Add a Certificate Identity to a PFX

See more PFX/P12 Examples

Demonstrates Pfx.AddCert, which adds a certificate as an identity in the PFX. The example loads the certificate from a .cer file and associates its private key from a PEM file (via Cert.SetPrivateKeyPem) before adding it.

The file paths are relative to the application's current working directory. Absolute paths may also be used. Supply the paths appropriate to your own environment.

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.Pfx,
  Chilkat.StringBuilder,
  Chilkat.Cert;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  pfx: TPfx;
  cert: TCert;
  sbPem: TStringBuilder;
  bIncludeChain: Boolean;

begin
  success := False;

  pfx := TPfx.Create;

  //  The file paths are relative to the application's current working directory.  Absolute paths may
  //  also be used.  Supply the paths appropriate to your own environment.

  //  Load the certificate from a .cer file.
  cert := TCert.Create;
  success := cert.LoadFromFile('qa_data/certificate.cer');
  if (success = False) then
    begin
      WriteLn(cert.LastErrorText);
      Exit;
    end;

  //  Load the matching private key from a PEM file and associate it with the certificate.  AddCert
  //  requires the certificate to have an accessible private key -- Chilkat must be able to obtain and
  //  copy the actual private-key bytes.
  sbPem := TStringBuilder.Create;
  success := sbPem.LoadFile('qa_data/private_key.pem','utf-8');
  if (success = False) then
    begin
      WriteLn('Failed to load the private key PEM.');
      Exit;
    end;
  success := cert.SetPrivateKeyPem(sbPem.GetAsString());
  if (success = False) then
    begin
      WriteLn(cert.LastErrorText);
      Exit;
    end;

  //  Add the certificate (and its chain) as an identity in the PFX.  Set the 2nd argument to True to
  //  include the certificate's chain of authority.
  bIncludeChain := True;
  success := pfx.AddCert(cert,bIncludeChain);
  if (success = False) then
    begin
      WriteLn(pfx.LastErrorText);
      Exit;
    end;
  WriteLn('Certificate added to the PFX.');

  //  Note: the private-key material must be accessible to the application.  A certificate whose private
  //  key is non-exportable -- for example a non-exportable key in a Windows certificate store or an
  //  Apple keychain, or a key on a smartcard/HSM -- cannot be added to a PFX, because the private-key
  //  bytes are inaccessible.  A certificate with an exportable key in a Windows certificate store or an
  //  Apple keychain, however, can be added, because its private-key bytes can be obtained.


  pfx.Free;
  cert.Free;
  sbPem.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.