Java

Trust Specific Root CA Certificates

See more Certificates Examples

Demonstrates how to trust specific root CA certificates and none others. Chilkat2 Java

import com.chilkatsoft.chilkat2.Cert;
import com.chilkatsoft.chilkat2.ChilkatException;
import com.chilkatsoft.chilkat2.Http;
import com.chilkatsoft.chilkat2.TrustedRoots;

public class ChilkatExample {

    public static void main(String[] args) {
        // This example assumes the Chilkat API to have been previously unlocked.
        // See Global Unlock Sample for sample code.

        // This example will trust the Amazon root CA certificates provided at
        // https://www.amazontrust.com/repository/

        // I've previously downloaded the root CA certificates to DER format.
        // Add each to the Chilkat TrustedRoots singleton object.

        TrustedRoots tRoots = new TrustedRoots();

        Cert caCert = new Cert();
        try {
            caCert.loadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA1.cer");
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        tRoots.addCert(caCert);

        // Continue with the others.
        // For brevity, we're not checking return values for success/failure.
        caCert.loadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA2.cer");
        tRoots.addCert(caCert);

        caCert.loadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA3.cer");
        tRoots.addCert(caCert);

        caCert.loadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA4.cer");
        tRoots.addCert(caCert);

        caCert.loadFromFile("qa_data/certs/aws_root_ca/SFSRootCAG2.cer");
        tRoots.addCert(caCert);

        // Indicate we don't want to automatically trust the operating system's installed root CA certificates.
        // On a Windows operating system, this would be the registry-based CA certificate stores.
        // On a Linux system, this could be /etc/ssl/certs/ca-certificates.crt, if it exists.
        tRoots.setTrustSystemCaRoots(false);

        // Activate the trusted roots object.
        // Once activated, all Chilkat objects that use TLS connections (HTTP, REST, Socket, MailMan, IMAP, FTP, etc.)
        // will fail the TLS handshake if the server certificate is not verified and rooted with one of our explicitly trusted root certificates.
        tRoots.activate();

        Http http = new Http();

        // Note: We also need to explicitly indicate that server certificates are to be verified.
        http.setRequireSslCertVerify(true);

        // For example, the following should fail because www.chilkatsoft.com's server certificate is not rooted in one of the explicitly trusted root CA certs.
        try {
            http.download("https://www.chilkatsoft.com/helloWorld.txt", "qa_output/helloWorld.txt");
        } catch (ChilkatException e) {
            // The above Download should fail.
            System.out.println(e.getLastErrorText());

            // There should be a message in the LastErrorText indicating that we were "Unable to build certificate chain to root.."
        }

        // However, we should be able to make TLS connections to good.sca1a.amazontrust.com
        try {
            http.download("https://good.sca1a.amazontrust.com/", "qa_output/valid.html");
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        // We can still examine the LastErrorText and we'll find this message within:
        // "The public key was successfully validated against the public key of the explicitly trusted root cert."
        System.out.println(http.getLastErrorText());

        System.out.println("Success!");
    }
}