Dart

Trust Specific Root CA Certificates

See more Certificates Examples

Demonstrates how to trust specific root CA certificates and none others. Dart

import 'package:chilkat/chilkat.dart';

void main() {
  // This example assumes the Chilkat API to have been previously unlocked.
  // See Global Unlock Sample for sample code.

  // This example will trust the Amazon root CA certificates provided at 
  // https://www.amazontrust.com/repository/

  // I've previously downloaded the root CA certificates to DER format.
  // Add each to the Chilkat TrustedRoots singleton object.

  final tRoots = CkTrustedRoots();

  final caCert = CkCert();
  try {
    caCert.loadFromFile('qa_data/certs/aws_root_ca/AmazonRootCA1.cer');
  } on ChilkatException catch (e) {
    print(e.lastErrorText);
    return;
  }

  tRoots.addCert(caCert);

  // Continue with the others.
  // For brevity, we're not checking return values for success/failure.
  caCert.loadFromFile('qa_data/certs/aws_root_ca/AmazonRootCA2.cer');
  tRoots.addCert(caCert);

  caCert.loadFromFile('qa_data/certs/aws_root_ca/AmazonRootCA3.cer');
  tRoots.addCert(caCert);

  caCert.loadFromFile('qa_data/certs/aws_root_ca/AmazonRootCA4.cer');
  tRoots.addCert(caCert);

  caCert.loadFromFile('qa_data/certs/aws_root_ca/SFSRootCAG2.cer');
  tRoots.addCert(caCert);

  // Indicate we don't want to automatically trust the operating system's installed root CA certificates.
  // On a Windows operating system, this would be the registry-based CA certificate stores. 
  // On a Linux system, this could be /etc/ssl/certs/ca-certificates.crt, if it exists.
  tRoots.trustSystemCaRoots = false;

  // Activate the trusted roots object.
  // Once activated, all Chilkat objects that use TLS connections (HTTP, REST, Socket, MailMan, IMAP, FTP, etc.)
  // will fail the TLS handshake if the server certificate is not verified and rooted with one of our explicitly trusted root certificates.
  tRoots.activate();

  final http = CkHttp();

  // Note: We also need to explicitly indicate that server certificates are to be verified.
  http.requireSslCertVerify = true;

  // For example, the following should fail because www.chilkatsoft.com's server certificate is not rooted in one of the explicitly trusted root CA certs.
  try {
    http.download('https://www.chilkatsoft.com/helloWorld.txt', 'qa_output/helloWorld.txt');
  } on ChilkatException catch (e) {
    // The above Download should fail.
    print(e.lastErrorText);

    // There should be a message in the LastErrorText indicating that we were "Unable to build certificate chain to root.."
  }

  // However, we should be able to make TLS connections to good.sca1a.amazontrust.com
  try {
    http.download('https://good.sca1a.amazontrust.com/', 'qa_output/valid.html');
  } on ChilkatException catch (e) {
    print(e.lastErrorText);
    return;
  }

  // We can still examine the LastErrorText and we'll find this message within:  
  // "The public key was successfully validated against the public key of the explicitly trusted root cert."
  print(http.lastErrorText);

  print('Success!');
}