AutoIt

Trust Specific Root CA Certificates

See more Certificates Examples

Demonstrates how to trust specific root CA certificates and none others. AutoIt

Local $bSuccess = False

; This example assumes the Chilkat API to have been previously unlocked.
; See Global Unlock Sample for sample code.

; This example will trust the Amazon root CA certificates provided at 
; https://www.amazontrust.com/repository/

; I've previously downloaded the root CA certificates to DER format.
; Add each to the Chilkat TrustedRoots singleton object.

$oTRoots = ObjCreate("Chilkat.TrustedRoots")

$oCaCert = ObjCreate("Chilkat.Cert")
$bSuccess = $oCaCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA1.cer")
If ($bSuccess = False) Then
    ConsoleWrite($oCaCert.LastErrorText & @CRLF)
    Exit
EndIf

$bSuccess = $oTRoots.AddCert($oCaCert)

; Continue with the others.
; For brevity, we're not checking return values for success/failure.
$bSuccess = $oCaCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA2.cer")
$bSuccess = $oTRoots.AddCert($oCaCert)

$bSuccess = $oCaCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA3.cer")
$bSuccess = $oTRoots.AddCert($oCaCert)

$bSuccess = $oCaCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA4.cer")
$bSuccess = $oTRoots.AddCert($oCaCert)

$bSuccess = $oCaCert.LoadFromFile("qa_data/certs/aws_root_ca/SFSRootCAG2.cer")
$bSuccess = $oTRoots.AddCert($oCaCert)

; Indicate we don't want to automatically trust the operating system's installed root CA certificates.
; On a Windows operating system, this would be the registry-based CA certificate stores. 
; On a Linux system, this could be /etc/ssl/certs/ca-certificates.crt, if it exists.
$oTRoots.TrustSystemCaRoots = False

; Activate the trusted roots object.
; Once activated, all Chilkat objects that use TLS connections (HTTP, REST, Socket, MailMan, IMAP, FTP, etc.)
; will fail the TLS handshake if the server certificate is not verified and rooted with one of our explicitly trusted root certificates.
$bSuccess = $oTRoots.Activate()

$oHttp = ObjCreate("Chilkat.Http")

; Note: We also need to explicitly indicate that server certificates are to be verified.
$oHttp.RequireSslCertVerify = True

; For example, the following should fail because www.chilkatsoft.com's server certificate is not rooted in one of the explicitly trusted root CA certs.
$bSuccess = $oHttp.Download("https://www.chilkatsoft.com/helloWorld.txt","qa_output/helloWorld.txt")
If ($bSuccess <> True) Then
    ; The above Download should fail.
    ConsoleWrite($oHttp.LastErrorText & @CRLF)

    ; There should be a message in the LastErrorText indicating that we were "Unable to build certificate chain to root.."
EndIf

; However, we should be able to make TLS connections to good.sca1a.amazontrust.com
$bSuccess = $oHttp.Download("https://good.sca1a.amazontrust.com/","qa_output/valid.html")
If ($bSuccess <> True) Then
    ConsoleWrite($oHttp.LastErrorText & @CRLF)
    Exit
EndIf

; We can still examine the LastErrorText and we'll find this message within:  
; "The public key was successfully validated against the public key of the explicitly trusted root cert."
ConsoleWrite($oHttp.LastErrorText & @CRLF)

ConsoleWrite("Success!" & @CRLF)