Delphi DLL

Verify and Pin the FTPS Server Certificate

Demonstrates the certificate-verification properties RequireSslCertVerify, TlsPinSet, and the read-only SslServerCertVerified.

Background: By default a TLS connection is not rejected merely because certificate-chain verification fails, so RequireSslCertVerify = true is the important hardening step — it makes an expired, unsigned, or untrusted certificate abort the connection. TlsPinSet adds public-key pinning on top: the handshake fails unless the server's SPKI fingerprint matches one you configured, defending against a mis-issued certificate that would otherwise validate. Pinning supplements verification rather than replacing it. SslServerCertVerified reports the outcome.

Chilkat Delphi DLL Downloads

Download Chilkat for Delphi DLL

Delphi DLL

var
success: Boolean;
ftp: HCkFtp2;

begin
success := False;

ftp := CkFtp2_Create();

CkFtp2_putHostname(ftp,'ftp.example.com');
CkFtp2_putUsername(ftp,'myFtpLogin');

CkFtp2_putAuthTls(ftp,True);

//  Normally you would not hard-code the password in source.  You should instead obtain it
//  from an interactive prompt, environment variable, or a secrets vault.
CkFtp2_putPassword(ftp,'myPassword');

//  Reject the connection if the server certificate cannot be verified (expired, bad signature,
//  untrusted chain, etc.).  The default is 0, which does not reject on verification
//  failure -- set 1 for security.
CkFtp2_putRequireSslCertVerify(ftp,True);

//  Optionally pin the server's public key.  If none of the configured SPKI fingerprints matches,
//  the TLS handshake fails.  Pinning supplements normal verification; it does not replace it.
CkFtp2_putTlsPinSet(ftp,'sha256//YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=');

success := CkFtp2_Connect(ftp);
if (success = False) then
  begin
    Memo1.Lines.Add(CkFtp2__lastErrorText(ftp));
    Exit;
  end;

//  SslServerCertVerified reports whether the certificate chain was successfully verified.
if (CkFtp2_getSslServerCertVerified(ftp)) then
  begin
    Memo1.Lines.Add('The server certificate was verified.');
  end;

success := CkFtp2_Disconnect(ftp);
if (success = False) then
  begin
    Memo1.Lines.Add(CkFtp2__lastErrorText(ftp));
    Exit;
  end;

CkFtp2_Dispose(ftp);