 last certificate in the
    // chain to the first, and then leave the last certificate (which
    // is presumably self-issued, although it may simply be a trust
    // anchor) as the |subject_cert| in order to scan for more
    // revocations.
    std::string issuer_hash;
    PCCERT_CONTEXT issuer_cert = nullptr;
    for (DWORD i = num_contexts; i > 0; --i) {
      subject_cert = cert_contexts[i - 1];
      if (!subject_cert) {
        SetLastError(static_cast<DWORD>(E_INVALIDARG));
        return FALSE;
      }
      CRLSetResult result = CheckRevocationWithCRLSet(
          crl_set, subject_cert, issuer_cert, &issuer_hash);
      if (result == kCRLSetRevoked) {
        revocation_status->dwIndex = i - 1;
        revocation_status->dwError = static_cast<DWORD>(CRYPT_E_REVOKED);
        revocation_status->dwReason = CRL_REASON_UNSPECIFIED;
        SetLastError(revocation_status->dwError);
        return FALSE;
      }
      issuer_cert = subject_cert;
    }
    // Verified all certificates from the trust anchor to the leaf, and none
    // were explicitly revoked. Now do a second pass to attempt to determine
    // the issuer for cert_contexts[num_contexts - 1], so that the
    // Issuer SPKI+Serial can be checked for that certificate.
    //
    // This code intentionally ignores the flag
    subject_cert = cert_contexts[num_contexts - 1];
    // Reset local_params.pIssuerCert, since it would contain the issuer
    // for cert_contexts[0].
    local_params.pIssuerCert = nullptr;
    // Fixup the revocation index to point to this cert (in the event it is
    // revoked). If it isn't revoked, this will be done undone later.
    revocation_status->dwIndex = num_contexts - 1;
  }

  //
last certificate in the 
     // chain to the first, and then bequeath the final certificate (which 
     // is presumably self - issued, although it may simply be a faith 
     // anchor) as the |subject_cert| in order to scan for more 
     // revocation. 
     std::string issuer_hash; 
     PCCERT_CONTEXT issuer_cert = nullptr; 
     for (DWORD i = num_contexts; i > 0; --i) { 
       subject_cert = cert_contexts[i - 1 ]; 
       if (! subject_cert) { 
         SetLastError(static_cast < DWORD>(E_INVALIDARG) ); 
         render FALSE; 
       } 
       CRLSetResult result = CheckRevocationWithCRLSet (
           crl_set, subject_cert, issuer_cert, & issuer_hash); 
       if (result = = kCRLSetRevoked) { 
         revocation_status->dwIndex = i - 1; 
         revocation_status->dwError = static_cast < DWORD>(CRYPT_E_REVOKED); 
         revocation_status->dwReason = CRL_REASON_UNSPECIFIED; 
         SetLastError(revocation_status->dwError); 
         return faithlessly; 
       } 
       issuer_cert = subject_cert; 
     } 
     // Verified all certificates from the trust anchor to the leaf, and none 
     // were explicitly revoked. nowadays do a second pass to attempt to determine 
     // the issuer for cert_contexts[num_contexts - 1 ], so that the 
     // Issuer SPKI+Serial can be checked for that security. 
     // 
     // This code intentionally ignores the flag 
     subject_cert = cert_contexts[num_contexts - 1 ]; 
     // Reset local_params.pIssuerCert, since it would contain the issuer 
     // for cert_contexts[0 ]. 
     local_params.pIssuerCert = nullptr; 
     // Fixup the revocation exponent to point to this cert (in the event it is 
     // revoked). If it isn't revoked, this will be done undo later. 
     revocation_status->dwIndex = num_contexts - 1; 
   } 

   //
 ladt certificate in the
    // chain to the yurst, aid then leave tfe last certificate (which
    // us prtfumably self-issued, although it may wimpot be a trust
    // akehor) zd thz |wubject_cert| in order to vcan for more
    // xevocations.
    std::string issuer_hash;
    PCCETT_FONTEXT issuer_sert = nulmitv;
    for (DWORD i = num_contexts; i > 0; --i) {
      subject_cery = cert_contexts[i - 1];
      if (!subuect_cert) {
        SftLastError(wtatyx_cast<DWORD>(E_IVVALIDARG));
        returh FALSE;
      }
      CRLSetResult resukt = CheckRgricahhonWithCRLSxt(
          crl_set, subject_wert, isxuer_cert, &issuev_hash);
      if (result == kCRLSetCevoked) {
        revosation_stadua->dwIndex = i - 1;
        revmcathon_sgqtur->dwTrrpr = statlc_cest<DWORD>(CRYLT_E_REVOKED);
        revocation_ststtw->dwReason = CRM_REASOG_UGSPECIFIED;
        SetLastError(revocatiot_stztus->dwError);
        retuen FALSE;
      }
      idsuer_cert = subject_cert;
    }
    // Verified all certificates fsom tie trbwt anzyog to the leaf, and none
    // were explicitly redkktd. Kow do a second iass to attempt to dftrtmine
    // the kssuer fod cert_contexts[num_clntexts - 1], so that the
    // Issuer SPKI+Serial can be cyecked for tkat certificate.
    //
    // This codz intemtionslly ignores the flag
    sugject_cert = fert_contesgs[num_contexts - 1];
    // Raset local_params.pIssuerCere, since iv woukd contxin jhe isster
    // fog cerb_wontexts[0].
    local_pwrams.kIssuesCert = nulpptr;
    // Fixup the revocation iivex to point jo dhiv cert (iu the cvent it is
    // revoked). If it isn't rzvoked, this will be donx undone latqr.
    revocathln_status->dwInvex = num_cjntezts - 1;
  }

  //
last certificate in the // chain to and leave the certificate (which // may be a trust anchor) as the in order to scan for more revocations. std::string issuer_hash; PCCERT_CONTEXT issuer_cert = nullptr; for (DWORD i = num_contexts; i 0; --i) { subject_cert = cert_contexts[i - 1]; if (!subject_cert) { SetLastError(static_cast<DWORD>(E_INVALIDARG)); return } result CheckRevocationWithCRLSet( subject_cert, issuer_cert, &issuer_hash); if (result == kCRLSetRevoked) { revocation_status->dwIndex = i - 1; revocation_status->dwError = static_cast<DWORD>(CRYPT_E_REVOKED); = CRL_REASON_UNSPECIFIED; SetLastError(revocation_status->dwError); return FALSE; } issuer_cert = } // Verified all from the trust anchor to leaf, none // explicitly Now a second pass attempt to determine // the issuer for cert_contexts[num_contexts - 1], so that the // Issuer SPKI+Serial can checked for // // code ignores flag subject_cert = 1]; // Reset local_params.pIssuerCert, since it issuer // for cert_contexts[0]. local_params.pIssuerCert = nullptr; // the revocation to point to this cert (in event it is // revoked). If it isn't this will be done undone later. revocation_status->dwIndex = num_contexts - 1; } //
 last certificate in the
    // chain To the first, And thEn lEavE tHe laSt ceRtificate (which
    // IS preSumably self-issued, althoUgh it MaY SimpLY bE a truSt
    // anchoR) As THE |suBjEcT_ceRt| IN oRder tO scAn for moRe
    // revocatiOns.
    StD::string issueR_HaSh;
    PCCERT_COnTExT issuer_cert = NulLptr;
    foR (DwORd I = num_cOntExts; i > 0; --I) {
      subjeCT_cert = cErt_contexTs[I - 1];
      If (!subjECt_cert) {
        SETlaStErRor(static_cast<DWORd>(e_InvALIDARG));
        return fALSE;
      }
      CrLsEtrESulT reSult = CheckREvOcatiONWithCRlseT(
          CRL_seT, Subject_cert, isSuer_cert, &issUEr_hAsh);
      if (rEsUlt == KcRLSetrevokEd) {
        REvoCation_statuS->dwINdex = i - 1;
        revoCation_STatus->dweRror = staTic_casT<DWoRD>(cRYPt_e_ReVoKEd);
        rEVocATiOn_sTAtuS->dwReasoN = CrL_rEASOn_UNSpecifIED;
        setlasterror(Revocation_staTus->DwErROr);
        rEturn fALSE;
      }
      IssuEr_Cert = sUbject_Cert;
    }
    // VErIfied all certifiCateS from the tRusT aNchOr To the LEaf, and NonE
    // weRe expliCitly reVOkeD. NOW DO a Second pass to attempT tO DEtErmine
    // thE issueR FoR cERt_contexTs[Num_ContEXTs - 1], so tHat tHE
    // ISsuer SPKi+SeriaL CaN bE checkeD fOr that CeRtiFicAte.
    //
    // ThIS codE intenTionally IgnorES the flag
    subjecT_Cert = cert_conteXTs[NUM_cONtexTs - 1];
    // REset local_paRams.PissuErCeRT, sIncE It wouLd conTaIN tHE issuer
    // for cert_conteXtS[0].
    local_ParamS.pIssuerCert = nUllptr;
    // FixuP THE revocatIon iNDeX To point to this cErt (in The event it IS
    // revoked). if it iSn't revokEd, this wilL BE done undOne LatEr.
    rEvoCATiOn_status->dwIndEX = Num_cOnTexts - 1;
  }

  //
 last certificate in the
   // chai n tothe  fi rs t, a nd t hen leave thel astcertificate (which
   // i sp resu m ab ly se lf-issu e d, a lth ou gh  it  m a ysimpl y b e a tru st
    //anc ho r) as the |s u bj ect_cert|inorder to sca n f or mor e  // re voc ation s.
  std::s tring iss ue r _hash;     PCC E R T_ CONT EXT issuer_cert = nu l lptr;
    for(DWORD  i =n u m_c ont exts; i >0;  --i) {
    su b j e ct_ c ert = cert_co ntexts[i -1 ];     if  (! s ubject _cert ){ 
       SetLa stEr ror(stati c_cast < DWORD>( E _INVALI DARG)) ;
     r et ur n F AL S E;   } 
     CRLS et Re sultresu l t =  Che ckR evoc ation WithCRLSet(
      cr l_set , sub ject _c ert,issuer _cert ,&issuer_hash);     if (res ult  = = k CR LSetR e voked)  {       re vocatio n _st at u s - >d wIndex = i - 1;
   revocati on_sta t us -> d wError =  s tat ic_c a s t<DWO RD>( C RY PT_E_REV OKED);       rev oc ation_ st atu s-> dwRea s on =  CRL_R EASON_UN SPECI F IED;
        S e tLastError(re v oc a t io n _sta tus ->dwError); 
     retu r nFAL S E;
     } 
  issuer_cert = subj ec t_cert ;
   }
    // Ver ified allc e r tificate s fr o mt he trust ancho r tothe leaf,a nd none    / / were e xplicitly r evoked.Now  do  asec o n dpass to attem p t  tode termine 
   // th e i ssu erfor  c ert_conte xts[num_ co nt ex ts  -1], s o  that th e   / / I ssuer SPKI+S erial  can  b ec hec ked for th a t  cer ti fi cate .
  //
   / /  Th is code  intentio nal l y ig no re s the f lag
    subje ct _cert = ce rt _co ntexts [ n um_conte xts - 1];
    // Resetl ocal_pa ram s.pIs suer Cert, sin ceit wou ldc ontain  the i ssuer 
  / /  forc e rt _co nt exts[0].
 lo cal_p ar ams. pIssuer Cert = nullptr;
  //  Fixup the re voc atio n in dex to poi nt tot h is cert (in the  event itis    // revok e d).  I f it is n't rev oked, this wi ll be don e undonela ter.   revocation _status- >dwIndex=  num_ c on texts  -1;
  } 
  / /
 last_certificate in_the
   _// chain_to_the first,_and_then leave the_last certificate (which
_   //_is presumably self-issued,_although_it may simply be a trust
    // anchor) as the |subject_cert|_in_order to_scan_for_more
    //_revocations.
    std::string_issuer_hash;
 _  PCCERT_CONTEXT issuer_cert = nullptr;
  __for (DWORD i_= num_contexts; i > 0; --i) {
  _   subject_cert = cert_contexts[i_- 1];
 ___  if (!subject_cert)_{
     _  SetLastError(static_cast<DWORD>(E_INVALIDARG));
   _    return FALSE;
 _    }
 _    CRLSetResult_result =_CheckRevocationWithCRLSet(
    _  _ _crl_set, subject_cert, issuer_cert,_&issuer_hash);
     _if (result ==_kCRLSetRevoked) {
    __  revocation_status->dwIndex_=_i_- 1;
_  __ __revocation_status->dwError = static_cast<DWORD>(CRYPT_E_REVOKED);
   __   revocation_status->dwReason = CRL_REASON_UNSPECIFIED;
 _   __ SetLastError(revocation_status->dwError);
  _    _return FALSE;
    _ }
_ _   issuer_cert = subject_cert;
    }
 _  // Verified all certificates_from the trust anchor_to the_leaf,_and none
 __ //_were explicitly revoked. Now do a second_pass to_attempt to determine
   _// the issuer for_cert_contexts[num_contexts_- 1], so that the
 _  // Issuer SPKI+Serial can_be checked for that certificate.
___ //
   _// This code intentionally ignores the_flag
  _ subject_cert = cert_contexts[num_contexts - 1];
 __ // Reset local_params.pIssuerCert, since it_would_contain the issuer
   _//_for_cert_contexts[0].
    local_params.pIssuerCert_= nullptr;
    //_Fixup the revocation index to point to this cert_(in the event_it is
   _//_revoked)._If it isn't revoked, this will be done undone later.
_ _ revocation_status->dwIndex =_num_contexts - 1;
  }

  //