Lua

HTTP - Verify Server is a Trusted Root CA

See more HTTP Examples

Demonstrates how to only allow connections to an HTTP server having a certificate with a root that is in our list of trusted CA root certificates. Lua

local chilkat = require("chilkat")

-- This example assumes the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

local success = false

--  On my particular system, the root CA cert for this URL is not pre-installed.
--  Note: This may be different for you.
--  Also, this example was written on 29-May-2015.  This URL was valid at the time,
--  but may not be valid at a future date.
local url = "https://animals.nationalgeographic.com/animals/invertebrates/starfish/"

local http = chilkat.Http.new()

--  Require that the SSL/TLS server certificate is not expired,
--  and that the certificate signature is valid.
--  This does not ensure that it has a chain of authentication to
--  a trusted root.  To ensure that, the TrustedRoots object (below) is required.
http.require_ssl_cert_verify = true

--  Do the HTTPS page fetch (through the SSH tunnel)
local html = http:quick_get_str(url)
if not http.last_method_success then
    print(http.last_error_text)
    return
end

print("The HTTP GET was successful.")

--  Now let's require that HTTP requests to SSL/TLS servers that don't have trusted CA roots
--  should fail.
local trustedRoots = chilkat.TrustedRoots.new()

--  Indicate that we will trust any pre-installed certificates on this system.
--  (The meaning of pre-installed certificates depends on the operating system, and in
--  some environments there is no such thing as pre-installed certificates.  See the reference
--  documentation for the TrustedRoots class.)
trustedRoots.trust_system_ca_roots = true

--  Activate the trusted roots globally for all Chilkat objects.
--  This call really shouldn't fail, so we're not checking the return value.
success = trustedRoots:activate()

--  Given that our previous HTTP GET likely kept the connection open,
--  make sure that all HTTP connections are closed before re-trying.
--  Otherwise, we'll simply be re-using the pre-existing connection.
success = http:close_all_connections()

--  Now let's try fetching the URL again.  It should fail this time because
--  there is a requirement that the SSL/TLS server certificate must have a trusted root,
--  and the trusted root for this URL is not installed on my system (but may be different for you..)
html = http:quick_get_str(url)
if not http.last_method_success then
    print(http.last_error_text)
    print("Good, the HTTP request failed as expected.")
else
    print(http.last_error_text)
    print("Hmmm... we did not fail as expected?")
end