(Visual FoxPro) Trust Specific Root CA Certificates

Demonstrates how to trust specific root CA certificates and none others.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

LOCAL loTRoots
LOCAL loCaCert
LOCAL lnSuccess
LOCAL loHttp

* This example assumes the Chilkat API to have been previously unlocked.
* See Global Unlock Sample for sample code.

* This example will trust the Amazon root CA certificates provided at 
* https://www.amazontrust.com/repository/

* I've previously downloaded the root CA certificates to DER format.
* Add each to the Chilkat TrustedRoots singleton object.

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.TrustedRoots')
loTRoots = CreateObject('Chilkat.TrustedRoots')

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Cert')
loCaCert = CreateObject('Chilkat.Cert')
lnSuccess = loCaCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA1.cer")
IF (lnSuccess = 0) THEN
    ? loCaCert.LastErrorText
    RELEASE loTRoots
    RELEASE loCaCert
    CANCEL
ENDIF

lnSuccess = loTRoots.AddCert(loCaCert)

* Continue with the others.
* For brevity, we're not checking return values for success/failure.
lnSuccess = loCaCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA2.cer")
lnSuccess = loTRoots.AddCert(loCaCert)

lnSuccess = loCaCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA3.cer")
lnSuccess = loTRoots.AddCert(loCaCert)

lnSuccess = loCaCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA4.cer")
lnSuccess = loTRoots.AddCert(loCaCert)

lnSuccess = loCaCert.LoadFromFile("qa_data/certs/aws_root_ca/SFSRootCAG2.cer")
lnSuccess = loTRoots.AddCert(loCaCert)

* Indicate we don't want to automatically trust the operating system's installed root CA certificates.
* On a Windows operating system, this would be the registry-based CA certificate stores. 
* On a Linux system, this could be /etc/ssl/certs/ca-certificates.crt, if it exists.
loTRoots.TrustSystemCaRoots = 0

* Activate the trusted roots object.
* Once activated, all Chilkat objects that use TLS connections (HTTP, REST, Socket, MailMan, IMAP, FTP, etc.)
* will fail the TLS handshake if the server certificate is not verified and rooted with one of our explicitly trusted root certificates.
lnSuccess = loTRoots.Activate()

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Http')
loHttp = CreateObject('Chilkat.Http')

* Note: We also need to explicitly indicate that server certificates are to be verified.
loHttp.RequireSslCertVerify = 1

* For example, the following should fail because www.chilkatsoft.com's server certificate is not rooted in one of the explicitly trusted root CA certs.
lnSuccess = loHttp.Download("https://www.chilkatsoft.com/helloWorld.txt","qa_output/helloWorld.txt")
IF (lnSuccess <> 1) THEN
    * The above Download should fail.
    ? loHttp.LastErrorText

    * There should be a message in the LastErrorText indicating that we were "Unable to build certificate chain to root.."
ENDIF

* However, we should be able to make TLS connections to good.sca1a.amazontrust.com
lnSuccess = loHttp.Download("https://good.sca1a.amazontrust.com/","qa_output/valid.html")
IF (lnSuccess <> 1) THEN
    ? loHttp.LastErrorText
    RELEASE loTRoots
    RELEASE loCaCert
    RELEASE loHttp
    CANCEL
ENDIF

* We can still examine the LastErrorText and we'll find this message within:  
* "The public key was successfully validated against the public key of the explicitly trusted root cert."
? loHttp.LastErrorText

? "Success!"

RELEASE loTRoots
RELEASE loCaCert
RELEASE loHttp