Extract Public/Private Keys and Certs from PFX into String Variables

Demonstrates how to export certificates and public/private keys from a PFX file into in-memory strings.

uses
    Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
    Dialogs, StdCtrls,
    CHILKATCERTIFICATELib_TLB,
    OleCtrls;

...

procedure TForm1.Button1Click(Sender: TObject);
var
success: Integer;
certStore: CHILKATCERTIFICATELib_TLB.IChilkatCertStore;
password: String;
i: Integer;
numCerts: Integer;
cert: IChilkatCert;
fname: String;
encodedCert: String;
cert2: TChilkatCert;
pvkey: IPrivateKey;
pemPvKey: String;
pkcs8PvKey: String;
xmlPvKey: String;
pvKey2: IPrivateKey;
pubkey: IPublicKey;
pubKeyPem: String;
pubKeyXml: String;
pubKey2: IPublicKey;

begin

certStore := CoChilkatCertStore.Create();

//  Load the PFX file into a certificate store object

password := '*myPassword2*';
success := certStore.LoadPfxFile('chilkat.pfx',password);
if (success <> 1) then
  begin
    ShowMessage(certStore.LastErrorText);

  end;

numCerts := certStore.NumCertificates;

//  Loop over each certificate in the PFX.

for i := 0 to numCerts - 1 do
  begin

    cert := certStore.GetCertificate(i);

    Memo1.Lines.Add(cert.SubjectDN);
    Memo1.Lines.Add('---');

    encodedCert := cert.GetEncoded();

    //  This string may now be stored in a relational database string field.
    //  To re-create the cert, do this:
    cert2 := TChilkatCert.Create(Self);
    cert2.SetFromEncoded(encodedCert);

    //  Does this cert have a private key?
    if (cert.HasPrivateKey() = 1) then
      begin

        //  Get the private key.

        pvkey := cert.ExportPrivateKey();

        //  The private key can be exported into
        //  a string in PKCS8, RSA PEM, or XML format:

        pemPvKey := pvkey.GetRsaPem();
        pkcs8PvKey := pvkey.GetPkcs8Pem();
        xmlPvKey := pvkey.GetXml();

        Memo1.Lines.Add(pemPvKey);
        Memo1.Lines.Add(pkcs8PvKey);
        Memo1.Lines.Add(xmlPvKey);

        //  Any of these formatted strings may
        //  be stored in a relational database field.
        //  to restore, call LoadPem or LoadXml
        //  LoadPem accepts either RSA PEM or
        //  PKCS8 PEM:
        pvKey2 := TPrivateKey.Create(Self);

        pvKey2.LoadPem(pemPvKey);
        pvKey2.LoadPem(pkcs8PvKey);
        pvKey2.LoadXml(xmlPvKey);

      end;

    //  Now for the public key:

    pubkey := cert.ExportPublicKey();

    //  It can be exported to a string as OpenSSL PEM
    //  or XML:

    pubKeyPem := pubkey.GetOpenSslPem();
    pubKeyXml := pubkey.GetXml();

    Memo1.Lines.Add(pubKeyPem);
    Memo1.Lines.Add(pubKeyXml);

    //  To re-load a PublicKey object, call LoadXml
    //  or LoadOpenSslPem:
    pubKey2 := TPublicKey.Create(Self);

    pubKey2.LoadOpenSslPem(pubKeyPem);
    pubKey2.LoadXml(pubKeyXml);
    fname := 'pubkey' + IntToStr(i) + '_openSsl.der';
    pubkey.SaveOpenSslDerFile(fname);

  end;

//  The Chilkat Certificate, Certificate Store, Private Key,
//  Public Key, and Key Container classes / objects are freeware.

//  They are used by and included with the Chilkat Email,
//  Crypt, S/MIME, and other commercial Chilkat components.

end;