(Tcl) Trust Specific Root CA Certificates

Demonstrates how to trust specific root CA certificates and none others.

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# This example assumes the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# This example will trust the Amazon root CA certificates provided at 
# https://www.amazontrust.com/repository/

# I've previously downloaded the root CA certificates to DER format.
# Add each to the Chilkat TrustedRoots singleton object.

set tRoots [new_CkTrustedRoots]

set caCert [new_CkCert]

set success [CkCert_LoadFromFile $caCert "qa_data/certs/aws_root_ca/AmazonRootCA1.cer"]
if {$success == 0} then {
    puts [CkCert_lastErrorText $caCert]
    delete_CkTrustedRoots $tRoots
    delete_CkCert $caCert
    exit
}

set success [CkTrustedRoots_AddCert $tRoots $caCert]

# Continue with the others.
# For brevity, we're not checking return values for success/failure.
set success [CkCert_LoadFromFile $caCert "qa_data/certs/aws_root_ca/AmazonRootCA2.cer"]
set success [CkTrustedRoots_AddCert $tRoots $caCert]

set success [CkCert_LoadFromFile $caCert "qa_data/certs/aws_root_ca/AmazonRootCA3.cer"]
set success [CkTrustedRoots_AddCert $tRoots $caCert]

set success [CkCert_LoadFromFile $caCert "qa_data/certs/aws_root_ca/AmazonRootCA4.cer"]
set success [CkTrustedRoots_AddCert $tRoots $caCert]

set success [CkCert_LoadFromFile $caCert "qa_data/certs/aws_root_ca/SFSRootCAG2.cer"]
set success [CkTrustedRoots_AddCert $tRoots $caCert]

# Indicate we don't want to automatically trust the operating system's installed root CA certificates.
# On a Windows operating system, this would be the registry-based CA certificate stores. 
# On a Linux system, this could be /etc/ssl/certs/ca-certificates.crt, if it exists.
CkTrustedRoots_put_TrustSystemCaRoots $tRoots 0

# Activate the trusted roots object.
# Once activated, all Chilkat objects that use TLS connections (HTTP, REST, Socket, MailMan, IMAP, FTP, etc.)
# will fail the TLS handshake if the server certificate is not verified and rooted with one of our explicitly trusted root certificates.
set success [CkTrustedRoots_Activate $tRoots]

set http [new_CkHttp]

# Note: We also need to explicitly indicate that server certificates are to be verified.
CkHttp_put_RequireSslCertVerify $http 1

# For example, the following should fail because www.chilkatsoft.com's server certificate is not rooted in one of the explicitly trusted root CA certs.
set success [CkHttp_Download $http "https://www.chilkatsoft.com/helloWorld.txt" "qa_output/helloWorld.txt"]
if {$success != 1} then {
    # The above Download should fail.
    puts [CkHttp_lastErrorText $http]

    # There should be a message in the LastErrorText indicating that we were "Unable to build certificate chain to root.."
}

# However, we should be able to make TLS connections to good.sca1a.amazontrust.com
set success [CkHttp_Download $http "https://good.sca1a.amazontrust.com/" "qa_output/valid.html"]
if {$success != 1} then {
    puts [CkHttp_lastErrorText $http]
    delete_CkTrustedRoots $tRoots
    delete_CkCert $caCert
    delete_CkHttp $http
    exit
}

# We can still examine the LastErrorText and we'll find this message within:  
# "The public key was successfully validated against the public key of the explicitly trusted root cert."
puts [CkHttp_lastErrorText $http]

puts "Success!"

delete_CkTrustedRoots $tRoots
delete_CkCert $caCert
delete_CkHttp $http