Delphi DLL

HTTPS Server Certificate Require Hostname Match

See more HTTP Examples

Demonstrates and explains the RequireHostnameMatch property. Delphi DLL

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Http;

...

procedure TForm1.Button1Click(Sender: TObject);
var
http: HCkHttp;
html: PWideChar;

begin
// The RequireHostnameMatch property was added in Chilkat v11.0.0
// to ensure the URL's hostname matches at least one of the server certificate SAN's (Subject Alternative Names)
// 
// In actuality, it is the SNI hostname that must match.  If the SNI hostname is not explicitly set,
// then Chilkat uses the hostname from the URL as the SNI hostname.

// Here's an example using chilkatsoft.com
// The SSL server certificate for chilkatsoft.com has 2 Subject Alternative Names:
// 
// 1) DNS Name: *.chilkatsoft.com
// 2) DNS Name: chilkatsoft.com
// 
// See Explaining the SNI Hostname in TLS

http := CkHttp_Create();

CkHttp_putRequireHostnameMatch(http,True);

// This should succeed because "www.chilkatsoft.com" matches the SAN entry "*.chilkatsoft.com"
html := CkHttp__quickGetStr(http,'https://www.chilkatsoft.com/helloWorld.html');
Memo1.Lines.Add('1) Succeeded: ' + IntToStr(Ord(CkHttp_getLastMethodSuccess(http))));

// At the time of writing this example, the IP address for chilkatsoft.com is 3.101.18.47
// If we send the request using the IP address, it will fail because the IP address is does 
// not match any of the SAN entries in the server certificate.
html := CkHttp__quickGetStr(http,'https://3.101.18.47/helloWorld.html');
Memo1.Lines.Add('2) Succeeded: ' + IntToStr(Ord(CkHttp_getLastMethodSuccess(http))));

// However, it will succeed if we explicitly set the SNI hostname.
CkHttp_putSniHostname(http,'www.chilkatsoft.com');
html := CkHttp__quickGetStr(http,'https://3.101.18.47/helloWorld.html');
Memo1.Lines.Add('3) Succeeded: ' + IntToStr(Ord(CkHttp_getLastMethodSuccess(http))));

// Remove our explicit SNI hostname.
CkHttp_putSniHostname(http,'');

// Now let's try wrong.host.badssl.com
// The SSL server certificate for badssl.com has 2 Subject Alternative Names:
// 
// 1) DNS Name: *.badssl.com
// 2) DNS Name: badssl.com

// The domain wrong.host.badssl.com will fail the RequireHostnameMatch because
// the wildcarded domain SAN entry only extends 1 level deep.  
html := CkHttp__quickGetStr(http,'https://wrong.host.badssl.com/');
Memo1.Lines.Add('4) Succeeded: ' + IntToStr(Ord(CkHttp_getLastMethodSuccess(http))));

// The expected output is:
// 1) Succeeded: True
// 2) Succeeded: False
// 3) Succeeded: True
// 4) Succeeded: False

CkHttp_Dispose(http);

end;