The authoritative source for the values of the WinHttpRequestOption enums is
the httprequest.idl file in the Platform SDK. The ordering of the enums in
the IDL file determines their values. Unfortunately the on-line
documentation lists them in the incorrect order w.r.t. the
EnableCertificateRevocationCheck option.
From the httprequest.idl file :
enum WinHttpRequestOption
{
WinHttpRequestOption_UserAgentString, // 0
WinHttpRequestOption_URL, // 1
WinHttpRequestOption_URLCodePage, // 2
WinHttpRequestOption_EscapePercentInURL, // 3
WinHttpRequestOption_SslErrorIgnoreFlags, // 4
WinHttpRequestOption_SelectCertificate, // 5
WinHttpRequestOption_EnableRedirects, // 6
WinHttpRequestOption_UrlEscapeDisable, // 7
WinHttpRequestOption_UrlEscapeDisableQuery, // 8
WinHttpRequestOption_SecureProtocols, // 9
WinHttpRequestOption_EnableTracing, // 10
WinHttpRequestOption_RevertImpersonationOverSsl, // 11
WinHttpRequestOption_EnableHttpsToHttpRedirects, // 12
WinHttpRequestOption_EnablePassportAuthentication,// 13
WinHttpRequestOption_MaxAutomaticRedirects, // 14
WinHttpRequestOption_MaxResponseHeaderSize, // 15
WinHttpRequestOption_MaxResponseDrainSize, // 16
WinHttpRequestOption_EnableHttp1_1, // 17
WinHttpRequestOption_EnableCertificateRevocationCheck // 18
} WinHttpRequestOption;
Stephen
Post by GregHi Frank, and thanks for your interest.
Let me be clearer about this issue.
In the following page, you find the WinHttpRequestOption described.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/winhttp/htt
Post by Gregp/winhttprequestoption.asp
I'm assuming this Enum being is zero based. This is confirmed by the VB
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/winhttp/htt
Post by Gregp/iwinhttprequest_option.asp
Const WinHttpRequestOption_UserAgentString = 0
Const WinHttpRequestOption_URL = 1
Const WinHttpRequestOption_URLCodePage = 2
Const WinHttpRequestOption_EscapePercentInURL = 3
WinHttpRequestOption_EnableCertificateRevocationCheck == 4
WinHttpRequestOption_SslErrorIgnoreFlags == 5
Which is wrong, as far as WinHttpRequestOption_SslErrorIgnoreFlags == 4
;-))
Please let us know !
Thnx !
Greg
Post by Frank Schwieterman [MSFT]Hi Greg I'm glad you were to get things working. I'd like to followup
though about the issue you saw with the enum being inverted as I don't
understand the problem as stated. It sounds like you think you found a
bug
Post by Frank Schwieterman [MSFT]though? Can you expand a bit on the behavior you think was bug, and let
me
Post by Frank Schwieterman [MSFT]know what you expected and what you saw?
--
This posting is provided "AS IS" with no warranties, and confers no
rights.
Post by Frank Schwieterman [MSFT]Post by GregThanks Stephen,
I had the Option_SSLErrorIgnoreFlags set to 5 as described in the
WinHttpRequestOption enum at
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/winhttp/htt
Post by GregPost by Frank Schwieterman [MSFT]Post by Gregp/winhttprequestoption.asp
But there seems to be an inversion in this enum, as far as
Option_SSLErrorIgnoreFlags should be set to 4 instead !
N.B. : By adding the Option with 100H, I could also got rid of the CA
certificate.
Everything is working fine now !
Thanks again,
Greg
Post by Stephen SulzerGreg,
The ERROR_WINHTTP_SECURE_INVALID_CA error might be a problem with the
server's certificate, not with your client certificate. If it is a
problem
Post by GregPost by Stephen Sulzerwith the server's certificate, you can instruct WinHTTP to ignore the
problem as a workaround. This is done by setting a
'SSLErrorIgnoreFlags'
Post by Frank Schwieterman [MSFT]Post by GregPost by Stephen SulzerConst Option_SSLErrorIgnoreFlags = 4
Const SslErrorFlag_UnknownCA = 256
Const SslErrorFlag_CertWrongUsage = 512
Const SslErrorFlag_CertCNInvalid = 4096
Const SslErrorFlag_CertDateInvalid = 8192
Const SslErrorFlag_Ignore_All = 13056 ' Ignore all of the above
WinHttp.Option(Option_SSLErrorIgnoreFlags) = SslErrorFlag_Ignore_All
WinHttp.SetClientCertificate("LOCAL_MACHINE\MY\Gregoire")
WinHttp.Send
For documentation on the SSLErrorIgnoreFlags option, see the
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/winhttp/htt
Post by GregPost by Frank Schwieterman [MSFT]Post by Gregp/winhttprequestoption.asp
Post by Stephen SulzerHope that helps.
Stephen
Post by GregThat's it - Thanks !
1. Download & Install WinHttpCertCfgTool (for W2K) from
http://www.microsoft.com/downloads/details.aspx?familyid=c42e27ac-3409-40e9-
Post by GregPost by Frank Schwieterman [MSFT]Post by GregPost by Stephen SulzerPost by Greg8667-c748e422833f&displaylang=en
2. Launch mmc.exe
3. Add the Certificate SnapIn For Local Computer (only this one)
4. Add My certificate into the Personal Store
winhttpcertcfg -g -c LOCAL_MACHINE\My -s
"MyCertificateSubjectName" -a
Post by Frank Schwieterman [MSFT]Post by GregPost by Stephen SulzerPost by GregIWAM_MachineName
At this point I had a
ERROR_WINHTTP_SECURE_INVALID_CA
12045
Indicates that a certificate chain was processed but terminated in a
root
Post by Stephen SulzerPost by Gregcertificate that is not trusted by the trust provider (equivalent to
CERT_E_UNTRUSTEDROOT).
6. So I had to add the second certificate (the provider's public
key)
Post by Frank Schwieterman [MSFT]Post by Greginto
Post by Stephen SulzerPost by Gregthe Trusted Root Certification Authorities via the MMC
WinHttp.WinHttpRequest error '80072f06'
The host name in the certificate is invalid or does not match
<=>
ERROR_WINHTTP_SECURE_INVALID_CA
12045
Indicates that a certificate chain was processed but terminated in a
root
Post by Stephen SulzerPost by Gregcertificate that is not trusted by the trust provider (equivalent to
CERT_E_UNTRUSTEDROOT).
So may be there's a pb in the certificates themselves..
I'll post back to that forum to let you know anyway.
Greg