(Tcl) Use a Custom Set of Trusted Root Certificates

Demonstrates how to build a set of trusted root certificates to be used globally by all Chilkat classes.

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

set trustedRoots [new_CkTrustedRoots]

#  Indicate that we will NOT trust any pre-installed certificates on the system.
CkTrustedRoots_put_TrustSystemCaRoots $trustedRoots 0

# Thawte is a certificate authority that provides a .zip download of their
# root CA certificates:  https://www.thawte.com/roots/index.html
# The direct download link is: https://www.verisign.com/support/thawte-roots.zip
# Note: The above URLs are valid at the time of writing this example (29-May-2015).

# Assuming the .zip has already been downloaded, open it and load each .pem file into
# our trusted roots object.
set zip [new_CkZip]

# Open a .zip containing PEM files, among other things..
set success [CkZip_OpenZip $zip "qa_data/certs/thawte-roots.zip"]
if {$success != 1} then {
    puts [CkZip_lastErrorText $zip]
    delete_CkTrustedRoots $trustedRoots
    delete_CkZip $zip
    exit
}

# entry is a CkZipEntry
set entry [CkZip_FirstMatchingEntry $zip "*.pem"]
if {[CkZip_get_LastMethodSuccess $zip] != 1} then {
    puts "No entries matched."
    delete_CkTrustedRoots $trustedRoots
    delete_CkZip $zip
    exit
}

# nextEntry is a CkZipEntry

set cert [new_CkCert]

set bHasMoreEntries 1
while {$bHasMoreEntries == 1} {

    puts "Entry: [CkZipEntry_fileName $entry]"

    # Get the PEM of the CA cert:
    set pemStr [CkZipEntry_unzipToString $entry 0 "utf-8"]

    # Load it into a certificate object:
    set success [CkCert_LoadPem $cert $pemStr]
    if {$success != 1} then {
        puts [CkCert_lastErrorText $cert]
    }

    # Add it to the trusted roots.
    CkTrustedRoots_AddCert $trustedRoots $cert

    # The NextMatchingEntry method was added in v9.5.0.50
    set nextEntry [CkZipEntry_NextMatchingEntry $entry "*.pem"]
    set bHasMoreEntries [CkZipEntry_get_LastMethodSuccess $entry]

    delete_CkZipEntry $entry

    set entry $nextEntry
}

#  Activate the trusted roots globally for all Chilkat objects.
#  This call really shouldn't fail, so we're not checking the return value.
set success [CkTrustedRoots_Activate $trustedRoots]

delete_CkTrustedRoots $trustedRoots
delete_CkZip $zip
delete_CkCert $cert