Subject: RE: Microsoft

From: Boulos Dib <[email-masked]>
Date: Fri, 2 Jun 2000 07:44:27 -0700

Denis,

I take it you need to understand how IIS and Outlook perform certification
path validation which includes certificate status checking.  If you need to
learn more path validation in general, RFC2459 is the official document.
PKIX uses the term validation not verification and RFC2459 section 6 defines
the details of certification path validation.

I am not an expert on the internals of IIS and Outlook, but I understand
that they both use Microsoft's CryptoAPI (CAPI) certificate functions.  CAPI
includes a number of APIs to deal with certificates, certificate stores, and
what CAPI calls "Certificate Verification Functions" which use Certificate
Revocation Lists (CRLs) and Certificate Trust Lists (CTLs).  There is also a
way for third party vendors (i.e. Validation Authorities) to plug-in their
own implementation of certain APIs to extend the validation to use other
protocols such as Online Certificate Status Protocol (OCSP).  Check out
http://www.valicert.com for information about Email, Web Browser and Web
server validators.  Microsoft's CryptoAPI documentation is available online
on MSDN http://msdn.microsoft.com/library/psdk/crypto/portalapi_3351.htm

I hope the above helps to get you started.

Boulos.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Wednesday, May 31, 2000 6:42 PM
To: [email-masked]
Subject: Microsoft

Hello,

I am developing a certificate-generating application that will be employed
in a Microsoft-based environment. I am looking from someone in Microsoft who
has the technical insight about how certificate verification has been
implemented in IIS, and perhaps also Microsoft Outlook.

Is there, perhaps, someone who is reading this list who would know something
about this, or someone who would have the appropriate contacts?

If so, I would be much obliged if you could send me an email.

Kind regards,

denis bider