(PowerBuilder) Trust Specific Root CA Certificates

Demonstrates how to trust specific root CA certificates and none others.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

integer li_rc
oleobject loo_TRoots
oleobject loo_CaCert
integer li_Success
oleobject loo_Http

// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// This example will trust the Amazon root CA certificates provided at 
// https://www.amazontrust.com/repository/

// I've previously downloaded the root CA certificates to DER format.
// Add each to the Chilkat TrustedRoots singleton object.

loo_TRoots = create oleobject
// Use "Chilkat_9_5_0.TrustedRoots" for versions of Chilkat < 10.0.0
li_rc = loo_TRoots.ConnectToNewObject("Chilkat.TrustedRoots")
if li_rc < 0 then
    destroy loo_TRoots
    MessageBox("Error","Connecting to COM object failed")
    return
end if

loo_CaCert = create oleobject
// Use "Chilkat_9_5_0.Cert" for versions of Chilkat < 10.0.0
li_rc = loo_CaCert.ConnectToNewObject("Chilkat.Cert")

li_Success = loo_CaCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA1.cer")
if li_Success = 0 then
    Write-Debug loo_CaCert.LastErrorText
    destroy loo_TRoots
    destroy loo_CaCert
    return
end if

li_Success = loo_TRoots.AddCert(loo_CaCert)

// Continue with the others.
// For brevity, we're not checking return values for success/failure.
li_Success = loo_CaCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA2.cer")
li_Success = loo_TRoots.AddCert(loo_CaCert)

li_Success = loo_CaCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA3.cer")
li_Success = loo_TRoots.AddCert(loo_CaCert)

li_Success = loo_CaCert.LoadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA4.cer")
li_Success = loo_TRoots.AddCert(loo_CaCert)

li_Success = loo_CaCert.LoadFromFile("qa_data/certs/aws_root_ca/SFSRootCAG2.cer")
li_Success = loo_TRoots.AddCert(loo_CaCert)

// Indicate we don't want to automatically trust the operating system's installed root CA certificates.
// On a Windows operating system, this would be the registry-based CA certificate stores. 
// On a Linux system, this could be /etc/ssl/certs/ca-certificates.crt, if it exists.
loo_TRoots.TrustSystemCaRoots = 0

// Activate the trusted roots object.
// Once activated, all Chilkat objects that use TLS connections (HTTP, REST, Socket, MailMan, IMAP, FTP, etc.)
// will fail the TLS handshake if the server certificate is not verified and rooted with one of our explicitly trusted root certificates.
li_Success = loo_TRoots.Activate()

loo_Http = create oleobject
// Use "Chilkat_9_5_0.Http" for versions of Chilkat < 10.0.0
li_rc = loo_Http.ConnectToNewObject("Chilkat.Http")

// Note: We also need to explicitly indicate that server certificates are to be verified.
loo_Http.RequireSslCertVerify = 1

// For example, the following should fail because www.chilkatsoft.com's server certificate is not rooted in one of the explicitly trusted root CA certs.
li_Success = loo_Http.Download("https://www.chilkatsoft.com/helloWorld.txt","qa_output/helloWorld.txt")
if li_Success <> 1 then
    // The above Download should fail.
    Write-Debug loo_Http.LastErrorText

    // There should be a message in the LastErrorText indicating that we were "Unable to build certificate chain to root.."
end if

// However, we should be able to make TLS connections to good.sca1a.amazontrust.com
li_Success = loo_Http.Download("https://good.sca1a.amazontrust.com/","qa_output/valid.html")
if li_Success <> 1 then
    Write-Debug loo_Http.LastErrorText
    destroy loo_TRoots
    destroy loo_CaCert
    destroy loo_Http
    return
end if

// We can still examine the LastErrorText and we'll find this message within:  
// "The public key was successfully validated against the public key of the explicitly trusted root cert."
Write-Debug loo_Http.LastErrorText

Write-Debug "Success!"


destroy loo_TRoots
destroy loo_CaCert
destroy loo_Http