(C) Trust Specific Root CA Certificates

Demonstrates how to trust specific root CA certificates and none others.

Chilkat C/C++ Library Downloads
MS Visual C/C++ C++ Builder Linux C/C++ Alpine Linux C/C++	MacOS C/C++ iOS C/C++ Android C/C++ MinGW C/C++

#include <C_CkTrustedRoots.h>
#include <C_CkCert.h>
#include <C_CkHttp.h>

void ChilkatSample(void)
    {
    HCkTrustedRoots tRoots;
    HCkCert caCert;
    BOOL success;
    HCkHttp http;

    // This example assumes the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // This example will trust the Amazon root CA certificates provided at 
    // https://www.amazontrust.com/repository/

    // I've previously downloaded the root CA certificates to DER format.
    // Add each to the Chilkat TrustedRoots singleton object.

    tRoots = CkTrustedRoots_Create();

    caCert = CkCert_Create();
    success = CkCert_LoadFromFile(caCert,"qa_data/certs/aws_root_ca/AmazonRootCA1.cer");
    if (success == FALSE) {
        printf("%s\n",CkCert_lastErrorText(caCert));
        CkTrustedRoots_Dispose(tRoots);
        CkCert_Dispose(caCert);
        return;
    }

    success = CkTrustedRoots_AddCert(tRoots,caCert);

    // Continue with the others.
    // For brevity, we're not checking return values for success/failure.
    success = CkCert_LoadFromFile(caCert,"qa_data/certs/aws_root_ca/AmazonRootCA2.cer");
    success = CkTrustedRoots_AddCert(tRoots,caCert);

    success = CkCert_LoadFromFile(caCert,"qa_data/certs/aws_root_ca/AmazonRootCA3.cer");
    success = CkTrustedRoots_AddCert(tRoots,caCert);

    success = CkCert_LoadFromFile(caCert,"qa_data/certs/aws_root_ca/AmazonRootCA4.cer");
    success = CkTrustedRoots_AddCert(tRoots,caCert);

    success = CkCert_LoadFromFile(caCert,"qa_data/certs/aws_root_ca/SFSRootCAG2.cer");
    success = CkTrustedRoots_AddCert(tRoots,caCert);

    // Indicate we don't want to automatically trust the operating system's installed root CA certificates.
    // On a Windows operating system, this would be the registry-based CA certificate stores. 
    // On a Linux system, this could be /etc/ssl/certs/ca-certificates.crt, if it exists.
    CkTrustedRoots_putTrustSystemCaRoots(tRoots,FALSE);

    // Activate the trusted roots object.
    // Once activated, all Chilkat objects that use TLS connections (HTTP, REST, Socket, MailMan, IMAP, FTP, etc.)
    // will fail the TLS handshake if the server certificate is not verified and rooted with one of our explicitly trusted root certificates.
    success = CkTrustedRoots_Activate(tRoots);

    http = CkHttp_Create();

    // Note: We also need to explicitly indicate that server certificates are to be verified.
    CkHttp_putRequireSslCertVerify(http,TRUE);

    // For example, the following should fail because www.chilkatsoft.com's server certificate is not rooted in one of the explicitly trusted root CA certs.
    success = CkHttp_Download(http,"https://www.chilkatsoft.com/helloWorld.txt","qa_output/helloWorld.txt");
    if (success != TRUE) {
        // The above Download should fail.
        printf("%s\n",CkHttp_lastErrorText(http));

        // There should be a message in the LastErrorText indicating that we were "Unable to build certificate chain to root.."
    }

    // However, we should be able to make TLS connections to good.sca1a.amazontrust.com
    success = CkHttp_Download(http,"https://good.sca1a.amazontrust.com/","qa_output/valid.html");
    if (success != TRUE) {
        printf("%s\n",CkHttp_lastErrorText(http));
        CkTrustedRoots_Dispose(tRoots);
        CkCert_Dispose(caCert);
        CkHttp_Dispose(http);
        return;
    }

    // We can still examine the LastErrorText and we'll find this message within:  
    // "The public key was successfully validated against the public key of the explicitly trusted root cert."
    printf("%s\n",CkHttp_lastErrorText(http));

    printf("Success!\n");


    CkTrustedRoots_Dispose(tRoots);
    CkCert_Dispose(caCert);
    CkHttp_Dispose(http);

    }