Add a Certificate Identity to a PFX

See more PFX/P12 Examples

Demonstrates Pfx.AddCert, which adds a certificate as an identity in the PFX. The example loads the certificate from a .cer file and associates its private key from a PEM file (via Cert.SetPrivateKeyPem) before adding it.

The file paths are relative to the application's current working directory. Absolute paths may also be used. Supply the paths appropriate to your own environment.

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoPfx
    Variant vCert
    Handle hoCert
    Handle hoSbPem
    Boolean iBIncludeChain
    String sTemp1

    Move False To iSuccess

    Get Create (RefClass(cComChilkatPfx)) To hoPfx
    If (Not(IsComObjectCreated(hoPfx))) Begin
        Send CreateComObject of hoPfx
    End

    //  The file paths are relative to the application's current working directory.  Absolute paths may
    //  also be used.  Supply the paths appropriate to your own environment.

    //  Load the certificate from a .cer file.
    Get Create (RefClass(cComChilkatCert)) To hoCert
    If (Not(IsComObjectCreated(hoCert))) Begin
        Send CreateComObject of hoCert
    End
    Get ComLoadFromFile Of hoCert "qa_data/certificate.cer" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoCert To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Load the matching private key from a PEM file and associate it with the certificate.  AddCert
    //  requires the certificate to have an accessible private key -- Chilkat must be able to obtain and
    //  copy the actual private-key bytes.
    Get Create (RefClass(cComChilkatStringBuilder)) To hoSbPem
    If (Not(IsComObjectCreated(hoSbPem))) Begin
        Send CreateComObject of hoSbPem
    End
    Get ComLoadFile Of hoSbPem "qa_data/private_key.pem" "utf-8" To iSuccess
    If (iSuccess = False) Begin
        Showln "Failed to load the private key PEM."
        Procedure_Return
    End

    Get ComGetAsString Of hoSbPem To sTemp1
    Get ComSetPrivateKeyPem Of hoCert sTemp1 To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoCert To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Add the certificate (and its chain) as an identity in the PFX.  Set the 2nd argument to True to
    //  include the certificate's chain of authority.
    Move True To iBIncludeChain
    Get pvComObject of hoCert to vCert
    Get ComAddCert Of hoPfx vCert iBIncludeChain To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPfx To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "Certificate added to the PFX."

    //  Note: the private-key material must be accessible to the application.  A certificate whose private
    //  key is non-exportable -- for example a non-exportable key in a Windows certificate store or an
    //  Apple keychain, or a key on a smartcard/HSM -- cannot be added to a PFX, because the private-key
    //  bytes are inaccessible.  A certificate with an exportable key in a Windows certificate store or an
    //  Apple keychain, however, can be added, because its private-key bytes can be obtained.


End_Procedure