Pascal (Lazarus/Delphi)

Require Specific FTPS Server Certificate Fields

Demonstrates the Chilkat Ftp2.SetSslCertRequirement method, which adds a required match against the FTP server certificate. The first argument selects the certificate field (such as SubjectCN or IssuerCN) and the second is the required value. It is a void method; a non-matching certificate causes the connection to fail.

Background: Standard TLS validation confirms a certificate is trusted and valid for the hostname, but it does not guarantee you reached the specific server you expect — a form of pinning closes that gap. Requiring a certificate field to match a known value rejects any certificate that does not, defending against a mis-issued or substituted certificate even if it would otherwise pass validation. Multiple requirements can be added, and all must be satisfied.

Chilkat Pascal (Lazarus/Delphi) Downloads

Download Chilkat for Pascal (Lazarus/Delphi)

Pascal (Lazarus/Delphi)

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.Ftp2;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  ftp: TFtp2;

begin
  success := False;

  //  Demonstrates the Ftp2.SetSslCertRequirement method, which adds a required match against the FTP
  //  server certificate.  The 1st argument selects the certificate field and the 2nd is the required
  //  value.  It is a void method.

  ftp := TFtp2.Create;

  ftp.Hostname := 'ftp.example.com';
  ftp.Username := 'myFtpLogin';

  //  Normally you would not hard-code the password in source.  You should instead obtain it
  //  from an interactive prompt, environment variable, or a secrets vault.
  ftp.Password := 'myPassword';

  //  Use explicit FTPS (AUTH TLS) on the standard FTP port.
  ftp.AuthTls := True;

  //  Require that the server certificate's subject common name matches an expected value.  If the
  //  presented certificate does not match, the TLS connection fails.  Supported fields include
  //  SubjectDN, SubjectCN, IssuerDN, IssuerCN, and others.
  ftp.SetSslCertRequirement('SubjectCN','ftp.example.com');

  success := ftp.Connect();
  if (success = False) then
    begin
      WriteLn(ftp.LastErrorText);
      Exit;
    end;
  WriteLn('Connected; server certificate met the requirement.');

  success := ftp.Disconnect();
  if (success = False) then
    begin
      WriteLn(ftp.LastErrorText);
      Exit;
    end;


  ftp.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.