Lua

Trust Specific Root CA Certificates

See more Certificates Examples

Demonstrates how to trust specific root CA certificates and none others. Lua

local chilkat = require("chilkat")

-- This example assumes the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

-- This example will trust the Amazon root CA certificates provided at
-- https://www.amazontrust.com/repository/

-- I've previously downloaded the root CA certificates to DER format.
-- Add each to the Chilkat TrustedRoots singleton object.

local tRoots = chilkat.TrustedRoots.new()

local caCert = chilkat.Cert.new()
local success = caCert:load_from_file("qa_data/certs/aws_root_ca/AmazonRootCA1.cer")
if not success then
    print(caCert.last_error_text)
    return
end

success = tRoots:add_cert(caCert)

-- Continue with the others.
-- For brevity, we're not checking return values for success/failure.
success = caCert:load_from_file("qa_data/certs/aws_root_ca/AmazonRootCA2.cer")
success = tRoots:add_cert(caCert)

success = caCert:load_from_file("qa_data/certs/aws_root_ca/AmazonRootCA3.cer")
success = tRoots:add_cert(caCert)

success = caCert:load_from_file("qa_data/certs/aws_root_ca/AmazonRootCA4.cer")
success = tRoots:add_cert(caCert)

success = caCert:load_from_file("qa_data/certs/aws_root_ca/SFSRootCAG2.cer")
success = tRoots:add_cert(caCert)

-- Indicate we don't want to automatically trust the operating system's installed root CA certificates.
-- On a Windows operating system, this would be the registry-based CA certificate stores.
-- On a Linux system, this could be /etc/ssl/certs/ca-certificates.crt, if it exists.
tRoots.trust_system_ca_roots = false

-- Activate the trusted roots object.
-- Once activated, all Chilkat objects that use TLS connections (HTTP, REST, Socket, MailMan, IMAP, FTP, etc.)
-- will fail the TLS handshake if the server certificate is not verified and rooted with one of our explicitly trusted root certificates.
success = tRoots:activate()

local http = chilkat.Http.new()

-- Note: We also need to explicitly indicate that server certificates are to be verified.
http.require_ssl_cert_verify = true

-- For example, the following should fail because www.chilkatsoft.com's server certificate is not rooted in one of the explicitly trusted root CA certs.
success = http:download("https://www.chilkatsoft.com/helloWorld.txt", "qa_output/helloWorld.txt")
if not success then
    -- The above Download should fail.
    print(http.last_error_text)

    -- There should be a message in the LastErrorText indicating that we were "Unable to build certificate chain to root.."
end

-- However, we should be able to make TLS connections to good.sca1a.amazontrust.com
success = http:download("https://good.sca1a.amazontrust.com/", "qa_output/valid.html")
if not success then
    print(http.last_error_text)
    return
end

-- We can still examine the LastErrorText and we'll find this message within:
-- "The public key was successfully validated against the public key of the explicitly trusted root cert."
print(http.last_error_text)

print("Success!")