(PureBasic) Examine Client Certificates for an Accepted TLS Connection

Demonstrates how to access the client certificates for a TLS connection accepted by your application acting as the server.

Chilkat PureBasic Module Download Chilkat PureBasic Module

IncludeFile "CkSocket.pb"
IncludeFile "CkCert.pb"

Procedure ChilkatExample()

    ; This example requires the Chilkat API to have been previously unlocked.
    ; See Global Unlock Sample for sample code.

    listenSslSocket.i = CkSocket::ckCreate()
    If listenSslSocket.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; An SSL/TLS server needs a digital certificate.  This example loads it from a PFX file.
    ; This is the server's certificate.

    cert.i = CkCert::ckCreate()
    If cert.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success.i = CkCert::ckLoadPfxFile(cert,"qa_data/serverCert/myServerCert.pfx","pfx_password")
    If success <> 1
        Debug CkCert::ckLastErrorText(cert)
        CkSocket::ckDispose(listenSslSocket)
        CkCert::ckDispose(cert)
        ProcedureReturn
    EndIf

    ; To accept client client certificates in the TLS handshake,
    ; we must indicate a list of acceptable client certificate root CA DN's
    ; that are allowed.  (DN is an acronym for Distinguished Name.)
    ; Call AddSslAcceptableClientCaDn once for each acceptable CA DN.
    ; Here are a few examples so you can see the general format of a DN.
    CkSocket::ckAddSslAcceptableClientCaDn(listenSslSocket,"C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root")
    CkSocket::ckAddSslAcceptableClientCaDn(listenSslSocket,"O=Digital Signature Trust Co., CN=DST Root CA X3")

    ; Initialize with our server's TLS certificate.
    success = CkSocket::ckInitSslServer(listenSslSocket,cert)
    If success <> 1
        Debug CkSocket::ckLastErrorText(listenSslSocket)
        CkSocket::ckDispose(listenSslSocket)
        CkCert::ckDispose(cert)
        ProcedureReturn
    EndIf

    ; Bind and listen on a port:
    myPort.i = 8123
    ; Allow for a max of 5 queued connect requests.
    backLog.i = 5
    success = CkSocket::ckBindAndListen(listenSslSocket,myPort,backLog)
    If success <> 1
        Debug CkSocket::ckLastErrorText(listenSslSocket)
        CkSocket::ckDispose(listenSslSocket)
        CkCert::ckDispose(cert)
        ProcedureReturn
    EndIf

    ; Accept the next incoming connection.
    maxWaitMillisec.i = 20000
    clientSock.i = CkSocket::ckAcceptNextConnection(listenSslSocket,maxWaitMillisec)
    If CkSocket::ckLastMethodSuccess(listenSslSocket) = 0
        Debug CkSocket::ckLastErrorText(listenSslSocket)
        CkSocket::ckDispose(listenSslSocket)
        CkCert::ckDispose(cert)
        ProcedureReturn
    EndIf

    ; Examine the client certs chain.  The 1st cert will be the client certificate, and
    ; the subsequent certs will be the certs in the chain of authentication.
    numClientCerts.i = CkSocket::ckNumReceivedClientCerts(clientSock)
    Debug "numClientCerts = " + Str(numClientCerts)

    i.i = 0
    While i < numClientCerts
        clientCert.i = CkSocket::ckGetReceivedClientCert(clientSock,i)
        Debug CkCert::ckSubjectDN(clientCert)
        CkCert::ckDispose(clientCert)

        i = i + 1
    Wend

    ; Close the connection with the client
    success = CkSocket::ckClose(clientSock,1000)

    CkSocket::ckDispose(clientSock)



    CkSocket::ckDispose(listenSslSocket)
    CkCert::ckDispose(cert)


    ProcedureReturn
EndProcedure