Advertise Acceptable Client CA Names for Mutual TLS

See more Socket/SSL/TLS Examples

Demonstrates Socket.AddSslAcceptableClientCaDn, which adds a certificate-authority distinguished name to the list a TLS server advertises when requesting a client certificate for mutual TLS.

The file path is relative to the application's current working directory. An absolute path may also be used. Supply the path appropriate to your own environment.

integer li_rc
integer li_Success
oleobject loo_Socket
string ls_PfxPassword
oleobject loo_Cert

li_Success = 0

loo_Socket = create oleobject
li_rc = loo_Socket.ConnectToNewObject("Chilkat.Socket")
if li_rc < 0 then
    destroy loo_Socket
    MessageBox("Error","Connecting to COM object failed")
    return
end if

//  For mutual TLS, advertise the acceptable client-certificate CA distinguished names BEFORE
//  initializing server-side TLS.  Call once for each acceptable CA distinguished name.
li_Success = loo_Socket.AddSslAcceptableClientCaDn("CN=Example Root CA, O=Example, C=US")
if li_Success = 0 then
    Write-Debug loo_Socket.LastErrorText
    destroy loo_Socket
    return
end if

li_Success = loo_Socket.AddSslAcceptableClientCaDn("CN=Example Intermediate CA, O=Example, C=US")
if li_Success = 0 then
    Write-Debug loo_Socket.LastErrorText
    destroy loo_Socket
    return
end if

//  The file path is relative to the application's current working directory.  An absolute path
//  may also be used.  Supply the path appropriate to your own environment.
//  The PFX password should come from a secure source rather than being hard-coded.
ls_PfxPassword = "myPfxPassword"
loo_Cert = create oleobject
li_rc = loo_Cert.ConnectToNewObject("Chilkat.Cert")

li_Success = loo_Cert.LoadPfxFile("qa_data/server.pfx",ls_PfxPassword)
if li_Success = 0 then
    Write-Debug loo_Cert.LastErrorText
    destroy loo_Socket
    destroy loo_Cert
    return
end if

//  Initialize server-side TLS.  The server will now request a client certificate and advertise the
//  acceptable CA distinguished names added above.
li_Success = loo_Socket.InitSslServer(loo_Cert)
if li_Success = 0 then
    Write-Debug loo_Socket.LastErrorText
    destroy loo_Socket
    destroy loo_Cert
    return
end if

Write-Debug "Server-side TLS configured to request client certificates."


destroy loo_Socket
destroy loo_Cert