Secure FTP with .crt and .pvk (private key file)

Chilkat FTP2 provides the ability to use a client certificate with secure FTP (implicit or explicit SSL/TLS). This example demonstrates how to load a certificate from separate .crt (or .cer) and .pvk files and use it as the client-side SSL cert. The .pvk contains the private key. The .crt/.cer file contains the PEM or DER encoded digital certificate. Note: Client-side certificates are only needed in situations where the server demands one.

Download Chilkat FTP2 ActiveX

CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @ftp int
    EXEC @hr = sp_OACreate 'Chilkat.Ftp2', @ftp OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    DECLARE @success int

    --  Any string unlocks the component for the 1st 30-days.
    EXEC sp_OAMethod @ftp, 'UnlockComponent', @success OUT, 'Anything for 30-day trial'
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @ftp, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        RETURN
      END

    --  You may use this account for testing.
    --  This account allows for directory listings and files
    --  to be downloaded.  However, file uploads are not allowed.
    EXEC sp_OASetProperty @ftp, 'Hostname', 'ftp.secureftp-test.com'
    EXEC sp_OASetProperty @ftp, 'Username', 'test'
    EXEC sp_OASetProperty @ftp, 'Password', 'test'

    --  Establish an explicit secure channel after connection
    --  on the standard FTP port 21.
    EXEC sp_OASetProperty @ftp, 'AuthTls', 1

    --  The Ssl property is for establishing an implicit SSL connection
    --  on port 990.  Do not set it.
    EXEC sp_OASetProperty @ftp, 'Ssl', 0

    DECLARE @cert int
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    --  LoadFromFile will load either PEM and DER formatted files.
    --  It automatically recognizes the file format based on the
    --  file contents.
    EXEC sp_OAMethod @cert, 'LoadFromFile', @success OUT, 'Test.crt'
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        RETURN
      END

    DECLARE @password nvarchar(4000)

    SELECT @password = 'test'
    DECLARE @pvk int
    EXEC @hr = sp_OACreate 'Chilkat.PrivateKey', @pvk OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    EXEC sp_OAMethod @pvk, 'LoadPvkFile', @success OUT, 'Test.pvk', @password
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @pvk, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        RETURN
      END

    --  Import the private key to a Windows key container and link
    --  it to the certificate.  (It's OK if the key is already
    --  imported and present in the key container...)
    DECLARE @bForSigning int

    DECLARE @bForKeyExchange int

    DECLARE @bMachineKeyset int

    DECLARE @bNeedPrivateKeyAccess int

    DECLARE @keyContainerName nvarchar(4000)

    --  Choose anything for the key container name.
    SELECT @keyContainerName = 'MyCertForFtp'

    --  We'll import the key to our logged-on user keyset rather
    --  than the machine keyset:
    SELECT @bMachineKeyset = 0

    SELECT @bNeedPrivateKeyAccess = 1

    --  Create a key container and import the private key.
    DECLARE @keyContainer int
    EXEC @hr = sp_OACreate 'Chilkat.KeyContainer', @keyContainer OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    EXEC sp_OAMethod @keyContainer, 'OpenContainer', @success OUT, @keyContainerName, @bNeedPrivateKeyAccess, @bMachineKeyset
    IF @success <> 1
      BEGIN
        EXEC sp_OAMethod @keyContainer, 'CreateContainer', @success OUT, @keyContainerName, @bMachineKeyset
      END
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @keyContainer, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        RETURN
      END
    --  Import the private key into the key container.
    --  We're using the key for key exchange, not signing:
    SELECT @bForKeyExchange = 0
    EXEC sp_OAMethod @keyContainer, 'ImportPrivateKey', @success OUT, @pvk, @bForKeyExchange
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @keyContainer, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        RETURN
      END

    --  Link the cert with the private key in the key container.
    SELECT @bForSigning = 1
    EXEC sp_OAMethod @cert, 'LinkPrivateKey', @success OUT, @keyContainerName, @bMachineKeyset, @bForSigning
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        RETURN
      END
    --  The cert now has access to a private key and is ready to be
    --  used...

    --  Use this certificate for our secure (SSL/TLS) connection:
    EXEC sp_OAMethod @ftp, 'SetSslClientCert', NULL, @cert

    --  Connect and login to the FTP server.  The connection is
    --  made secure because of the AuthTls setting.
    EXEC sp_OAMethod @ftp, 'Connect', @success OUT
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @ftp, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        RETURN
      END
    ELSE
      BEGIN
        --  LastErrorText contains information even when
        --  successful. This allows you to visually verify
        --  that the secure connection actually occurred.
        EXEC sp_OAGetProperty @ftp, 'LastErrorText', @sTmp0 OUT

        PRINT @sTmp0
      END

    PRINT 'Secure FTP Channel Established!'

    --  Do whatever you're doing to do ...
    --  upload files, download files, etc...

    EXEC sp_OAMethod @ftp, 'Disconnect', NULL

    --  The LastErrorText provides a detailed log of the
    --  SSL connection for both success and failed connections.
    --  Here is an example of a successful connection.
    --  The client certificate is logged as "ClientCertDN":

    --  ChilkatLog:
    --    Connect:
    --      DllDate: Aug 15 2007
    --      Hostname: ftp.secureftp-test.com
    --      Port: 21
    --      IdleTimeoutMs: 60000
    --      ConnectTimeout: 60
    --      HeartbeatMs: 0
    --      initialStatus: 220
    --      initialResponse: 220 FileZilla Server version 0.9.23 beta
    --      converting to secure connection...
    --      ClientCertDN: C=US, S=Illinois, L=Wheaton, O="Chilkat Software, Inc.", OU=Secure Application Development, CN="Chilkat Software, Inc."
    --      SSL Server Certificate not verified.
    --      ConnectionInfo:
    --        protocol: TLS1
    --        cipher: RC4
    --        cipherStrength: 128
    --        hash: MD5
    --        hashStrength: 128
    --        keyExchange: RSA
    --        keyExchangeStrength: 1024
    --      Secure Channel Established.
    --      successfully converted to secure connection...
    --      Features: 211-Features:
    --   MDTM
    --   REST STREAM
    --   SIZE
    --   MLST type*;size*;modify*;
    --   MLSD
    --   AUTH SSL
    --   AUTH TLS
    --   UTF8
    --   CLNT
    --   MFMT
    --  211 End
    --      Directory listings are utf-8
    --      Logging in...
    --      Username: test
    --      Login successful.
    --      Connect successful

END
GO