(Delphi ActiveX) Trust Specific Root CA Certificates

Demonstrates how to trust specific root CA certificates and none others.

Chilkat for Delphi Downloads Chilkat ActiveX DLL for Delphi Chilkat non-ActiveX DLL for Delphi * The examples here use the ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Chilkat_TLB;

...

procedure TForm1.Button1Click(Sender: TObject);
var
tRoots: TChilkatTrustedRoots;
caCert: TChilkatCert;
success: Integer;
http: TChilkatHttp;

begin
// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// This example will trust the Amazon root CA certificates provided at 
// https://www.amazontrust.com/repository/

// I've previously downloaded the root CA certificates to DER format.
// Add each to the Chilkat TrustedRoots singleton object.

tRoots := TChilkatTrustedRoots.Create(Self);

caCert := TChilkatCert.Create(Self);
success := caCert.LoadFromFile('qa_data/certs/aws_root_ca/AmazonRootCA1.cer');
if (success = 0) then
  begin
    Memo1.Lines.Add(caCert.LastErrorText);
    Exit;
  end;
success := tRoots.AddCert(caCert.ControlInterface);

// Continue with the others.
// For brevity, we're not checking return values for success/failure.
success := caCert.LoadFromFile('qa_data/certs/aws_root_ca/AmazonRootCA2.cer');
success := tRoots.AddCert(caCert.ControlInterface);

success := caCert.LoadFromFile('qa_data/certs/aws_root_ca/AmazonRootCA3.cer');
success := tRoots.AddCert(caCert.ControlInterface);

success := caCert.LoadFromFile('qa_data/certs/aws_root_ca/AmazonRootCA4.cer');
success := tRoots.AddCert(caCert.ControlInterface);

success := caCert.LoadFromFile('qa_data/certs/aws_root_ca/SFSRootCAG2.cer');
success := tRoots.AddCert(caCert.ControlInterface);

// Indicate we don't want to automatically trust the operating system's installed root CA certificates.
// On a Windows operating system, this would be the registry-based CA certificate stores. 
// On a Linux system, this could be /etc/ssl/certs/ca-certificates.crt, if it exists.
tRoots.TrustSystemCaRoots := 0;

// Activate the trusted roots object.
// Once activated, all Chilkat objects that use TLS connections (HTTP, REST, Socket, MailMan, IMAP, FTP, etc.)
// will fail the TLS handshake if the server certificate is not verified and rooted with one of our explicitly trusted root certificates.
success := tRoots.Activate();

http := TChilkatHttp.Create(Self);

// Note: We also need to explicitly indicate that server certificates are to be verified.
http.RequireSslCertVerify := 1;

// For example, the following should fail because www.chilkatsoft.com's server certificate is not rooted in one of the explicitly trusted root CA certs.
success := http.Download('https://www.chilkatsoft.com/helloWorld.txt','qa_output/helloWorld.txt');
if (success <> 1) then
  begin
    // The above Download should fail.
    Memo1.Lines.Add(http.LastErrorText);

    // There should be a message in the LastErrorText indicating that we were "Unable to build certificate chain to root.."
  end;

// However, we should be able to make TLS connections to good.sca1a.amazontrust.com
success := http.Download('https://good.sca1a.amazontrust.com/','qa_output/valid.html');
if (success <> 1) then
  begin
    Memo1.Lines.Add(http.LastErrorText);
    Exit;
  end;

// We can still examine the LastErrorText and we'll find this message within:  
// "The public key was successfully validated against the public key of the explicitly trusted root cert."
Memo1.Lines.Add(http.LastErrorText);

Memo1.Lines.Add('Success!');
end;