(Delphi ActiveX) Import a PFX/P12 into the Windows Certificate Stores

Demonstrates how to import the certificates contained in a .pfx/.p12 to the Windows certificate stores.

Chilkat for Delphi Downloads Chilkat ActiveX DLL for Delphi Chilkat non-ActiveX DLL for Delphi * The examples here use the ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Chilkat_TLB;

...

procedure TForm1.Button1Click(Sender: TObject);
var
primaryCert: TChilkatCert;
pfxPassword: WideString;
success: Integer;
certChain: IChilkatCertChain;
chainReachesRoot: Integer;
cert: IChilkatCert;
i: Integer;
numCerts: Integer;
certStoreCU: TChilkatCertStore;
certStoreCA: TChilkatCertStore;
certStoreRootCA: TChilkatCertStore;
readOnlyFlag: Integer;
allSuccess: Integer;

begin
primaryCert := TChilkatCert.Create(Self);

// Load a PFX file into a certificate object.
// The cert object will contain the certificate from the PFX that has a private key.
// The certs in the chain of authentication (if contained in the PFX) are also loaded,
// and can be accessed by getting the certificate chain (see below).
// If the PFX did not include the issuer certs in the chain of authentication, then Chilkat will
// automatically try to construct the issuer chain from the CA and intermedicate CA certs
// already installed on the Windows system.
pfxPassword := 'myPfxPassword';
success := primaryCert.LoadPfxFile('qa_data/pfx/somePfx.p12',pfxPassword);
if (success = 0) then
  begin
    Memo1.Lines.Add(primaryCert.LastErrorText);
    Exit;
  end;

certChain := primaryCert.GetCertChain();
if (primaryCert.LastMethodSuccess = 0) then
  begin
    Memo1.Lines.Add(primaryCert.LastErrorText);
    Exit;
  end;

// If the certificate chain reaches the root CA cert, then the last cert in the chain
// is the root CA cert.
chainReachesRoot := certChain.ReachesRoot;
if (chainReachesRoot = 1) then
  begin
    Memo1.Lines.Add('The certificate chain reaches the root CA cert.');
  end;

i := 0;
numCerts := certChain.NumCerts;
while i < numCerts do
  begin
    cert := certChain.GetCert(i);
    Memo1.Lines.Add('SubjectDN ' + IntToStr(i) + ': ' + cert.SubjectDN);
    Memo1.Lines.Add('IssuerDN ' + IntToStr(i) + ': ' + cert.IssuerDN);
    Memo1.Lines.Add('--');

    i := i + 1;
  end;

// The primary cert having the private key will be imported into the Current User "My" certificate store.
// Any intermediate root certificates will be imported into certificate store for intermediate certificate authorities.
// The root CA cert will be imported into the Root CA cert store.

// Let's open each of these 3 certificate stores..
certStoreCU := TChilkatCertStore.Create(Self);
certStoreCA := TChilkatCertStore.Create(Self);
certStoreRootCA := TChilkatCertStore.Create(Self);
readOnlyFlag := 0;

// "CurrentUser" and "My" are the exact keywords to select your user account's certificate store.
success := certStoreCU.OpenWindowsStore('CurrentUser','My',readOnlyFlag);
if (success = 0) then
  begin
    Memo1.Lines.Add('Failed to open the CurrentUser/My certificate store for read/write.');

    Exit;
  end;

// Certificate store for intermediate certification authorities (CAs). 
success := certStoreCA.OpenWindowsStore('CurrentUser','CertificationAuthority',readOnlyFlag);
if (success = 0) then
  begin
    Memo1.Lines.Add('Failed to open the CurrentUser/CertificationAuthority certificate store for read/write.');

    Exit;
  end;

// Certificate store for trusted root certification authorities (CAs). 
success := certStoreRootCA.OpenWindowsStore('CurrentUser','Root',readOnlyFlag);
if (success = 0) then
  begin
    Memo1.Lines.Add('Failed to open the CurrentUser/Root certificate store for read/write.');

    Exit;
  end;

// Iterate over the certs in the chain and import each into the desired certificate store.
allSuccess := 1;
i := 0;
while i < numCerts do
  begin
    cert := certChain.GetCert(i);
    if (i = 0) then
      begin
        // Import the primary certificate into the CurrentUser/My certificate store.
        success := certStoreCU.AddCertificate(cert);
        if (success = 0) then
          begin
            Memo1.Lines.Add(certStoreCU.LastErrorText);
            allSuccess := 0;
          end;
      end
    else
      begin
        if ((i = (numCerts - 1)) and (chainReachesRoot = 1)) then
          begin
            // Add the root CA certificate to the CurrentUser/Root certificate store.
            // (Your application can obviously choose whether this should be done or not.  Perhaps you prompt the user.)

            // Note: If the root CA cert is already present in the Windows certificate store, Windows will display
            // a dialog to ask if it should be deleted.  Chilkat does not explicitly display dialogs.
            success := certStoreRootCA.AddCertificate(cert);
            if (success = 0) then
              begin
                Memo1.Lines.Add(certStoreRootCA.LastErrorText);
                allSuccess := 0;
              end;
          end
        else
          begin
            // This is an intermediate CA certificate.
            success := certStoreCA.AddCertificate(cert);
            if (success = 0) then
              begin
                Memo1.Lines.Add(certStoreCA.LastErrorText);
                allSuccess := 0;
              end;
          end;
      end;

    if (success = 0) then
      begin
        Memo1.Lines.Add('Failed to import certificate.');
      end;

    i := i + 1;
  end;

Memo1.Lines.Add('allSuccess = ' + IntToStr(Ord(allSuccess)));
end;