Advertise Acceptable Client CA Names for Mutual TLS

See more Socket/SSL/TLS Examples

Demonstrates Socket.AddSslAcceptableClientCaDn, which adds a certificate-authority distinguished name to the list a TLS server advertises when requesting a client certificate for mutual TLS.

The file path is relative to the application's current working directory. An absolute path may also be used. Supply the path appropriate to your own environment.

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoSocket
    String sPfxPassword
    Variant vCert
    Handle hoCert
    String sTemp1

    Move False To iSuccess

    Get Create (RefClass(cComChilkatSocket)) To hoSocket
    If (Not(IsComObjectCreated(hoSocket))) Begin
        Send CreateComObject of hoSocket
    End

    //  For mutual TLS, advertise the acceptable client-certificate CA distinguished names BEFORE
    //  initializing server-side TLS.  Call once for each acceptable CA distinguished name.
    Get ComAddSslAcceptableClientCaDn Of hoSocket "CN=Example Root CA, O=Example, C=US" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSocket To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get ComAddSslAcceptableClientCaDn Of hoSocket "CN=Example Intermediate CA, O=Example, C=US" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSocket To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  The file path is relative to the application's current working directory.  An absolute path
    //  may also be used.  Supply the path appropriate to your own environment.
    //  The PFX password should come from a secure source rather than being hard-coded.
    Move "myPfxPassword" To sPfxPassword
    Get Create (RefClass(cComChilkatCert)) To hoCert
    If (Not(IsComObjectCreated(hoCert))) Begin
        Send CreateComObject of hoCert
    End
    Get ComLoadPfxFile Of hoCert "qa_data/server.pfx" sPfxPassword To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoCert To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Initialize server-side TLS.  The server will now request a client certificate and advertise the
    //  acceptable CA distinguished names added above.
    Get pvComObject of hoCert to vCert
    Get ComInitSslServer Of hoSocket vCert To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSocket To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "Server-side TLS configured to request client certificates."


End_Procedure