Advertise Acceptable Client CA Names for Mutual TLS

See more Socket/SSL/TLS Examples

Demonstrates Socket.AddSslAcceptableClientCaDn, which adds a certificate-authority distinguished name to the list a TLS server advertises when requesting a client certificate for mutual TLS.

The file path is relative to the application's current working directory. An absolute path may also be used. Supply the path appropriate to your own environment.

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.Cert,
  Chilkat.Socket;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  socket: TSocket;
  pfxPassword: string;
  cert: TCert;

begin
  success := False;

  socket := TSocket.Create;

  //  For mutual TLS, advertise the acceptable client-certificate CA distinguished names BEFORE
  //  initializing server-side TLS.  Call once for each acceptable CA distinguished name.
  success := socket.AddSslAcceptableClientCaDn('CN=Example Root CA, O=Example, C=US');
  if (success = False) then
    begin
      WriteLn(socket.LastErrorText);
      Exit;
    end;
  success := socket.AddSslAcceptableClientCaDn('CN=Example Intermediate CA, O=Example, C=US');
  if (success = False) then
    begin
      WriteLn(socket.LastErrorText);
      Exit;
    end;

  //  The file path is relative to the application's current working directory.  An absolute path
  //  may also be used.  Supply the path appropriate to your own environment.
  //  The PFX password should come from a secure source rather than being hard-coded.
  pfxPassword := 'myPfxPassword';
  cert := TCert.Create;
  success := cert.LoadPfxFile('qa_data/server.pfx',pfxPassword);
  if (success = False) then
    begin
      WriteLn(cert.LastErrorText);
      Exit;
    end;

  //  Initialize server-side TLS.  The server will now request a client certificate and advertise the
  //  acceptable CA distinguished names added above.
  success := socket.InitSslServer(cert);
  if (success = False) then
    begin
      WriteLn(socket.LastErrorText);
      Exit;
    end;
  WriteLn('Server-side TLS configured to request client certificates.');


  socket.Free;
  cert.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.