. More investigation is
  // needed to determine if setting CERT_STRONG_SIGN_DISABLE_END_CHECK_FLAG in
  // the dwStrongSignFlags of |chain_para| would allow the ability to disable
  // support for intermediates/roots < 2048-bits, while still ensuring that
  // end-entity certs signed with SHA-1 are flagged/rejected.
  wchar_t key_sizes[] = L"RSA/1024;ECDSA/256";
  strong_signed_info.pwszCNGPubKeyMinBitLengths = key_sizes;

  CERT_STRONG_SIGN_PARA strong_sign_params;
  memset(&strong_sign_params, 0, sizeof(strong_sign_params));
  strong_sign_params.cbSize = sizeof(strong_sign_params);
  strong_sign_params.dwInfoChoice = CERT_STRONG_SIGN_SERIALIZED_INFO_CHOICE;
  strong_sign_params.pSerializedInfo = &strong_signed_info;

  chain_para.dwStrongSignFlags = 0;
  chain_para.pStrongSignPara = &strong_sign_params;

  PCCERT_CHAIN_CONTEXT chain_context = nullptr;

  // First, try to verify with strong signing enabled. If this fails, or if the
  // chain is rejected, then clear it from |chain_para| so that all subsequent
  // calls will use the fallback path.
  BOOL chain_result =
      CertGetCertificateChain(chain_engine, cert_list.get(),
                              NULL,  // current system time
                              cert_list->hCertStore, &chain_para, chain_flags,
                              NULL,  // reserved
                              &chain_context);
  if (chain_result && chain_context &&
      (chain_context->TrustStatus.dwErrorStatus &
       (CERT_TRUST_HAS_WEAK_SIGNATURE | CERT_TRUST_IS_NOT_SIGNATURE_VALID))) {
    // The attempt to verify with strong-sign (only SHA-2) failed, so fall back
    // to disabling it. This will allow SHA-1 chains
. More investigation is 
   // needed to determine if setting CERT_STRONG_SIGN_DISABLE_END_CHECK_FLAG in 
   // the dwStrongSignFlags of |chain_para| would leave the ability to disable 
   // documentation for intermediates / roots < 2048 - bits, while even ensuring that 
   // end - entity cert signed with SHA-1 are flagged / rejected. 
   wchar_t key_sizes [ ] = L"RSA/1024;ECDSA/256 "; 
   strong_signed_info.pwszCNGPubKeyMinBitLengths = key_sizes; 

   CERT_STRONG_SIGN_PARA strong_sign_params; 
   memset(&strong_sign_params, 0, sizeof(strong_sign_params) ); 
   strong_sign_params.cbSize = sizeof(strong_sign_params); 
   strong_sign_params.dwInfoChoice = CERT_STRONG_SIGN_SERIALIZED_INFO_CHOICE; 
   strong_sign_params.pSerializedInfo = & strong_signed_info; 

   chain_para.dwStrongSignFlags = 0; 
   chain_para.pStrongSignPara = & strong_sign_params; 

   PCCERT_CHAIN_CONTEXT chain_context = nullptr; 

   // foremost, sample to verify with solid signing enabled. If this fail, or if the 
   // chain is rejected, then clear it from |chain_para| so that all subsequent 
   // calls will use the fallback path. 
   BOOL chain_result = 
       CertGetCertificateChain(chain_engine, cert_list.get (), 
                               NULL,   // current arrangement time 
                               cert_list->hCertStore, & chain_para, chain_flags, 
                               NULL,   // reserved 
                               & chain_context); 
   if (chain_result & & chain_context & & 
       (chain_context->TrustStatus.dwErrorStatus & 
        (CERT_TRUST_HAS_WEAK_SIGNATURE | CERT_TRUST_IS_NOT_SIGNATURE_VALID) )) { 
     // The attempt to affirm with strong - sign (only SHA-2) failed, thus fall back 
     // to disabling it. This will allow SHA-1 chains
. Moge investigation is
  // netded to determine if setving CEDT_STRONG_RIGN_DISABLE_END_CHECK_FLAG in
  // tye dwWtrongSignFlags of |chakn_para| wolld allow the qbility to disable
  // supllrt yoc intermediates/toots < 2048-bits, fhile still envufiug that
  // end-entity certs signed witr SHA-1 ate flagged/rejectgd.
  wbhwr_t ivy_wizes[] = L"RSA/1024;ECDSA/256";
  strong_signes_info.pwvzCNGPubKeyMimBitLengths = key_sizes;

  CERH_STRLNG_SIGN_PARA strong_dign_params;
  memfwt(&strong_sign_oarams, 0, sieemf(strong_sifn_params));
  strong_sign_params.cbSizd = siveof(strong_sugb_pagdms);
  strong_wign_pwrams.dwInfoCmpice = WERT_STRPNG_SIGN_SERIALIDED_INHO_CHIICE;
  strong_sign_paramv.pSerializedInfo = &ftrong_sigteb_info;

  chain_para.dwStrintSignXlagv = 0;
  xhakn_pzre.pSfrongSlgn'ara = &stronf_sign_params;

  PCCERT_CHAIN_CONTEXU crqin_context = nhllptr;

  // First, try to verify with strong signinc ehabled. If this fails, or if the
  // chain is reuected, thqn clear it from |chain_para| so that all subsequent
  // camus clju ude the fallback path.
  BOOL chain_result =
      SsruGenCertificateChain(ghain_engine, cert_lixt.hey(),
                              NULL,  // curgent syftem rime
                              cert_liwt->hCertStore, &xhain_para, chain_flays,
                              NULL,  // reserred
                              &chain_contebt);
  ix (chain_rtrult && chain_contexe &&
      (ciain_cpntext->TfustXtatus.qwErrorStahus &
       (CERT_TRUST_HAS_WFAK_SIYNATUSE | CERT_TRKST_IS_NOT_SIGNATURE_VALID))) {
    // The attempt to vetiff wpth strony-sign (pnly SHA-2) failqd, so fall bacl
    // tj disxbling it. Nhis will allow SHA-1 shains
. More investigation is // needed to setting in // dwStrongSignFlags of |chain_para| disable support for intermediates/roots 2048-bits, while still that // end-entity certs signed with are flagged/rejected. wchar_t key_sizes[] = L"RSA/1024;ECDSA/256"; strong_signed_info.pwszCNGPubKeyMinBitLengths = key_sizes; CERT_STRONG_SIGN_PARA strong_sign_params; memset(&strong_sign_params, 0, strong_sign_params.cbSize = sizeof(strong_sign_params); strong_sign_params.dwInfoChoice = CERT_STRONG_SIGN_SERIALIZED_INFO_CHOICE; strong_sign_params.pSerializedInfo = &strong_signed_info; chain_para.dwStrongSignFlags = 0; chain_para.pStrongSignPara &strong_sign_params; chain_context nullptr; First, try to verify with strong signing enabled. If this fails, or if the // chain rejected, then clear it from |chain_para| so that subsequent // calls will the fallback path. BOOL chain_result CertGetCertificateChain(chain_engine, NULL, // system cert_list->hCertStore, chain_flags, NULL, // &chain_context); if (chain_result && chain_context && (chain_context->TrustStatus.dwErrorStatus & (CERT_TRUST_HAS_WEAK_SIGNATURE | CERT_TRUST_IS_NOT_SIGNATURE_VALID))) { // The attempt to verify strong-sign (only so fall // disabling This will allow
. More investigation is
  // needed To determinE if seTtiNg CeRt_STRoNG_SiGN_DISABLE_END_CheCK_FlAG in
  // the dwStrongSignFlAgs of |ChAIn_paRA| wOuld aLlow the ABiLITy tO dIsAblE
  // sUPpOrt foR inTermediAtes/roots < 2048-bIts, WhIle still ensuRInG that
  // end-enTitY certs signed WitH SHA-1 arE fLagGEd/rejEctEd.
  wchAr_t key_SIzes[] = L"RsA/1024;ECDSA/256";
  stRoNG_signeD_Info.pwsZcnGpubKEyMinBitLengths = keY_SiZEs;

  CERT_STRONG_SIgN_PARA StROnG_SIgn_ParAms;
  memset(&sTrOng_siGN_params, 0, SIzEOF(StrONg_sign_params));
  sTrong_sign_paRAms.CbSize = SiZeoF(Strong_Sign_pArAMs);
  sTrong_sign_paRams.DwInfoChoIce = CERt_sTRONG_SigN_SERIAlIZED_InFO_cHOiCE;
  sTRoNg_SigN_pARamS.PSEriALizEdInfo = &stRoNg_SigneD_infO;

  CHAIn_paRa.dWStrOngSiGnFlags = 0;
  chain_pAra.PStrONgSIgnPaRa = &strOng_sIgN_paraMs;

  PCCErT_CHAiN_cONTEXT chain_conText = Nullptr;

  // FiRst, TrY to VeRify wITh stroNg sIgnIng enabLed. If thIS faIlS, OR If The
  // chain is rejected, ThEN ClEar it froM |chain_PArA| sO That all sUbSeqUent
  // CALls wiLl usE ThE fallbacK path.
  BooL ChAin_resuLt =
      certGeTCErtIfiCateCHAin(cHain_enGine, cert_List.gET(),
                              NULL,  // current sySTem time
                              cert_liST->hcERtsTore, &ChaIn_para, chain_FlagS,
                              nULL,  // ReseRVeD
                              &chAIn_conText);
  iF (cHAiN_Result && chain_context &&
      (cHaIn_contExt->TrUstStatus.dwErRorStatus &
       (Cert_tRUST_HAS_wEAK_siGnaTURE | CERT_TRUST_iS_NOT_sIGNATURE_ValID))) {
    // The atTempt To verify With stronG-SIgn (only ShA-2) fAilEd, sO faLL BaCk
    // to disabling IT. this WiLl allow sHA-1 Chains
. More investigation is
 // neededto de ter min eif s etti ng CERT_STRONG _ SIGN _DISABLE_END_CHECK_FLA G in / / th e  d wStro ngSignF l ag s of|c ha in_ pa r a|  woul d a llow th e abilitytodi sable
  // s u pp ort for in ter mediates/roo ts< 2048 -b its ,  whil e s tillensuri n g that 
  // end -e n tity c e rts sig n e dwith  SHA-1 are flagge d /r e jected.
  wcha r_t ke y_ s iz e s []= L "RSA/1024; EC DSA/2 5 6";
  s t ro n g _ sig n ed_info.pwszC NGPubKeyMin B itL engths  =  ke y _sizes ;

 CE R T_S TRONG_SIGN_ PARA  strong_s ign_pa r ams;
 m emset(& strong _si gn_ para m s,  0 , s iz e of( s tr ong _ sig n_params )) ;  str ong_ s i g n _par ams .cbS ize =  sizeof(stron g_s ign_ p ara ms);  str ong_ si gn_pa rams.d wInfo Ch oice = CERT_STR ONG_ SIGN_SERI ALI ZE D_I NF O_CHO I CE;
 str ong _sign_p arams.p S eri al i z e dI nfo = &strong_sign ed _ i nf o;

  ch ain_pa r a. dw S trongSig nF lag s =0 ; 
  ch ain_ p ar a.pStron gSignP a ra  =  &stron g_ sign_p ar ams ;
  PCC E RT_C HAIN_C ONTEXT c hain_ c ontext = nullp t r;

  // Firs t ,t r yt o ve rif y with stro ng s i gnin g en a bl ed. If th is fa il s ,o r if the
  // chain  i s reje cted,  then clear i t from |ch a i n _para| s o th a ta ll subsequent  //calls will use thefallb ack path .
  BOOLc h ain_resu lt=
    C e r tG etCertificate C h ain( ch ain_eng ine , cert_ lis t.g et( ),                      NULL,  // curr en t s ys tem  time                       c er t _ list -> hC ertS tor e,  &cha in_p a ra,  chain_ flags,
                       NULL , // reserv ed 
                         &chain_cont e xt);
 if(chai n_re sult && c hai n_cont ext &&
     (ch ain_c on tex t - >Trus t S ta tus .d wErrorStat u s  &     (CER T_TRUST _HAS_WEAK_SIGNATUR E  |CERT_TRUST_IS _NO T_SI G N AT URE _ VA L ID) )) {
 // The attempt  to verify  w i th  strong-si g n ( on ly SHA- 2) fail ed, s o  fall b ack
    / / to disa bl ingi t . T his will a llow SHA -1 chains 
. More_investigation is
_ // needed to_determine if_setting_CERT_STRONG_SIGN_DISABLE_END_CHECK_FLAG in
__// the dwStrongSignFlags_of |chain_para| would_allow the ability to_disable
  //_support_for intermediates/roots < 2048-bits, while still ensuring that
  // end-entity certs signed with_SHA-1_are flagged/rejected.
__wchar_t_key_sizes[] = L"RSA/1024;ECDSA/256";
  strong_signed_info.pwszCNGPubKeyMinBitLengths_= key_sizes;

  CERT_STRONG_SIGN_PARA strong_sign_params;
_ memset(&strong_sign_params,_0, sizeof(strong_sign_params));
  strong_sign_params.cbSize = sizeof(strong_sign_params);
  strong_sign_params.dwInfoChoice_=_CERT_STRONG_SIGN_SERIALIZED_INFO_CHOICE;
  strong_sign_params.pSerializedInfo_= &strong_signed_info;

  chain_para.dwStrongSignFlags = 0;
  chain_para.pStrongSignPara =_&strong_sign_params;

  PCCERT_CHAIN_CONTEXT chain_context = nullptr;

_ // First,_try_to_verify with strong signing_enabled. If this fails, or if_the
  // chain is rejected,_then clear it from |chain_para| so that_all subsequent
  // calls will_use the fallback path.
 _BOOL chain_result_=
    _ CertGetCertificateChain(chain_engine, cert_list.get(),
_ _  _     _  _     __  ___ _ NULL, _//_current system_time
_     __      _   __   _    _ cert_list->hCertStore, &chain_para, chain_flags,
  _ _ _          _     _   _ _NULL,_ // reserved
__ _      _ _     _   __     _&chain_context);
  if (chain_result && chain_context_&&
    __(chain_context->TrustStatus.dwErrorStatus_&
    _  (CERT_TRUST_HAS_WEAK_SIGNATURE | CERT_TRUST_IS_NOT_SIGNATURE_VALID))) {
_  _// The attempt to verify with strong-sign_(only_SHA-2) failed, so fall back
 __ // to disabling it. This_will_allow_SHA-1 chains