C

HTTPS Client Certificate using Smartcard or Token

See more HTTP Examples

Explains how to use a client certificate for HTTP TLS mutual authentication where the certificate and private key exists on an HSM (Smartcard or USB Token). C

#include <C_CkHttp.h>
#include <C_CkCert.h>

void ChilkatSample(void)
    {
    BOOL success;
    HCkHttp http;
    HCkCert cert;

    success = FALSE;

    http = CkHttp_Create();

    //  To do HTTPS mutual authentication where the certificate and private key are stored
    //  on a smartcard or token, first load the Chilkat certificate object from the smartcard/token,
    //  and then pass the certificate object to the Http object's SetSslClientCert method.

    //  Doing HTTP mutual authentication is the same regardless of the source of the cert + private key.
    //  The steps are to first load the certificate from the source, then pass the cert object to the HTTP object.
    //  Chilkat provides methods for loading the certificate from a variety of sources, such as smartcards, tokens,
    //  .pfx/.p12 files, Windows registry-based certificate stores, PEM files, or other file formats.
    cert = CkCert_Create();

    //  The easiest way to load a certificate from an HSM is to call cert.LoadFromSmartcard with 
    //  an empty string argument.  Chilkat will detect the HSM and will choose the most appropriate
    //  underlying means for accessing and loading the default certificate + key from the HSM.
    //  The underlying means could be PKCS11, ScMinidriver, or MSCNG, depending on the HSM what it
    //  supports.

    //  For example:
    //  If you know the smart card PIN, it's good to set it prior to loading from the smartcard/USB token.
    CkCert_putSmartCardPin(cert,"12345678");

    //  To let Chilkat discover what smartcard or token is connected, pass an empty string to LoadFromSmartcard.
    //  When testing in this way, it's best to have only a single smartcard or token connected to the system.
    success = CkCert_LoadFromSmartcard(cert,"");
    if (success == FALSE) {
        printf("%s\n",CkCert_lastErrorText(cert));
        printf("Certificate not loaded.\n");
        CkHttp_Dispose(http);
        CkCert_Dispose(cert);
        return;
    }

    //  If there are multiple certificates stored on the smartcard/token, then 
    //  you can be more specific.  See these examples:

    //  Load a Certificate from an HSM by Common Name
    //  Load a Certificate from an HSM by Serial Number

    //  It may be that you need to code at a lower level with a specific
    //  supported interface, such as PKCS11.
    //  See these examples:

    //  Use PKCS11 to Find a Specific Certificate
    //  Use PKCS11 to Find a Certificate with a Specified Key Usage

    //  Once you have the desired certificate, pass it to SetSslClientCert.
    //  Set the certificate to be used for mutual TLS authentication
    //  (i.e. sets the client-side certificate for two-way TLS authentication)
    success = CkHttp_SetSslClientCert(http,cert);
    if (success != TRUE) {
        printf("%s\n",CkHttp_lastErrorText(http));
        CkHttp_Dispose(http);
        CkCert_Dispose(cert);
        return;
    }

    //  At this point, the HTTP object instance is setup with the client-side cert, and any SSL/TLS
    //  connection will automatically use it if the server demands a client-side cert.


    CkHttp_Dispose(http);
    CkCert_Dispose(cert);

    }