(SQL Server) Examine Client Certificates for an Accepted TLS Connection

Demonstrates how to access the client certificates for a TLS connection accepted by your application acting as the server.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @iTmp0 int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    -- This example requires the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    DECLARE @listenSslSocket int
    -- Use "Chilkat_9_5_0.Socket" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Socket', @listenSslSocket OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    -- An SSL/TLS server needs a digital certificate.  This example loads it from a PFX file.
    -- This is the server's certificate.

    DECLARE @cert int
    -- Use "Chilkat_9_5_0.Cert" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert OUT

    DECLARE @success int
    EXEC sp_OAMethod @cert, 'LoadPfxFile', @success OUT, 'qa_data/serverCert/myServerCert.pfx', 'pfx_password'
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @listenSslSocket
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    -- To accept client client certificates in the TLS handshake,
    -- we must indicate a list of acceptable client certificate root CA DN's
    -- that are allowed.  (DN is an acronym for Distinguished Name.)
    -- Call AddSslAcceptableClientCaDn once for each acceptable CA DN.
    -- Here are a few examples so you can see the general format of a DN.
    EXEC sp_OAMethod @listenSslSocket, 'AddSslAcceptableClientCaDn', @success OUT, 'C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root'
    EXEC sp_OAMethod @listenSslSocket, 'AddSslAcceptableClientCaDn', @success OUT, 'O=Digital Signature Trust Co., CN=DST Root CA X3'

    -- Initialize with our server's TLS certificate.
    EXEC sp_OAMethod @listenSslSocket, 'InitSslServer', @success OUT, @cert
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @listenSslSocket, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @listenSslSocket
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    -- Bind and listen on a port:
    DECLARE @myPort int
    SELECT @myPort = 8123
    -- Allow for a max of 5 queued connect requests.
    DECLARE @backLog int
    SELECT @backLog = 5
    EXEC sp_OAMethod @listenSslSocket, 'BindAndListen', @success OUT, @myPort, @backLog
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @listenSslSocket, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @listenSslSocket
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    -- Accept the next incoming connection.
    DECLARE @maxWaitMillisec int
    SELECT @maxWaitMillisec = 20000
    DECLARE @clientSock int
    EXEC sp_OAMethod @listenSslSocket, 'AcceptNextConnection', @clientSock OUT, @maxWaitMillisec
    EXEC sp_OAGetProperty @listenSslSocket, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 = 0
      BEGIN
        EXEC sp_OAGetProperty @listenSslSocket, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @listenSslSocket
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    -- Examine the client certs chain.  The 1st cert will be the client certificate, and
    -- the subsequent certs will be the certs in the chain of authentication.
    DECLARE @numClientCerts int
    EXEC sp_OAGetProperty @clientSock, 'NumReceivedClientCerts', @numClientCerts OUT

    PRINT 'numClientCerts = ' + @numClientCerts

    DECLARE @i int
    SELECT @i = 0
    WHILE @i < @numClientCerts
      BEGIN
        DECLARE @clientCert int
        EXEC sp_OAMethod @clientSock, 'GetReceivedClientCert', @clientCert OUT, @i
        EXEC sp_OAGetProperty @clientCert, 'SubjectDN', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @clientCert

        SELECT @i = @i + 1
      END

    -- Close the connection with the client
    EXEC sp_OAMethod @clientSock, 'Close', @success OUT, 1000

    EXEC @hr = sp_OADestroy @clientSock


    EXEC @hr = sp_OADestroy @listenSslSocket
    EXEC @hr = sp_OADestroy @cert


END
GO