(Classic ASP) Trust Specific Root CA Certificates

Demonstrates how to trust specific root CA certificates and none others.

Chilkat ActiveX Downloads

ActiveX for 32-bit and 64-bit Windows

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<%
' This example assumes the Chilkat API to have been previously unlocked.
' See Global Unlock Sample for sample code.

' This example will trust the Amazon root CA certificates provided at 
' https://www.amazontrust.com/repository/

' I've previously downloaded the root CA certificates to DER format.
' Add each to the Chilkat TrustedRoots singleton object.

' For versions of Chilkat < 10.0.0, use CreateObject("Chilkat_9_5_0.TrustedRoots")
set tRoots = Server.CreateObject("Chilkat.TrustedRoots")

' For versions of Chilkat < 10.0.0, use CreateObject("Chilkat_9_5_0.Cert")
set caCert = Server.CreateObject("Chilkat.Cert")
success = caCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA1.cer")
If (success = 0) Then
    Response.Write "<pre>" & Server.HTMLEncode( caCert.LastErrorText) & "</pre>"
    Response.End
End If

success = tRoots.AddCert(caCert)

' Continue with the others.
' For brevity, we're not checking return values for success/failure.
success = caCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA2.cer")
success = tRoots.AddCert(caCert)

success = caCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA3.cer")
success = tRoots.AddCert(caCert)

success = caCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA4.cer")
success = tRoots.AddCert(caCert)

success = caCert.LoadFromFile("qa_data/certs/aws_root_ca/SFSRootCAG2.cer")
success = tRoots.AddCert(caCert)

' Indicate we don't want to automatically trust the operating system's installed root CA certificates.
' On a Windows operating system, this would be the registry-based CA certificate stores. 
' On a Linux system, this could be /etc/ssl/certs/ca-certificates.crt, if it exists.
tRoots.TrustSystemCaRoots = 0

' Activate the trusted roots object.
' Once activated, all Chilkat objects that use TLS connections (HTTP, REST, Socket, MailMan, IMAP, FTP, etc.)
' will fail the TLS handshake if the server certificate is not verified and rooted with one of our explicitly trusted root certificates.
success = tRoots.Activate()

' For versions of Chilkat < 10.0.0, use CreateObject("Chilkat_9_5_0.Http")
set http = Server.CreateObject("Chilkat.Http")

' Note: We also need to explicitly indicate that server certificates are to be verified.
http.RequireSslCertVerify = 1

' For example, the following should fail because www.chilkatsoft.com's server certificate is not rooted in one of the explicitly trusted root CA certs.
success = http.Download("https://www.chilkatsoft.com/helloWorld.txt","qa_output/helloWorld.txt")
If (success <> 1) Then
    ' The above Download should fail.
    Response.Write "<pre>" & Server.HTMLEncode( http.LastErrorText) & "</pre>"

    ' There should be a message in the LastErrorText indicating that we were "Unable to build certificate chain to root.."
End If

' However, we should be able to make TLS connections to good.sca1a.amazontrust.com
success = http.Download("https://good.sca1a.amazontrust.com/","qa_output/valid.html")
If (success <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( http.LastErrorText) & "</pre>"
    Response.End
End If

' We can still examine the LastErrorText and we'll find this message within:  
' "The public key was successfully validated against the public key of the explicitly trusted root cert."
Response.Write "<pre>" & Server.HTMLEncode( http.LastErrorText) & "</pre>"

Response.Write "<pre>" & Server.HTMLEncode( "Success!") & "</pre>"

%>
</body>
</html>