DataFlex

Require Specific FTPS Server Certificate Fields

Demonstrates the Chilkat Ftp2.SetSslCertRequirement method, which adds a required match against the FTP server certificate. The first argument selects the certificate field (such as SubjectCN or IssuerCN) and the second is the required value. It is a void method; a non-matching certificate causes the connection to fail.

Background: Standard TLS validation confirms a certificate is trusted and valid for the hostname, but it does not guarantee you reached the specific server you expect — a form of pinning closes that gap. Requiring a certificate field to match a known value rejects any certificate that does not, defending against a mis-issued or substituted certificate even if it would otherwise pass validation. Multiple requirements can be added, and all must be satisfied.

Chilkat DataFlex Downloads

Download Chilkat for DataFlex

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoFtp
    String sTemp1

    Move False To iSuccess

    //  Demonstrates the Ftp2.SetSslCertRequirement method, which adds a required match against the FTP
    //  server certificate.  The 1st argument selects the certificate field and the 2nd is the required
    //  value.  It is a void method.

    Get Create (RefClass(cComChilkatFtp2)) To hoFtp
    If (Not(IsComObjectCreated(hoFtp))) Begin
        Send CreateComObject of hoFtp
    End

    Set ComHostname Of hoFtp To "ftp.example.com"
    Set ComUsername Of hoFtp To "myFtpLogin"

    //  Normally you would not hard-code the password in source.  You should instead obtain it
    //  from an interactive prompt, environment variable, or a secrets vault.
    Set ComPassword Of hoFtp To "myPassword"

    //  Use explicit FTPS (AUTH TLS) on the standard FTP port.
    Set ComAuthTls Of hoFtp To True

    //  Require that the server certificate's subject common name matches an expected value.  If the
    //  presented certificate does not match, the TLS connection fails.  Supported fields include
    //  SubjectDN, SubjectCN, IssuerDN, IssuerCN, and others.
    Send ComSetSslCertRequirement To hoFtp "SubjectCN" "ftp.example.com"

    Get ComConnect Of hoFtp To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoFtp To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "Connected; server certificate met the requirement."

    Get ComDisconnect Of hoFtp To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoFtp To sTemp1
        Showln sTemp1
        Procedure_Return
    End



End_Procedure