Zig

Trust Specific Root CA Certificates

See more Certificates Examples

Demonstrates how to trust specific root CA certificates and none others. Zig

const std = @import("std");
const chilkat = @import("chilkat");

pub fn main(init: std.process.Init) !void {
    const alloc = init.arena.allocator();

    // This example assumes the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // This example will trust the Amazon root CA certificates provided at
    // https://www.amazontrust.com/repository/

    // I've previously downloaded the root CA certificates to DER format.
    // Add each to the Chilkat TrustedRoots singleton object.

    const t_roots = try chilkat.TrustedRoots.init();
    defer t_roots.deinit();

    const ca_cert = try chilkat.Cert.init();
    defer ca_cert.deinit();
    ca_cert.loadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA1.cer") catch {
        std.debug.print("{s}\n", .{try ca_cert.getLastErrorText(alloc)});
        return;
    };

    try t_roots.addCert(ca_cert);

    // Continue with the others.
    // For brevity, we're not checking return values for success/failure.
    try ca_cert.loadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA2.cer");
    try t_roots.addCert(ca_cert);

    try ca_cert.loadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA3.cer");
    try t_roots.addCert(ca_cert);

    try ca_cert.loadFromFile("qa_data/certs/aws_root_ca/AmazonRootCA4.cer");
    try t_roots.addCert(ca_cert);

    try ca_cert.loadFromFile("qa_data/certs/aws_root_ca/SFSRootCAG2.cer");
    try t_roots.addCert(ca_cert);

    // Indicate we don't want to automatically trust the operating system's installed root CA certificates.
    // On a Windows operating system, this would be the registry-based CA certificate stores.
    // On a Linux system, this could be /etc/ssl/certs/ca-certificates.crt, if it exists.
    t_roots.setTrustSystemCaRoots(false);

    // Activate the trusted roots object.
    // Once activated, all Chilkat objects that use TLS connections (HTTP, REST, Socket, MailMan, IMAP, FTP, etc.)
    // will fail the TLS handshake if the server certificate is not verified and rooted with one of our explicitly trusted root certificates.
    try t_roots.activate();

    const http = try chilkat.Http.init();
    defer http.deinit();

    // Note: We also need to explicitly indicate that server certificates are to be verified.
    http.setRequireSslCertVerify(true);

    // For example, the following should fail because www.chilkatsoft.com's server certificate is not rooted in one of the explicitly trusted root CA certs.
    http.download("https://www.chilkatsoft.com/helloWorld.txt", "qa_output/helloWorld.txt") catch {
        // The above Download should fail.
        std.debug.print("{s}\n", .{try http.getLastErrorText(alloc)});

        // There should be a message in the LastErrorText indicating that we were "Unable to build certificate chain to root.."
    };

    // However, we should be able to make TLS connections to good.sca1a.amazontrust.com
    http.download("https://good.sca1a.amazontrust.com/", "qa_output/valid.html") catch {
        std.debug.print("{s}\n", .{try http.getLastErrorText(alloc)});
        return;
    };

    // We can still examine the LastErrorText and we'll find this message within:
    // "The public key was successfully validated against the public key of the explicitly trusted root cert."
    std.debug.print("{s}\n", .{try http.getLastErrorText(alloc)});

    std.debug.print("Success!\n", .{});
}