#include <wincrypt.h>
 
DWORD VerifyServerCertificate(
	PCCERT_CONTEXT  pCertContextServer,
	PWSTR		 pwszServerName)
{
	PCCERT_CHAIN_CONTEXT	pChainContext   = NULL;
	CERT_CHAIN_PARA		 ChainPara;
	PCERT_SIMPLE_CHAIN	pSimpleChain;
	PCCERT_CONTEXT		pRootCert;
	WCHAR*				pwszName		= NULL;
	DWORD				 dwErr		 = NO_ERROR;
	DWORD				cchName;
	DWORD				dwTrustErrorMask =
~(CERT_TRUST_IS_NOT_TIME_NESTED|CERT_TRUST_REVOCATION_STATUS_UNKNOWN);
 
	ZeroMemory(&ChainPara, sizeof(ChainPara));
	ChainPara.cbSize = sizeof(ChainPara);
 
	if(!CertGetCertificateChain(
							NULL,
							pCertContextServer,
							NULL,
							pCertContextServer->hCertStore,
							&ChainPara,
							0,
							NULL,
							&pChainContext))
	{
		dwErr = GetLastError();
 
		EapTlsTrace(TEXT("CertGetCertificateChain failed and
returned 0x%x"), dwErr);
		pChainContext = NULL;
		goto LDone;
}
 
	pSimpleChain = pChainContext->rgpChain[0];
 
	dwTrustErrorMask &=
pSimpleChain->TrustStatus.dwErrorStatus;
	if (dwTrustErrorMask)
	{
		if (dwTrustErrorMask & (CERT_TRUST_IS_PARTIAL_CHAIN |
CERT_TRUST_IS_UNTRUSTED_ROOT))
			dwErr = SEC_E_UNTRUSTED_ROOT;
		else if (dwTrustErrorMask &
(CERT_TRUST_IS_NOT_TIME_VALID))
			dwErr = SEC_E_CERT_EXPIRED;
		else
			dwErr = SEC_E_CERT_UNKNOWN;
		goto LDone;
}
	// Compare the DNS name in the certificate with the server.
	dwErr = SEC_E_CERT_UNKNOWN;  // Could be a better error.
	// Get the DNS name from the certificate.

	pwszName = NULL;
	cchName = CertGetNameStringW(pCertContextServer,
						CERT_NAME_DNS_TYPE,
						0,
						NULL,
						NULL,
						0);
	if (cchName > 1)
	{
		pwszName = LocalAlloc(0, sizeof(WCHAR)*cchName);
		if (pwszName)
		{
			cchName = CertGetNameStringW(pCertContextServer,
						CERT_NAME_DNS_TYPE,
						0,
						NULL,
						pwszName,
						cchName);
			if (cchName > 1 && wcsicmp(pwszServerName,
pwszName) == 0)
				dwErr = ERROR_SUCCESS;
	}
}
					
LDone:
 
	if (pChainContext)
	{
		CertFreeCertificateChain(pChainContext);
}
 
	LocalFree(pwszName);
 
	return(dwErr);
}