(Visual FoxPro) Examine Client Certificates for an Accepted TLS Connection

Demonstrates how to access the client certificates for a TLS connection accepted by your application acting as the server.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

LOCAL loListenSslSocket
LOCAL loCert
LOCAL lnSuccess
LOCAL lnMyPort
LOCAL lnBackLog
LOCAL lnMaxWaitMillisec
LOCAL loClientSock
LOCAL lnNumClientCerts
LOCAL i
LOCAL loClientCert

* This example requires the Chilkat API to have been previously unlocked.
* See Global Unlock Sample for sample code.

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Socket')
loListenSslSocket = CreateObject('Chilkat.Socket')

* An SSL/TLS server needs a digital certificate.  This example loads it from a PFX file.
* This is the server's certificate.

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Cert')
loCert = CreateObject('Chilkat.Cert')
lnSuccess = loCert.LoadPfxFile("qa_data/serverCert/myServerCert.pfx","pfx_password")
IF (lnSuccess <> 1) THEN
    ? loCert.LastErrorText
    RELEASE loListenSslSocket
    RELEASE loCert
    CANCEL
ENDIF

* To accept client client certificates in the TLS handshake,
* we must indicate a list of acceptable client certificate root CA DN's
* that are allowed.  (DN is an acronym for Distinguished Name.)
* Call AddSslAcceptableClientCaDn once for each acceptable CA DN.
* Here are a few examples so you can see the general format of a DN.
loListenSslSocket.AddSslAcceptableClientCaDn("C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root")
loListenSslSocket.AddSslAcceptableClientCaDn("O=Digital Signature Trust Co., CN=DST Root CA X3")

* Initialize with our server's TLS certificate.
lnSuccess = loListenSslSocket.InitSslServer(loCert)
IF (lnSuccess <> 1) THEN
    ? loListenSslSocket.LastErrorText
    RELEASE loListenSslSocket
    RELEASE loCert
    CANCEL
ENDIF

* Bind and listen on a port:
lnMyPort = 8123
* Allow for a max of 5 queued connect requests.
lnBackLog = 5
lnSuccess = loListenSslSocket.BindAndListen(lnMyPort,lnBackLog)
IF (lnSuccess <> 1) THEN
    ? loListenSslSocket.LastErrorText
    RELEASE loListenSslSocket
    RELEASE loCert
    CANCEL
ENDIF

* Accept the next incoming connection.
lnMaxWaitMillisec = 20000
loClientSock = loListenSslSocket.AcceptNextConnection(lnMaxWaitMillisec)
IF (loListenSslSocket.LastMethodSuccess = 0) THEN
    ? loListenSslSocket.LastErrorText
    RELEASE loListenSslSocket
    RELEASE loCert
    CANCEL
ENDIF

* Examine the client certs chain.  The 1st cert will be the client certificate, and
* the subsequent certs will be the certs in the chain of authentication.
lnNumClientCerts = loClientSock.NumReceivedClientCerts
? "numClientCerts = " + STR(lnNumClientCerts)

i = 0
DO WHILE i < lnNumClientCerts
    loClientCert = loClientSock.GetReceivedClientCert(i)
    ? loClientCert.SubjectDN
    RELEASE loClientCert
    i = i + 1
ENDDO

* Close the connection with the client
lnSuccess = loClientSock.Close(1000)

RELEASE loClientSock

RELEASE loListenSslSocket
RELEASE loCert