AutoIt

Examine Client Certificates for an Accepted TLS Connection

See more Socket/SSL/TLS Examples

Demonstrates how to access the client certificates for a TLS connection accepted by your application acting as the server. AutoIt

Local $bSuccess = False

; This example requires the Chilkat API to have been previously unlocked.
; See Global Unlock Sample for sample code.

$oListenSslSocket = ObjCreate("Chilkat.Socket")

; An SSL/TLS server needs a digital certificate.  This example loads it from a PFX file.
; This is the server's certificate.

$oCert = ObjCreate("Chilkat.Cert")
$bSuccess = $oCert.LoadPfxFile("qa_data/serverCert/myServerCert.pfx","pfx_password")
If ($bSuccess = False) Then
    ConsoleWrite($oCert.LastErrorText & @CRLF)
    Exit
EndIf

; To accept client client certificates in the TLS handshake,
; we must indicate a list of acceptable client certificate root CA DN's
; that are allowed.  (DN is an acronym for Distinguished Name.)
; Call AddSslAcceptableClientCaDn once for each acceptable CA DN.
; Here are a few examples so you can see the general format of a DN.
$oListenSslSocket.AddSslAcceptableClientCaDn("C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root")
$oListenSslSocket.AddSslAcceptableClientCaDn("O=Digital Signature Trust Co., CN=DST Root CA X3")

; Initialize with our server's TLS certificate.
$bSuccess = $oListenSslSocket.InitSslServer($oCert)
If ($bSuccess = False) Then
    ConsoleWrite($oListenSslSocket.LastErrorText & @CRLF)
    Exit
EndIf

; Bind and listen on a port:
Local $iMyPort = 8123
; Allow for a max of 5 queued connect requests.
Local $iBackLog = 5
$bSuccess = $oListenSslSocket.BindAndListen($iMyPort,$iBackLog)
If ($bSuccess = False) Then
    ConsoleWrite($oListenSslSocket.LastErrorText & @CRLF)
    Exit
EndIf

; Accept the next incoming connection.
Local $iMaxWaitMillisec = 20000

$oClientSock = ObjCreate("Chilkat.Socket")
$bSuccess = $oListenSslSocket.AcceptNext($iMaxWaitMillisec,$oClientSock)
If ($bSuccess = False) Then
    ConsoleWrite($oListenSslSocket.LastErrorText & @CRLF)
    Exit
EndIf

; Examine the client certs chain.  The 1st cert will be the client certificate, and
; the subsequent certs will be the certs in the chain of authentication.
Local $iNumClientCerts = $oClientSock.NumReceivedClientCerts
ConsoleWrite("numClientCerts = " & $iNumClientCerts & @CRLF)

$oClientCert = ObjCreate("Chilkat.Cert")
Local $i = 0
While $i < $iNumClientCerts
    $oClientSock.GetRcvdClientCert($i,$oClientCert)
    ConsoleWrite($oClientCert.SubjectDN & @CRLF)
    $i = $i + 1
Wend

; Close the connection with the client
$bSuccess = $oClientSock.Close(1000)