function CertCreateCertificateChainEngine(
  pConfig: PCERT_CHAIN_ENGINE_CONFIG;
  var phChainEngine: HCERTCHAINENGINE
): BOOL; stdcall;

function CertGetCertificateChain(
  hChainEngine: HCERTCHAINENGINE;
  pCertContext: PCCERT_CONTEXT;
  pTime: LPFILETIME;
  hAdditionalStore: HCERTSTORE;
  pChainPara: PCERT_CHAIN_PARA;
  dwFlags: DWORD;
  pvReserved: LPVOID;
  ppChainContext: PPCCERT_CHAIN_CONTEXT  // указатель на указатель
): BOOL; stdcall;

function GetCertificateChain_Status(pCertContext: PCCERT_CONTEXT): Boolean;
var
  ChainConfig: CERT_CHAIN_ENGINE_CONFIG;
  phChainEngine: HCERTCHAINENGINE;

  pChainPara: PCERT_CHAIN_PARA;
  dwFlags: DWORD;
  ppChainContext: PCCERT_CHAIN_CONTEXT;
begin
  Result := False;

  ChainConfig.cbSize := sizeof(CERT_CHAIN_ENGINE_CONFIG);
  ChainConfig.hRestrictedRoot := nil;
  ChainConfig.hRestrictedTrust := nil;
  ChainConfig.hRestrictedOther := nil;
  ChainConfig.cAdditionalStore := 0;
  ChainConfig.rghAdditionalStore := nil;
  ChainConfig.dwFlags := CERT_CHAIN_CACHE_END_CERT;
  ChainConfig.dwUrlRetrievalTimeout := 0;
  ChainConfig.MaximumCachedCertificates := 0;
  ChainConfig.CycleDetectionModulus := 0;

  if not CertCreateCertificateChainEngine(@ChainConfig, phChainEngine) then
    EXIT;

  dwFlags := CERT_CHAIN_CACHE_END_CERT;

  if CertGetCertificateChain(    // <--- Здесь происходит AV
      phChainEngine,
      pCertContext,
      nil,
      nil,
      pChainPara,
      dwFlags,
      nil,
      nil //@ppChainContext
    )
  then
    EXIT;

  Result := ppChainContext^.TrustStatus.dwErrorStatus = CERT_TRUST_NO_ERROR;
end;

//----- Найти сертификат в хранилище 'MY' по SHA1 HASH ---------------
function Cert_FindCertificate_BySHA1(SHA1: PWideChar; aCertStore: Pointer): PCCERT_CONTEXT; stdcall;
var
  blob: CRYPT_HASH_BLOB;
begin
  blob.cbData := 20;
  blob.pbData := GetMemory(blob.cbData);
  HexToBin(PWideChar(SHA1), blob.pbData, blob.cbData);

  try
    Result := CertFindCertificateInStore(
      aCertStore,
      X509_ASN_ENCODING or PKCS_7_ASN_ENCODING,
      0,
      CERT_FIND_SHA1_HASH,
      @blob,
      nil
    );
  finally
    FreeMemory(blob.pbData);
  end;
end;

//----- Проверить цепочку сертификатов ---------------
function GetCertificateChain_Status(pCertContext: PCCERT_CONTEXT): Boolean;
var
  ChainConfig: CERT_CHAIN_ENGINE_CONFIG;
  phChainEngine: HCERTCHAINENGINE;

  vChainPara: CERT_CHAIN_PARA;
  dwFlags: DWORD;
  pChainContext: PCCERT_CHAIN_CONTEXT;
  flgChainCreated: Boolean;

  vCertStore: Pointer;
begin
  Result := False;
  pChainContext := nil;

  ChainConfig.cbSize := sizeof(CERT_CHAIN_ENGINE_CONFIG);
  ChainConfig.hRestrictedRoot := nil;
  ChainConfig.hRestrictedTrust := nil;
  ChainConfig.hRestrictedOther := nil;
  ChainConfig.cAdditionalStore := 0;
  ChainConfig.rghAdditionalStore := nil;
  ChainConfig.dwFlags := CERT_CHAIN_CACHE_END_CERT;
  ChainConfig.dwUrlRetrievalTimeout := 0;
  ChainConfig.MaximumCachedCertificates := 0;
  ChainConfig.CycleDetectionModulus := 0;

  vChainPara.cbSize := SizeOf(CERT_CHAIN_PARA);

  if not CertCreateCertificateChainEngine(@ChainConfig, phChainEngine) then
    EXIT;

  dwFlags := CERT_CHAIN_CACHE_END_CERT;

  flgChainCreated := CertGetCertificateChain(    // <--- Здесь происходит AV
    phChainEngine,
    pCertContext,
    nil,
    nil,
    @vChainPara,
    dwFlags,
    nil,
    @pChainContext
  );

  if flgChainCreated then
    Result := pChainContext^.TrustStatus.dwErrorStatus = CERT_TRUST_NO_ERROR;

  if pChainContext <> nil then
    CertFreeCertificateChain(pChainContext);

  CertFreeCertificateChainEngine(phChainEngine);
end;

//----- Проверим работу функции проверки цепочки сертификтов ---------------
procedure TfrmMain.Button1Click(Sender: TObject);
var
  vCertStore: Pointer;
  vCertContext: PCCERT_CONTEXT;
begin
  // откроем хранилище и найдем сертификат
  vCertStore := CertOpenSystemStore( 0, PChar( 'MY' ));
  vCertContext := Cert_FindCertificate_BySHA1(PWideChar( edtSHA1FingerPrint.Text ), vCertStore);

  Memo1.Lines.Append(''); // <-- если удалить эту строку, то проискходит AV в GetCertificateChain_Status()

  if GetCertificateChain_Status(vCertContext) then
    ShowMessage('Ok')
  else
    ShowMessage('ERROR !');

  CertFreeCertificateContext( vCertContext );
  CertCloseStore( vCertStore, CERT_CLOSE_STORE_CHECK_FLAG );
end;

unit JwaWinCrypt;
...
function CertFindCertificateInStore(
  hCertStore: HCERTSTORE;
  dwCertEncodingType, dwFindFlags, dwFindType: DWORD;
  pvFindPara: Pointer;
  pPrevCertContext: PCCERT_CONTEXT
): PCCERT_CONTEXT; stdcall;

function CertCreateCertificateChainEngine(
  pConfig: PCERT_CHAIN_ENGINE_CONFIG;
  var phChainEngine: HCERTCHAINENGINE
): BOOL; stdcall;

function CertGetCertificateChain(
  hChainEngine: HCERTCHAINENGINE;
  pCertContext: PCCERT_CONTEXT;
  pTime: LPFILETIME;
  hAdditionalStore: HCERTSTORE;
  pChainPara: PCERT_CHAIN_PARA;
  dwFlags: DWORD;
  pvReserved: LPVOID;
  ppChainContext: PPCCERT_CHAIN_CONTEXT
): BOOL; stdcall;

procedure CertFreeCertificateChain(pChainContext: PCCERT_CHAIN_CONTEXT); stdcall;

procedure CertFreeCertificateChainEngine(hChainEngine: HCERTCHAINENGINE); stdcall;

function CertOpenSystemStore(hProv: HCRYPTPROV; szSubsystemProtocol: LPCTSTR): HCERTSTORE; stdcall;

function CertFreeCertificateContext(pCertContext: PCCERT_CONTEXT): BOOL; stdcall;

function CertCloseStore(hCertStore: HCERTSTORE; dwFlags: DWORD): BOOL; stdcall;