Classic ASP

Advertise Acceptable Client CA Names for Mutual TLS

Demonstrates Socket.AddSslAcceptableClientCaDn, which adds a certificate-authority distinguished name to the list a TLS server advertises when requesting a client certificate for mutual TLS.

The file path is relative to the application's current working directory. An absolute path may also be used. Supply the path appropriate to your own environment.

Background. Call this once for each acceptable CA distinguished name, and add all names before calling InitSslServer. The server then requests a client certificate and advertises the configured acceptable CAs.

Chilkat Classic ASP Downloads

Download Chilkat for Classic ASP

Classic ASP

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<%
success = 0

set socket = Server.CreateObject("Chilkat.Socket")

'  For mutual TLS, advertise the acceptable client-certificate CA distinguished names BEFORE
'  initializing server-side TLS.  Call once for each acceptable CA distinguished name.
success = socket.AddSslAcceptableClientCaDn("CN=Example Root CA, O=Example, C=US")
If (success = 0) Then
    Response.Write "<pre>" & Server.HTMLEncode( socket.LastErrorText) & "</pre>"
    Response.End
End If

success = socket.AddSslAcceptableClientCaDn("CN=Example Intermediate CA, O=Example, C=US")
If (success = 0) Then
    Response.Write "<pre>" & Server.HTMLEncode( socket.LastErrorText) & "</pre>"
    Response.End
End If

'  The file path is relative to the application's current working directory.  An absolute path
'  may also be used.  Supply the path appropriate to your own environment.
'  The PFX password should come from a secure source rather than being hard-coded.
pfxPassword = "myPfxPassword"
set cert = Server.CreateObject("Chilkat.Cert")
success = cert.LoadPfxFile("qa_data/server.pfx",pfxPassword)
If (success = 0) Then
    Response.Write "<pre>" & Server.HTMLEncode( cert.LastErrorText) & "</pre>"
    Response.End
End If

'  Initialize server-side TLS.  The server will now request a client certificate and advertise the
'  acceptable CA distinguished names added above.
success = socket.InitSslServer(cert)
If (success = 0) Then
    Response.Write "<pre>" & Server.HTMLEncode( socket.LastErrorText) & "</pre>"
    Response.End
End If

Response.Write "<pre>" & Server.HTMLEncode( "Server-side TLS configured to request client certificates.") & "</pre>"

%>
</body>
</html>