(SQL Server) (PKCS11) Use a Smart Card Certificate + Private Key for SSL/TLS Authentication

See more ScMinidriver Examples

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @iTmp0 int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    -- This example requires the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    -- Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

    DECLARE @pkcs11 int
    -- Use "Chilkat_9_5_0.Pkcs11" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Pkcs11', @pkcs11 OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    -- Set your shared lib path -- either a full path to the DLL, .so, or .dylib,
    -- or just the filename if the driver is in a location that can be automatically found. (Such as in C:\Windows\System32)
    EXEC sp_OASetProperty @pkcs11, 'SharedLibPath', 'C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll'

    DECLARE @success int
    EXEC sp_OAMethod @pkcs11, 'Initialize', @success OUT
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @pkcs11, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @pkcs11
        RETURN
      END

    -- Pass -1 for the slotID to open a session on the first non-empty slot.
    DECLARE @slotID int
    SELECT @slotID = -1

    -- Open a session.
    DECLARE @readWrite int
    SELECT @readWrite = 1
    EXEC sp_OAMethod @pkcs11, 'OpenSession', @success OUT, @slotID, @readWrite
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @pkcs11, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @pkcs11
        RETURN
      END

    -- Make it an authenticated session by calling Login.
    -- 
    -- If we don't authenticate, then we won't be able to see the private keys, and thus
    -- we won't know which certificates have an associated private key stored on the smart card.

    -- The smart card PIN is passed to the Login method.
    -- userType 1 indicates a "Normal User".
    DECLARE @userType int
    SELECT @userType = 1
    DECLARE @pin nvarchar(4000)
    SELECT @pin = '0000'
    EXEC sp_OAMethod @pkcs11, 'Login', @success OUT, @userType, @pin
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @pkcs11, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC sp_OAMethod @pkcs11, 'CloseSession', @success OUT
        EXEC @hr = sp_OADestroy @pkcs11
        RETURN
      END

    DECLARE @cert int
    -- Use "Chilkat_9_5_0.Cert" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert OUT

    -- Find a certificate by the Subject Common Name
    EXEC sp_OAMethod @pkcs11, 'FindCert', @success OUT, 'subjectCN', 'BadSSL Client Certificate', @cert
    IF @success = 1
      BEGIN

        EXEC sp_OAGetProperty @cert, 'SubjectCN', @sTmp0 OUT
        PRINT 'Found: ' + @sTmp0
      END
    ELSE
      BEGIN

        EXEC sp_OAGetProperty @cert, 'SubjectCN', @sTmp0 OUT
        PRINT 'Not found: ' + @sTmp0
        EXEC sp_OAMethod @pkcs11, 'CloseSession', @success OUT
        EXEC @hr = sp_OADestroy @pkcs11
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END


    PRINT 'Successfully loaded the cert object from the smart card / USB token.'

    -- Note: When successful, the cert object is internally linked to the Pkcs11 object's authenticated session.
    -- The cert object can now be used to sign or do other cryptographic operations that occur on the smart card / USB token.

    -- ------------------------------------------------------------------------------------------------------------

    -- Send an HTTPS request to https://client.badssl.com
    -- https://client.badssl.com (part of the badssl.com service) lets you test authentication using client SSL certificates. 
    -- The client certificate can be downloaded from https://badssl.com/download/.
    -- This server returns 200 OK if the correct client certificate is provided, and 400 Bad Request otherwise.

    DECLARE @http int
    -- Use "Chilkat_9_5_0.Http" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Http', @http OUT

    -- Provide the client certificate (linked internally to our authenticated smartcard session)
    EXEC sp_OAMethod @http, 'SetSslClientCert', @success OUT, @cert
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @http, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC sp_OAMethod @pkcs11, 'CloseSession', @success OUT
        EXEC @hr = sp_OADestroy @pkcs11
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @http
        RETURN
      END

    DECLARE @responseBody nvarchar(4000)
    EXEC sp_OAMethod @http, 'QuickGetStr', @responseBody OUT, 'https://client.badssl.com/'
    EXEC sp_OAGetProperty @http, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 = 0
      BEGIN
        EXEC sp_OAGetProperty @http, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC sp_OAMethod @pkcs11, 'CloseSession', @success OUT
        EXEC @hr = sp_OADestroy @pkcs11
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @http
        RETURN
      END


    EXEC sp_OAGetProperty @http, 'LastStatus', @iTmp0 OUT
    PRINT 'Response status code: ' + @iTmp0

    PRINT 'Response body: '

    PRINT @responseBody

    -- ------------------------------------------------------------------------------------------------------------
    -- Revert to an unauthenticated session by calling Logout.
    EXEC sp_OAMethod @pkcs11, 'Logout', @success OUT
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @pkcs11, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC sp_OAMethod @pkcs11, 'CloseSession', @success OUT
        EXEC @hr = sp_OADestroy @pkcs11
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @http
        RETURN
      END

    -- When finished, close the session.
    -- It is important to close the session (memory leaks will occur if the session is not properly closed).
    EXEC sp_OAMethod @pkcs11, 'CloseSession', @success OUT
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @pkcs11, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @pkcs11
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @http
        RETURN
      END


    PRINT 'Success.'

    EXEC @hr = sp_OADestroy @pkcs11
    EXEC @hr = sp_OADestroy @cert
    EXEC @hr = sp_OADestroy @http


END
GO