = true;
 888                                 }
 889                                 else if (GetContextType() == _CERT_CONTEXT_OSP_PRELOAD_APP_NO_VALIDITY)
 890                                 {
 891                                         __checkValidity = false;
 892                                 }
 893                                 certType = _CERT_TYPE_OSP_PRELOAD_APP;
 894
 895                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 896                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 897                         }
 898                         else if (GetContextType() == _CERT_CONTEXT_WRT)
 899                         {
 900                                 __checkValidity = true;
 901                                 certType = _CERT_TYPE_WRT;
 902
 903                                 r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 904                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 905                         }
 906                         else if (GetContextType() == _CERT_CONTEXT_TK)
 907                         {
 908                                 certType = _CERT_TYPE_ROOT_DOMAIN2;
 909                                 __checkValidity = true;
 910
 911                                 if (!strcmp(_CERT_TK_ISSUER_NAME, reinterpret_cast< const char* >(pTbsCert->GetIssuerName())))
 912                                 {
 913                                         r = pCertDb->FindIssuerCertificateByTypeN(_CERT_X509, certType, reinterpret_cast< char* >(pTbsCert->GetIssuerName()), &pCert, certLen);
 914                                         SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s] Failed to find certificate in database (subject name: %s).", GetErrorMessage(r), pTbsCert->GetIssuerName());
 915                                 }
 916                                 else
 917                                 {
 918                                         SysTryReturnResult(NID_SEC_CERT, false, E_INACCESSIBLE_PATH, "Failed to access specified certificate path.");
 919                                 }
 920                         }
 921                         else
 922                         {
 923                                 SysTryReturnResult(NID_SEC_CERT, false, E_SYSTEM, "Invalid context type.");
 924                         }
 925
 926                         if (pCert != null)
 927                         {
 928                                 std::unique_ptr<byte[]> pCertAuto(pCert);
 929
 930                                 //Add newly found root certificate in chain for verification.
 931                                 r = AddCertificate(__certFormat, reinterpret_cast< byte* >(pCert), certLen);
 932
 933                                 SysTryReturnResult(NID_SEC_CERT, !IsFailed(r), E_SYSTEM, "Failed to add parent certificate in chain.");
 934                                 //Verify certificate chain and return result to application
 935                                 r = Verify();
 936                                 SysTryReturn(NID_SEC_CERT, !IsFailed(r), r, r, "[%s]Failed to verify certificate chain.", GetErrorMessage(r));
 937                         }
 938                         else
 939                         {
 940                                 SysTryReturnResult(NID_SEC_CERT, false, E_DATA_NOT_FOUND, "Parent certificate not found in certificate database.");
 941                         }
 942
 943                         if (!IsFailed(r))
 944                         {
 945                                 //Set the format of root certificate
 946                                 __rootCertType = certType;
 947                         }
 948                 }
 949         }
 950
 951         return r;
 952 }
 953
 954 int
 955 _CertChain::GetCount(void)
 956 {
 957         return __certChain.GetCount();
 958 }
 959
 960 void
 961 _CertChain::SetContextType(_CertContextType type)
 962 {
 963         __contextType = type;
 964 }
 965
 966 _CertContextType
 967 _CertChain::GetContextType(void)
 968 {
 969         return __contextType;
 970 }
 971
 972 _CertFormat
 973 _CertChain::GetCertFormat(void)
 974 {
 975         return __certFormat;
 976 }
 977
 978 void
 979 _CertChain::RemoveHead(bool freeFlag)
 980 {
 981         __certChain.RemoveAt(0, freeFlag);
 982 }
 983
 984 void
 985 _CertChain::RemoveTail(bool freeFlag)
 986 {
 987         if (__certChain.GetCount() > 0)
 988         {
 989                 __certChain.RemoveAt(__certChain.GetCount() - 1, freeFlag);
 990         }
 991 }
 992
 993 } } } //Tizen::Security::Cert