(PureBasic) Use a Smart Card Certificate + Private Key for SSL/TLS Authentication

See more ScMinidriver Examples

Demonstrates how to use a certificate + private key located on a smart card for the TLS client certificate in an HTTPS request.

Chilkat PureBasic Module Download Chilkat PureBasic Module

IncludeFile "CkHttp.pb"
IncludeFile "CkCert.pb"
IncludeFile "CkScMinidriver.pb"

Procedure ChilkatExample()

    ; This example requires the Chilkat API to have been previously unlocked.
    ; See Global Unlock Sample for sample code.

    scmd.i = CkScMinidriver::ckCreate()
    If scmd.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; Reader names (smart card readers or USB tokens) can be discovered
    ; via List Readers or Find Smart Cards
    readerName.s = "SCM Microsystems Inc. SCR33x USB Smart Card Reader 0"
    success.i = CkScMinidriver::ckAcquireContext(scmd,readerName)
    If success = 0
        Debug CkScMinidriver::ckLastErrorText(scmd)
        CkScMinidriver::ckDispose(scmd)
        ProcedureReturn
    EndIf

    ; If successful, the name of the currently inserted smart card is available:
    Debug "Card name: " + CkScMinidriver::ckCardName(scmd)

    ; If desired, perform regular PIN authentication with the smartcard.
    ; For more details about smart card PIN authentication, see the Smart Card PIN Authentication Example
    retval.i = CkScMinidriver::ckPinAuthenticate(scmd,"user","000000")
    If retval <> 0
        Debug "PIN Authentication failed."
    EndIf

    ; You can find a cerficate using any of the following certificate parts:
    ; "subjectDN" -- The full distinguished name of the cert.
    ; "subjectDN_withTags" -- Same as above, but in a format that includes the subject part tags, such as the "CN=" in "CN=something"
    ; "subjectCN" -- The common name part (CN) of the certificate's subject.
    ; "serial" -- The certificate serial number.
    ; "serial:issuerCN" -- The certificate serial number + the issuer's common name, delimited with a colon char.
    ; These are the same certificate parts that can be retrieved by listing certificates on the smart card (or USB token).
    ; See List Certificates on Smart Card Example
    certPart.s = "subjectCN"
    partValue.s = "BadSSL Client Certificate"

    ; If the certificate is found, it is loaded into the cert object.
    ; Note: We imported this certificate from a .p12/.pfx using this Example to Import a .pfx/.p12 onto a Smart Card
    cert.i = CkCert::ckCreate()
    If cert.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkScMinidriver::ckFindCert(scmd,certPart,partValue,cert)
    If success = 0
        Debug "Failed to find the certificate."
        CkScMinidriver::ckDeleteContext(scmd)
        CkScMinidriver::ckDispose(scmd)
        CkCert::ckDispose(cert)
        ProcedureReturn
    EndIf

    Debug "Successfully loaded the cert object from the smart card / USB token."

    ; Note: When successful, the cert object is internally linked to the ScMinidriver object's authenticated session.
    ; The cert object can now be used to sign or do other cryptographic operations that occur on the smart card / USB token.
    ; If your application calls PinDeauthenticate or DeleteContext, the cert will no longer be able to sign on the smart card
    ; because the smart card ScMinidriver session will no longer be authenticated or deleted.

    ; ------------------------------------------------------------------------------------------------------------

    ; Send an HTTPS request to https://client.badssl.com
    ; https://client.badssl.com (part of the badssl.com service) lets you test authentication using client SSL certificates. 
    ; The client certificate can be downloaded from https://badssl.com/download/.
    ; This server returns 200 OK if the correct client certificate is provided, and 400 Bad Request otherwise.

    http.i = CkHttp::ckCreate()
    If http.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; Provide the client certificate (linked internally to our authenticated smartcard session)
    success = CkHttp::ckSetSslClientCert(http,cert)
    If success = 0
        Debug CkHttp::ckLastErrorText(http)
        CkScMinidriver::ckDeleteContext(scmd)
        CkScMinidriver::ckDispose(scmd)
        CkCert::ckDispose(cert)
        CkHttp::ckDispose(http)
        ProcedureReturn
    EndIf

    responseBody.s = CkHttp::ckQuickGetStr(http,"https://client.badssl.com/")
    If CkHttp::ckLastMethodSuccess(http) = 0
        Debug CkHttp::ckLastErrorText(http)
        CkScMinidriver::ckDeleteContext(scmd)
        CkScMinidriver::ckDispose(scmd)
        CkCert::ckDispose(cert)
        CkHttp::ckDispose(http)
        ProcedureReturn
    EndIf

    Debug "Response status code: " + Str(CkHttp::ckLastStatus(http))
    Debug "Response body: "
    Debug responseBody

    ; ------------------------------------------------------------------------------------------------------------
    ; Cleanup our ScMinidriver session...

    ; When finished with operations that required authentication, you may if you wish, deauthenticate the session.
    success = CkScMinidriver::ckPinDeauthenticate(scmd,"user")
    If success = 0
        Debug CkScMinidriver::ckLastErrorText(scmd)
    EndIf

    ; Delete the context when finished with the card.
    success = CkScMinidriver::ckDeleteContext(scmd)
    If success = 0
        Debug CkScMinidriver::ckLastErrorText(scmd)
    EndIf



    CkScMinidriver::ckDispose(scmd)
    CkCert::ckDispose(cert)
    CkHttp::ckDispose(http)


    ProcedureReturn
EndProcedure