Pascal (Lazarus/Delphi)

Verify and Pin the FTPS Server Certificate

Demonstrates the certificate-verification properties RequireSslCertVerify, TlsPinSet, and the read-only SslServerCertVerified.

Background: By default a TLS connection is not rejected merely because certificate-chain verification fails, so RequireSslCertVerify = true is the important hardening step — it makes an expired, unsigned, or untrusted certificate abort the connection. TlsPinSet adds public-key pinning on top: the handshake fails unless the server's SPKI fingerprint matches one you configured, defending against a mis-issued certificate that would otherwise validate. Pinning supplements verification rather than replacing it. SslServerCertVerified reports the outcome.

Chilkat Pascal (Lazarus/Delphi) Downloads

Download Chilkat for Pascal (Lazarus/Delphi)

Pascal (Lazarus/Delphi)

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.Ftp2;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  ftp: TFtp2;

begin
  success := False;

  ftp := TFtp2.Create;

  ftp.Hostname := 'ftp.example.com';
  ftp.Username := 'myFtpLogin';

  ftp.AuthTls := True;

  //  Normally you would not hard-code the password in source.  You should instead obtain it
  //  from an interactive prompt, environment variable, or a secrets vault.
  ftp.Password := 'myPassword';

  //  Reject the connection if the server certificate cannot be verified (expired, bad signature,
  //  untrusted chain, etc.).  The default is False, which does not reject on verification
  //  failure -- set True for security.
  ftp.RequireSslCertVerify := True;

  //  Optionally pin the server's public key.  If none of the configured SPKI fingerprints matches,
  //  the TLS handshake fails.  Pinning supplements normal verification; it does not replace it.
  ftp.TlsPinSet := 'sha256//YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=';

  success := ftp.Connect();
  if (success = False) then
    begin
      WriteLn(ftp.LastErrorText);
      Exit;
    end;

  //  SslServerCertVerified reports whether the certificate chain was successfully verified.
  if (ftp.SslServerCertVerified) then
    begin
      WriteLn('The server certificate was verified.');
    end;

  success := ftp.Disconnect();
  if (success = False) then
    begin
      WriteLn(ftp.LastErrorText);
      Exit;
    end;


  ftp.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.