(PowerShell) Examine Client Certificates for an Accepted TLS Connection

Demonstrates how to access the client certificates for a TLS connection accepted by your application acting as the server.

Chilkat .NET Downloads Chilkat .NET Assemblies

Add-Type -Path "C:\chilkat\ChilkatDotNet47-9.5.0-x64\ChilkatDotNet47.dll"

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

$listenSslSocket = New-Object Chilkat.Socket

# An SSL/TLS server needs a digital certificate.  This example loads it from a PFX file.
# This is the server's certificate.

$cert = New-Object Chilkat.Cert
$success = $cert.LoadPfxFile("qa_data/serverCert/myServerCert.pfx","pfx_password")
if ($success -ne $true) {
    $($cert.LastErrorText)
    exit
}

# To accept client client certificates in the TLS handshake,
# we must indicate a list of acceptable client certificate root CA DN's
# that are allowed.  (DN is an acronym for Distinguished Name.)
# Call AddSslAcceptableClientCaDn once for each acceptable CA DN.
# Here are a few examples so you can see the general format of a DN.
$listenSslSocket.AddSslAcceptableClientCaDn("C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root")
$listenSslSocket.AddSslAcceptableClientCaDn("O=Digital Signature Trust Co., CN=DST Root CA X3")

# Initialize with our server's TLS certificate.
$success = $listenSslSocket.InitSslServer($cert)
if ($success -ne $true) {
    $($listenSslSocket.LastErrorText)
    exit
}

# Bind and listen on a port:
$myPort = 8123
# Allow for a max of 5 queued connect requests.
$backLog = 5
$success = $listenSslSocket.BindAndListen($myPort,$backLog)
if ($success -ne $true) {
    $($listenSslSocket.LastErrorText)
    exit
}

# Accept the next incoming connection.
$maxWaitMillisec = 20000
$clientSock = $listenSslSocket.AcceptNextConnection($maxWaitMillisec)
if ($listenSslSocket.LastMethodSuccess -eq $false) {
    $($listenSslSocket.LastErrorText)
    exit
}

# Examine the client certs chain.  The 1st cert will be the client certificate, and
# the subsequent certs will be the certs in the chain of authentication.
$numClientCerts = $clientSock.NumReceivedClientCerts
$("numClientCerts = " + $numClientCerts)

$i = 0
while ($i -lt $numClientCerts) {
    $clientCert = $clientSock.GetReceivedClientCert($i)
    $($clientCert.SubjectDN)

    $i = $i + 1
}

# Close the connection with the client
$success = $clientSock.Close(1000)