(SQL Server) Accept TLS Connection with Client Authentication

Demonstrates how to accept a TLS connection requiring client authentication. This is the case where the TLS client sends a certificate. It is also known as "Two-Way SSL".

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @iTmp0 int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    -- This example requires the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    DECLARE @listenSslSocket int
    -- Use "Chilkat_9_5_0.Socket" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Socket', @listenSslSocket OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    -- An SSL/TLS server needs a digital certificate.  This example loads it from a PFX file.
    -- Note: This is the server's certificate.

    DECLARE @cert int
    -- Use "Chilkat_9_5_0.Cert" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert OUT

    -- The 1st argument is the file path, the 2nd arg is the 
    -- PFX file's password:
    DECLARE @success int
    EXEC sp_OAMethod @cert, 'LoadPfxFile', @success OUT, 'chilkat.pfx', 'test'
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @listenSslSocket
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    -- To accept client client certificates in the TLS handshake,
    -- we must indicate a list of acceptable client certificate root CA DN's
    -- that are allowed.  (DN is an acronym for Distinguished Name.)
    -- Call AddSslAcceptableClientCaDn once for each acceptable CA DN.
    -- Here are a few examples so you can see the general format of a DN.
    EXEC sp_OAMethod @listenSslSocket, 'AddSslAcceptableClientCaDn', @success OUT, 'C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root'
    EXEC sp_OAMethod @listenSslSocket, 'AddSslAcceptableClientCaDn', @success OUT, 'O=Digital Signature Trust Co., CN=DST Root CA X3'

    -- Use the certificate:
    EXEC sp_OAMethod @listenSslSocket, 'InitSslServer', @success OUT, @cert
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @listenSslSocket, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @listenSslSocket
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    -- Bind and listen on a port:
    DECLARE @myPort int
    SELECT @myPort = 8123
    -- Allow for a max of 5 queued connect requests.
    DECLARE @backLog int
    SELECT @backLog = 5
    EXEC sp_OAMethod @listenSslSocket, 'BindAndListen', @success OUT, @myPort, @backLog
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @listenSslSocket, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @listenSslSocket
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    -- If accepting an SSL/TLS connection, the SSL handshake is part of the connection
    -- establishment process. This involves a few back-and-forth messages between the 
    -- client and server to establish algorithms and a shared key to create the secure 
    -- channel. The sending and receiving of these messages are governed by the 
    -- MaxReadIdleMs and MaxSendIdleMs properties. If these properties are set to 0 
    -- (and this is the default unless changed by your application), then the 
    -- AcceptNextConnection can hang indefinitely during the SSL handshake process. 
    -- Make sure these properties are set to appropriate values before calling AcceptNextConnection.

    -- Set a 10 second max for waiting to read/write.  This is for the SSL/TLS handshake establishment.
    EXEC sp_OASetProperty @listenSslSocket, 'MaxReadIdleMs', 10000
    EXEC sp_OASetProperty @listenSslSocket, 'MaxSendIdleMs', 10000

    -- Accept a single client connection and establish the secure SSL/TLS channel:
    DECLARE @clientSock int

    DECLARE @maxWaitMillisec int
    SELECT @maxWaitMillisec = 20000
    EXEC sp_OAMethod @listenSslSocket, 'AcceptNextConnection', @clientSock OUT, @maxWaitMillisec
    EXEC sp_OAGetProperty @listenSslSocket, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 = 0
      BEGIN
        EXEC sp_OAGetProperty @listenSslSocket, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @listenSslSocket
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    -- The client (in this example) is going to send a "Hello Server! -EOM-" 
    -- message.  Read it:
    DECLARE @receivedMsg nvarchar(4000)
    EXEC sp_OAMethod @clientSock, 'ReceiveUntilMatch', @receivedMsg OUT, '-EOM-'
    EXEC sp_OAGetProperty @clientSock, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 <> 1
      BEGIN
        EXEC sp_OAGetProperty @clientSock, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @listenSslSocket
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END


    PRINT @receivedMsg

    -- Send a "Hello Client! -EOM-" message:
    EXEC sp_OAMethod @clientSock, 'SendString', @success OUT, 'Hello Client! -EOM-'
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @clientSock, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @listenSslSocket
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    -- Close the connection with the client
    -- Wait a max of 20 seconds (20000 millsec)
    EXEC sp_OAMethod @clientSock, 'Close', @success OUT, 20000

    EXEC @hr = sp_OADestroy @clientSock


    EXEC @hr = sp_OADestroy @listenSslSocket
    EXEC @hr = sp_OADestroy @cert


END
GO