PowerBuilder

Get and Inspect the FTPS Server Certificate Before Login

Demonstrates the Chilkat Ftp2.GetServerCert method, which loads the leaf certificate presented on the connected FTPS control channel into a Cert object. The only argument is the Cert; an active TLS control connection is required. This example uses ConnectOnly followed by LoginAfterConnectOnly so the certificate can be inspected before any credentials are sent.

Background: Chilkat validates the server certificate during the TLS handshake, but an application often needs to apply its own check — pinning a fingerprint, matching a subject, or enforcing an internal policy — and the safe moment to do that is before revealing the login. Splitting the handshake with ConnectOnly establishes TLS and makes the certificate available via GetServerCert, while deferring USER and PASS to LoginAfterConnectOnly. If the certificate fails inspection you simply disconnect, and an untrusted or impersonating server never receives the credentials. For declarative pinning without writing inspection code, SetSslCertRequirement lets you require certificate-field values up front.

Chilkat PowerBuilder Downloads

Download Chilkat for PowerBuilder

PowerBuilder

integer li_rc
integer li_Success
oleobject loo_Ftp
oleobject loo_Cert

li_Success = 0

//  Demonstrates the Ftp2.GetServerCert method, which loads the leaf certificate presented on the
//  connected FTPS control channel into a Cert object.  The only argument is the Cert.  It requires
//  an active TLS control connection.
//  
//  This example uses ConnectOnly + LoginAfterConnectOnly so the server certificate can be
//  inspected and validated BEFORE any credentials are sent.

loo_Ftp = create oleobject
li_rc = loo_Ftp.ConnectToNewObject("Chilkat.Ftp2")
if li_rc < 0 then
    destroy loo_Ftp
    MessageBox("Error","Connecting to COM object failed")
    return
end if

loo_Ftp.Hostname = "ftp.example.com"

//  Use explicit FTPS (AUTH TLS) on the standard FTP port.
loo_Ftp.AuthTls = 1

//  Establish the connection and TLS layer and receive the greeting, but do NOT send USER/PASS.
li_Success = loo_Ftp.ConnectOnly()
if li_Success = 0 then
    Write-Debug loo_Ftp.LastErrorText
    destroy loo_Ftp
    return
end if

//  The TLS control channel is now up.  Retrieve the server's certificate for inspection.
loo_Cert = create oleobject
li_rc = loo_Cert.ConnectToNewObject("Chilkat.Cert")

li_Success = loo_Ftp.GetServerCert(loo_Cert)
if li_Success = 0 then
    Write-Debug loo_Ftp.LastErrorText
    destroy loo_Ftp
    destroy loo_Cert
    return
end if

Write-Debug "Server certificate subject: " + loo_Cert.SubjectCN
Write-Debug "Issued by: " + loo_Cert.IssuerCN

//  Perform any application-specific validation of the server certificate here -- for example,
//  compare the fingerprint or subject against an expected value.  Only proceed to authenticate if
//  the certificate is acceptable.  Because no credentials have been sent yet, an untrusted server
//  never sees the username or password.
//  
//    if (certificate is not acceptable) { return; }

//  The certificate passed inspection, so now provide credentials and authenticate.
loo_Ftp.Username = "myFtpLogin"

//  Normally you would not hard-code the password in source.  You should instead obtain it
//  from an interactive prompt, environment variable, or a secrets vault.
loo_Ftp.Password = "myPassword"

li_Success = loo_Ftp.LoginAfterConnectOnly()
if li_Success = 0 then
    Write-Debug loo_Ftp.LastErrorText
    destroy loo_Ftp
    destroy loo_Cert
    return
end if

Write-Debug "Authenticated after verifying the server certificate."

li_Success = loo_Ftp.Disconnect()
if li_Success = 0 then
    Write-Debug loo_Ftp.LastErrorText
    destroy loo_Ftp
    destroy loo_Cert
    return
end if



destroy loo_Ftp
destroy loo_Cert