DataFlex

Get and Inspect the FTPS Server Certificate Before Login

Demonstrates the Chilkat Ftp2.GetServerCert method, which loads the leaf certificate presented on the connected FTPS control channel into a Cert object. The only argument is the Cert; an active TLS control connection is required. This example uses ConnectOnly followed by LoginAfterConnectOnly so the certificate can be inspected before any credentials are sent.

Background: Chilkat validates the server certificate during the TLS handshake, but an application often needs to apply its own check — pinning a fingerprint, matching a subject, or enforcing an internal policy — and the safe moment to do that is before revealing the login. Splitting the handshake with ConnectOnly establishes TLS and makes the certificate available via GetServerCert, while deferring USER and PASS to LoginAfterConnectOnly. If the certificate fails inspection you simply disconnect, and an untrusted or impersonating server never receives the credentials. For declarative pinning without writing inspection code, SetSslCertRequirement lets you require certificate-field values up front.

Chilkat DataFlex Downloads

Download Chilkat for DataFlex

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoFtp
    Variant vCert
    Handle hoCert
    String sTemp1

    Move False To iSuccess

    //  Demonstrates the Ftp2.GetServerCert method, which loads the leaf certificate presented on the
    //  connected FTPS control channel into a Cert object.  The only argument is the Cert.  It requires
    //  an active TLS control connection.
    //  
    //  This example uses ConnectOnly + LoginAfterConnectOnly so the server certificate can be
    //  inspected and validated BEFORE any credentials are sent.

    Get Create (RefClass(cComChilkatFtp2)) To hoFtp
    If (Not(IsComObjectCreated(hoFtp))) Begin
        Send CreateComObject of hoFtp
    End

    Set ComHostname Of hoFtp To "ftp.example.com"

    //  Use explicit FTPS (AUTH TLS) on the standard FTP port.
    Set ComAuthTls Of hoFtp To True

    //  Establish the connection and TLS layer and receive the greeting, but do NOT send USER/PASS.
    Get ComConnectOnly Of hoFtp To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoFtp To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  The TLS control channel is now up.  Retrieve the server's certificate for inspection.
    Get Create (RefClass(cComChilkatCert)) To hoCert
    If (Not(IsComObjectCreated(hoCert))) Begin
        Send CreateComObject of hoCert
    End
    Get pvComObject of hoCert to vCert
    Get ComGetServerCert Of hoFtp vCert To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoFtp To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get ComSubjectCN Of hoCert To sTemp1
    Showln "Server certificate subject: " sTemp1
    Get ComIssuerCN Of hoCert To sTemp1
    Showln "Issued by: " sTemp1

    //  Perform any application-specific validation of the server certificate here -- for example,
    //  compare the fingerprint or subject against an expected value.  Only proceed to authenticate if
    //  the certificate is acceptable.  Because no credentials have been sent yet, an untrusted server
    //  never sees the username or password.
    //  
    //    if (certificate is not acceptable) { return; }

    //  The certificate passed inspection, so now provide credentials and authenticate.
    Set ComUsername Of hoFtp To "myFtpLogin"

    //  Normally you would not hard-code the password in source.  You should instead obtain it
    //  from an interactive prompt, environment variable, or a secrets vault.
    Set ComPassword Of hoFtp To "myPassword"

    Get ComLoginAfterConnectOnly Of hoFtp To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoFtp To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "Authenticated after verifying the server certificate."

    Get ComDisconnect Of hoFtp To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoFtp To sTemp1
        Showln sTemp1
        Procedure_Return
    End



End_Procedure