Objective-C

Get and Inspect the FTPS Server Certificate Before Login

Demonstrates the Chilkat Ftp2.GetServerCert method, which loads the leaf certificate presented on the connected FTPS control channel into a Cert object. The only argument is the Cert; an active TLS control connection is required. This example uses ConnectOnly followed by LoginAfterConnectOnly so the certificate can be inspected before any credentials are sent.

Background: Chilkat validates the server certificate during the TLS handshake, but an application often needs to apply its own check — pinning a fingerprint, matching a subject, or enforcing an internal policy — and the safe moment to do that is before revealing the login. Splitting the handshake with ConnectOnly establishes TLS and makes the certificate available via GetServerCert, while deferring USER and PASS to LoginAfterConnectOnly. If the certificate fails inspection you simply disconnect, and an untrusted or impersonating server never receives the credentials. For declarative pinning without writing inspection code, SetSslCertRequirement lets you require certificate-field values up front.

Chilkat Objective-C Downloads

Download Chilkat for Objective-C

Objective-C

#import <CkoFtp2.h>
#import <CkoCert.h>

BOOL success = NO;

//  Demonstrates the Ftp2.GetServerCert method, which loads the leaf certificate presented on the
//  connected FTPS control channel into a Cert object.  The only argument is the Cert.  It requires
//  an active TLS control connection.
//  
//  This example uses ConnectOnly + LoginAfterConnectOnly so the server certificate can be
//  inspected and validated BEFORE any credentials are sent.

CkoFtp2 *ftp = [[CkoFtp2 alloc] init];

ftp.Hostname = @"ftp.example.com";

//  Use explicit FTPS (AUTH TLS) on the standard FTP port.
ftp.AuthTls = YES;

//  Establish the connection and TLS layer and receive the greeting, but do NOT send USER/PASS.
success = [ftp ConnectOnly];
if (success == NO) {
    NSLog(@"%@",ftp.LastErrorText);
    return;
}

//  The TLS control channel is now up.  Retrieve the server's certificate for inspection.
CkoCert *cert = [[CkoCert alloc] init];
success = [ftp GetServerCert: cert];
if (success == NO) {
    NSLog(@"%@",ftp.LastErrorText);
    return;
}

NSLog(@"%@%@",@"Server certificate subject: ",cert.SubjectCN);
NSLog(@"%@%@",@"Issued by: ",cert.IssuerCN);

//  Perform any application-specific validation of the server certificate here -- for example,
//  compare the fingerprint or subject against an expected value.  Only proceed to authenticate if
//  the certificate is acceptable.  Because no credentials have been sent yet, an untrusted server
//  never sees the username or password.
//  
//    if (certificate is not acceptable) { return; }

//  The certificate passed inspection, so now provide credentials and authenticate.
ftp.Username = @"myFtpLogin";

//  Normally you would not hard-code the password in source.  You should instead obtain it
//  from an interactive prompt, environment variable, or a secrets vault.
ftp.Password = @"myPassword";

success = [ftp LoginAfterConnectOnly];
if (success == NO) {
    NSLog(@"%@",ftp.LastErrorText);
    return;
}

NSLog(@"%@",@"Authenticated after verifying the server certificate.");

success = [ftp Disconnect];
if (success == NO) {
    NSLog(@"%@",ftp.LastErrorText);
    return;
}