DataFlex

(PKCS11) Use a Smart Card Certificate + Private Key for SSL/TLS Authentication

See more ScMinidriver Examples

Demonstrates how to use a certificate + private key located on a smart card for the TLS client certificate in an HTTPS request. DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoPkcs11
    Integer iSlotID
    Boolean iReadWrite
    Integer iUserType
    String sPin
    Variant vCert
    Handle hoCert
    Handle hoHttp
    String sResponseBody
    String sTemp1
    Integer iTemp1
    Boolean bTemp1

    Move False To iSuccess

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

    Get Create (RefClass(cComChilkatPkcs11)) To hoPkcs11
    If (Not(IsComObjectCreated(hoPkcs11))) Begin
        Send CreateComObject of hoPkcs11
    End

    // Set your shared lib path -- either a full path to the DLL, .so, or .dylib,
    // or just the filename if the driver is in a location that can be automatically found. (Such as in C:\Windows\System32)
    Set ComSharedLibPath Of hoPkcs11 To "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll"

    Get ComInitialize Of hoPkcs11 To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Pass -1 for the slotID to open a session on the first non-empty slot.
    Move -1 To iSlotID

    // Open a session.
    Move True To iReadWrite
    Get ComOpenSession Of hoPkcs11 iSlotID iReadWrite To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Make it an authenticated session by calling Login.
    // 
    // If we don't authenticate, then we won't be able to see the private keys, and thus
    // we won't know which certificates have an associated private key stored on the smart card.

    // The smart card PIN is passed to the Login method.
    // userType 1 indicates a "Normal User".
    Move 1 To iUserType
    Move "0000" To sPin
    Get ComLogin Of hoPkcs11 iUserType sPin To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Get ComCloseSession Of hoPkcs11 To iSuccess
        Procedure_Return
    End

    Get Create (RefClass(cComChilkatCert)) To hoCert
    If (Not(IsComObjectCreated(hoCert))) Begin
        Send CreateComObject of hoCert
    End

    // Find a certificate by the Subject Common Name
    Get pvComObject of hoCert to vCert
    Get ComFindCert Of hoPkcs11 "subjectCN" "BadSSL Client Certificate" vCert To iSuccess
    If (iSuccess = True) Begin
        Get ComSubjectCN Of hoCert To sTemp1
        Showln "Found: " sTemp1
    End
    Else Begin
        Get ComSubjectCN Of hoCert To sTemp1
        Showln "Not found: " sTemp1
        Get ComCloseSession Of hoPkcs11 To iSuccess
        Procedure_Return
    End

    Showln "Successfully loaded the cert object from the smart card / USB token."

    // Note: When successful, the cert object is internally linked to the Pkcs11 object's authenticated session.
    // The cert object can now be used to sign or do other cryptographic operations that occur on the smart card / USB token.

    // ------------------------------------------------------------------------------------------------------------

    // Send an HTTPS request to https://client.badssl.com
    // https://client.badssl.com (part of the badssl.com service) lets you test authentication using client SSL certificates. 
    // The client certificate can be downloaded from https://badssl.com/download/.
    // This server returns 200 OK if the correct client certificate is provided, and 400 Bad Request otherwise.

    Get Create (RefClass(cComChilkatHttp)) To hoHttp
    If (Not(IsComObjectCreated(hoHttp))) Begin
        Send CreateComObject of hoHttp
    End

    // Provide the client certificate (linked internally to our authenticated smartcard session)
    Get pvComObject of hoCert to vCert
    Get ComSetSslClientCert Of hoHttp vCert To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoHttp To sTemp1
        Showln sTemp1
        Get ComCloseSession Of hoPkcs11 To iSuccess
        Procedure_Return
    End

    Get ComQuickGetStr Of hoHttp "https://client.badssl.com/" To sResponseBody
    Get ComLastMethodSuccess Of hoHttp To bTemp1
    If (bTemp1 = False) Begin
        Get ComLastErrorText Of hoHttp To sTemp1
        Showln sTemp1
        Get ComCloseSession Of hoPkcs11 To iSuccess
        Procedure_Return
    End

    Get ComLastStatus Of hoHttp To iTemp1
    Showln "Response status code: " iTemp1
    Showln "Response body: "
    Showln sResponseBody

    // ------------------------------------------------------------------------------------------------------------
    // Revert to an unauthenticated session by calling Logout.
    Get ComLogout Of hoPkcs11 To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Get ComCloseSession Of hoPkcs11 To iSuccess
        Procedure_Return
    End

    // When finished, close the session.
    // It is important to close the session (memory leaks will occur if the session is not properly closed).
    Get ComCloseSession Of hoPkcs11 To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "Success."


End_Procedure