(Ruby) Examine Client Certificates for an Accepted TLS Connection

Demonstrates how to access the client certificates for a TLS connection accepted by your application acting as the server.

Chilkat Ruby Downloads install from rubygems.org gem install chilkat or download... Ruby Library for Windows, MacOS, Linux, Alpine Linux

require 'chilkat'

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

listenSslSocket = Chilkat::CkSocket.new()

# An SSL/TLS server needs a digital certificate.  This example loads it from a PFX file.
# This is the server's certificate.

cert = Chilkat::CkCert.new()
success = cert.LoadPfxFile("qa_data/serverCert/myServerCert.pfx","pfx_password")
if (success != true)
    print cert.lastErrorText() + "\n";
    exit
end

# To accept client client certificates in the TLS handshake,
# we must indicate a list of acceptable client certificate root CA DN's
# that are allowed.  (DN is an acronym for Distinguished Name.)
# Call AddSslAcceptableClientCaDn once for each acceptable CA DN.
# Here are a few examples so you can see the general format of a DN.
listenSslSocket.AddSslAcceptableClientCaDn("C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root")
listenSslSocket.AddSslAcceptableClientCaDn("O=Digital Signature Trust Co., CN=DST Root CA X3")

# Initialize with our server's TLS certificate.
success = listenSslSocket.InitSslServer(cert)
if (success != true)
    print listenSslSocket.lastErrorText() + "\n";
    exit
end

# Bind and listen on a port:
myPort = 8123
# Allow for a max of 5 queued connect requests.
backLog = 5
success = listenSslSocket.BindAndListen(myPort,backLog)
if (success != true)
    print listenSslSocket.lastErrorText() + "\n";
    exit
end

# Accept the next incoming connection.
maxWaitMillisec = 20000
# clientSock is a CkSocket
clientSock = listenSslSocket.AcceptNextConnection(maxWaitMillisec)
if (listenSslSocket.get_LastMethodSuccess() == false)
    print listenSslSocket.lastErrorText() + "\n";
    exit
end

# Examine the client certs chain.  The 1st cert will be the client certificate, and
# the subsequent certs will be the certs in the chain of authentication.
numClientCerts = clientSock.get_NumReceivedClientCerts()
print "numClientCerts = " + numClientCerts.to_s() + "\n";

i = 0
while i < numClientCerts
    # clientCert is a CkCert
    clientCert = clientSock.GetReceivedClientCert(i)
    print clientCert.subjectDN() + "\n";

    i = i + 1
end

# Close the connection with the client
success = clientSock.Close(1000)