Objective-C

Trust Specific Root CA Certificates

See more Certificates Examples

Demonstrates how to trust specific root CA certificates and none others. Objective-C

#import <CkoTrustedRoots.h>
#import <CkoCert.h>
#import <CkoHttp.h>

BOOL success = NO;

//  This example assumes the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  This example will trust the Amazon root CA certificates provided at 
//  https://www.amazontrust.com/repository/

//  I've previously downloaded the root CA certificates to DER format.
//  Add each to the Chilkat TrustedRoots singleton object.

CkoTrustedRoots *tRoots = [[CkoTrustedRoots alloc] init];

CkoCert *caCert = [[CkoCert alloc] init];
success = [caCert LoadFromFile: @"qa_data/certs/aws_root_ca/AmazonRootCA1.cer"];
if (success == NO) {
    NSLog(@"%@",caCert.LastErrorText);
    return;
}

success = [tRoots AddCert: caCert];

//  Continue with the others.
//  For brevity, we're not checking return values for success/failure.
success = [caCert LoadFromFile: @"qa_data/certs/aws_root_ca/AmazonRootCA2.cer"];
success = [tRoots AddCert: caCert];

success = [caCert LoadFromFile: @"qa_data/certs/aws_root_ca/AmazonRootCA3.cer"];
success = [tRoots AddCert: caCert];

success = [caCert LoadFromFile: @"qa_data/certs/aws_root_ca/AmazonRootCA4.cer"];
success = [tRoots AddCert: caCert];

success = [caCert LoadFromFile: @"qa_data/certs/aws_root_ca/SFSRootCAG2.cer"];
success = [tRoots AddCert: caCert];

//  Indicate we don't want to automatically trust the operating system's installed root CA certificates.
//  On a Windows operating system, this would be the registry-based CA certificate stores. 
//  On a Linux system, this could be /etc/ssl/certs/ca-certificates.crt, if it exists.
tRoots.TrustSystemCaRoots = NO;

//  Activate the trusted roots object.
//  Once activated, all Chilkat objects that use TLS connections (HTTP, REST, Socket, MailMan, IMAP, FTP, etc.)
//  will fail the TLS handshake if the server certificate is not verified and rooted with one of our explicitly trusted root certificates.
success = [tRoots Activate];

CkoHttp *http = [[CkoHttp alloc] init];

//  Note: We also need to explicitly indicate that server certificates are to be verified.
http.RequireSslCertVerify = YES;

//  For example, the following should fail because www.chilkatsoft.com's server certificate is not rooted in one of the explicitly trusted root CA certs.
success = [http Download: @"https://www.chilkatsoft.com/helloWorld.txt" saveToPath: @"qa_output/helloWorld.txt"];
if (success != YES) {
    //  The above Download should fail.
    NSLog(@"%@",http.LastErrorText);

    //  There should be a message in the LastErrorText indicating that we were "Unable to build certificate chain to root.."
}

//  However, we should be able to make TLS connections to good.sca1a.amazontrust.com
success = [http Download: @"https://good.sca1a.amazontrust.com/" saveToPath: @"qa_output/valid.html"];
if (success != YES) {
    NSLog(@"%@",http.LastErrorText);
    return;
}

//  We can still examine the LastErrorText and we'll find this message within:  
//  "The public key was successfully validated against the public key of the explicitly trusted root cert."
NSLog(@"%@",http.LastErrorText);

NSLog(@"%@",@"Success!");