(Tcl) Examine Client Certificates for an Accepted TLS Connection

Demonstrates how to access the client certificates for a TLS connection accepted by your application acting as the server.

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

set listenSslSocket [new_CkSocket]

# An SSL/TLS server needs a digital certificate.  This example loads it from a PFX file.
# This is the server's certificate.

set cert [new_CkCert]

set success [CkCert_LoadPfxFile $cert "qa_data/serverCert/myServerCert.pfx" "pfx_password"]
if {$success != 1} then {
    puts [CkCert_lastErrorText $cert]
    delete_CkSocket $listenSslSocket
    delete_CkCert $cert
    exit
}

# To accept client client certificates in the TLS handshake,
# we must indicate a list of acceptable client certificate root CA DN's
# that are allowed.  (DN is an acronym for Distinguished Name.)
# Call AddSslAcceptableClientCaDn once for each acceptable CA DN.
# Here are a few examples so you can see the general format of a DN.
CkSocket_AddSslAcceptableClientCaDn $listenSslSocket "C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root"
CkSocket_AddSslAcceptableClientCaDn $listenSslSocket "O=Digital Signature Trust Co., CN=DST Root CA X3"

# Initialize with our server's TLS certificate.
set success [CkSocket_InitSslServer $listenSslSocket $cert]
if {$success != 1} then {
    puts [CkSocket_lastErrorText $listenSslSocket]
    delete_CkSocket $listenSslSocket
    delete_CkCert $cert
    exit
}

# Bind and listen on a port:
set myPort 8123
# Allow for a max of 5 queued connect requests.
set backLog 5
set success [CkSocket_BindAndListen $listenSslSocket $myPort $backLog]
if {$success != 1} then {
    puts [CkSocket_lastErrorText $listenSslSocket]
    delete_CkSocket $listenSslSocket
    delete_CkCert $cert
    exit
}

# Accept the next incoming connection.
set maxWaitMillisec 20000
# clientSock is a CkSocket
set clientSock [CkSocket_AcceptNextConnection $listenSslSocket $maxWaitMillisec]
if {[CkSocket_get_LastMethodSuccess $listenSslSocket] == 0} then {
    puts [CkSocket_lastErrorText $listenSslSocket]
    delete_CkSocket $listenSslSocket
    delete_CkCert $cert
    exit
}

# Examine the client certs chain.  The 1st cert will be the client certificate, and
# the subsequent certs will be the certs in the chain of authentication.
set numClientCerts [CkSocket_get_NumReceivedClientCerts $clientSock]
puts "numClientCerts = $numClientCerts"

set i 0
while {$i < $numClientCerts} {
    # clientCert is a CkCert
    set clientCert [CkSocket_GetReceivedClientCert $clientSock $i]
    puts [CkCert_subjectDN $clientCert]
    delete_CkCert $clientCert

    set i [expr $i + 1]
}

# Close the connection with the client
set success [CkSocket_Close $clientSock 1000]

delete_CkSocket $clientSock


delete_CkSocket $listenSslSocket
delete_CkCert $cert