Lianja

Add a Certificate Identity to a PFX

Demonstrates Pfx.AddCert, which adds a certificate as an identity in the PFX. The example loads the certificate from a .cer file and associates its private key from a PEM file (via Cert.SetPrivateKeyPem) before adding it.

The file paths are relative to the application's current working directory. Absolute paths may also be used. Supply the paths appropriate to your own environment.

Background. AddCert requires the certificate to have an accessible private key that Chilkat can obtain and copy. A certificate whose private key is non-exportable — for example a non-exportable key in a Windows certificate store or an Apple keychain, or a key on a smartcard/HSM — cannot be added to a PFX, because the private-key bytes are inaccessible. A certificate whose private key is exportable in these same locations, however, can be added to the PFX, because its private-key bytes can be obtained. Set the include-chain argument to true to also add the certificate's chain of authority.

Chilkat Lianja Downloads

Download Chilkat for Lianja

Lianja

llSuccess = .F.

loPfx = createobject("CkPfx")

//  The file paths are relative to the application's current working directory.  Absolute paths may
//  also be used.  Supply the paths appropriate to your own environment.

//  Load the certificate from a .cer file.
loCert = createobject("CkCert")
llSuccess = loCert.LoadFromFile("qa_data/certificate.cer")
if (llSuccess = .F.) then
    ? loCert.LastErrorText
    release loPfx
    release loCert
    return
endif

//  Load the matching private key from a PEM file and associate it with the certificate.  AddCert
//  requires the certificate to have an accessible private key -- Chilkat must be able to obtain and
//  copy the actual private-key bytes.
loSbPem = createobject("CkStringBuilder")
llSuccess = loSbPem.LoadFile("qa_data/private_key.pem","utf-8")
if (llSuccess = .F.) then
    ? "Failed to load the private key PEM."
    release loPfx
    release loCert
    release loSbPem
    return
endif

llSuccess = loCert.SetPrivateKeyPem(loSbPem.GetAsString())
if (llSuccess = .F.) then
    ? loCert.LastErrorText
    release loPfx
    release loCert
    release loSbPem
    return
endif

//  Add the certificate (and its chain) as an identity in the PFX.  Set the 2nd argument to .T. to
//  include the certificate's chain of authority.
llBIncludeChain = .T.
llSuccess = loPfx.AddCert(loCert,llBIncludeChain)
if (llSuccess = .F.) then
    ? loPfx.LastErrorText
    release loPfx
    release loCert
    release loSbPem
    return
endif

? "Certificate added to the PFX."

//  Note: the private-key material must be accessible to the application.  A certificate whose private
//  key is non-exportable -- for example a non-exportable key in a Windows certificate store or an
//  Apple keychain, or a key on a smartcard/HSM -- cannot be added to a PFX, because the private-key
//  bytes are inaccessible.  A certificate with an exportable key in a Windows certificate store or an
//  Apple keychain, however, can be added, because its private-key bytes can be obtained.


release loPfx
release loCert
release loSbPem