This function verifies that the signed certificate has not been altered since it was signed by the designated signer. Only one signature is verified by this function. If the certificate to be verified includes multiple signatures, this function must be applied once for each signature to be verified. This function verifies a digital signature over the certificate fields specified by VerifyScope. If the verification scope fields are not specified, the function performs verification using a preselected set of fields in the certificate.

CSSM_BOOL CSSMAPI CSSM_CL_CertVerify
            (CSSM_CL_HANDLE CLHandle,
            CSSM_CC_HANDLE CCHandle,
            const CSSM_DATA_PTR CertToBeVerified,
            const CSSM_DATA_PTR SignerCert,
            const CSSM_FIELD_PTR VerifyScope,
            uint32 ScopeSize)

Input

CLHandle

The handle that describes the CL module used to perform this function.

CCHandle

The handle that describes the context of this cryptographic operation.

CertToBeVerified

A pointer to the CSSM_DATA structure containing a certificate containing at least one signature for verification. An unsigned certificate template cannot be verified.

SignerSize

A pointer to the CSSM_DATA structure containing the certificate used to sign the subject certificate.

ScopeSize

The number of entries in the verify scope list. If the verification scope is not specified, the input value for scope size must be zero.

Input/optional

VerifyScope

A pointer to the CSSM_FIELD array containing the tag/value pairs of the fields to be used in verifying the signature (i.e., the fields that were used to calculate the signature). If the verify scope is null, the CL module assumes that its default set of certificate fields were used to calculate the signature and those same fields are used in the verification process.

CSSM_TRUE if the certificate signature verified. CSSM_FALSE if the certificate signature did not verify or an error condition occurred. Use CSSM_GetError to obtain the error code.

CSSM_CL_CertSign