PureBasic

Require Specific FTPS Server Certificate Fields

Demonstrates the Chilkat Ftp2.SetSslCertRequirement method, which adds a required match against the FTP server certificate. The first argument selects the certificate field (such as SubjectCN or IssuerCN) and the second is the required value. It is a void method; a non-matching certificate causes the connection to fail.

Background: Standard TLS validation confirms a certificate is trusted and valid for the hostname, but it does not guarantee you reached the specific server you expect — a form of pinning closes that gap. Requiring a certificate field to match a known value rejects any certificate that does not, defending against a mis-issued or substituted certificate even if it would otherwise pass validation. Multiple requirements can be added, and all must be satisfied.

Chilkat PureBasic Downloads

Download Chilkat for PureBasic

PureBasic

IncludeFile "CkFtp2.pb"

Procedure ChilkatExample()

    success.i = 0

    ;  Demonstrates the Ftp2.SetSslCertRequirement method, which adds a required match against the FTP
    ;  server certificate.  The 1st argument selects the certificate field and the 2nd is the required
    ;  value.  It is a void method.

    ftp.i = CkFtp2::ckCreate()
    If ftp.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkFtp2::setCkHostname(ftp, "ftp.example.com")
    CkFtp2::setCkUsername(ftp, "myFtpLogin")

    ;  Normally you would not hard-code the password in source.  You should instead obtain it
    ;  from an interactive prompt, environment variable, or a secrets vault.
    CkFtp2::setCkPassword(ftp, "myPassword")

    ;  Use explicit FTPS (AUTH TLS) on the standard FTP port.
    CkFtp2::setCkAuthTls(ftp, 1)

    ;  Require that the server certificate's subject common name matches an expected value.  If the
    ;  presented certificate does not match, the TLS connection fails.  Supported fields include
    ;  SubjectDN, SubjectCN, IssuerDN, IssuerCN, and others.
    CkFtp2::ckSetSslCertRequirement(ftp,"SubjectCN","ftp.example.com")

    success = CkFtp2::ckConnect(ftp)
    If success = 0
        Debug CkFtp2::ckLastErrorText(ftp)
        CkFtp2::ckDispose(ftp)
        ProcedureReturn
    EndIf

    Debug "Connected; server certificate met the requirement."

    success = CkFtp2::ckDisconnect(ftp)
    If success = 0
        Debug CkFtp2::ckLastErrorText(ftp)
        CkFtp2::ckDispose(ftp)
        ProcedureReturn
    EndIf



    CkFtp2::ckDispose(ftp)


    ProcedureReturn
EndProcedure