SQL Server

Verify and Pin the FTPS Server Certificate

Demonstrates the certificate-verification properties RequireSslCertVerify, TlsPinSet, and the read-only SslServerCertVerified.

Background: By default a TLS connection is not rejected merely because certificate-chain verification fails, so RequireSslCertVerify = true is the important hardening step — it makes an expired, unsigned, or untrusted certificate abort the connection. TlsPinSet adds public-key pinning on top: the handshake fails unless the server's SPKI fingerprint matches one you configured, defending against a mis-issued certificate that would otherwise validate. Pinning supplements verification rather than replacing it. SslServerCertVerified reports the outcome.

Chilkat SQL Server Downloads

Download Chilkat for SQL Server

SQL Server

--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @iTmp0 int
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @success int
    SELECT @success = 0

    DECLARE @ftp int
    EXEC @hr = sp_OACreate 'Chilkat.Ftp2', @ftp OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    EXEC sp_OASetProperty @ftp, 'Hostname', 'ftp.example.com'
    EXEC sp_OASetProperty @ftp, 'Username', 'myFtpLogin'

    EXEC sp_OASetProperty @ftp, 'AuthTls', 1

    --  Normally you would not hard-code the password in source.  You should instead obtain it
    --  from an interactive prompt, environment variable, or a secrets vault.
    EXEC sp_OASetProperty @ftp, 'Password', 'myPassword'

    --  Reject the connection if the server certificate cannot be verified (expired, bad signature,
    --  untrusted chain, etc.).  The default is 0, which does not reject on verification
    --  failure -- set 1 for security.
    EXEC sp_OASetProperty @ftp, 'RequireSslCertVerify', 1

    --  Optionally pin the server's public key.  If none of the configured SPKI fingerprints matches,
    --  the TLS handshake fails.  Pinning supplements normal verification; it does not replace it.
    EXEC sp_OASetProperty @ftp, 'TlsPinSet', 'sha256//YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg='

    EXEC sp_OAMethod @ftp, 'Connect', @success OUT
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @ftp, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ftp
        RETURN
      END

    --  SslServerCertVerified reports whether the certificate chain was successfully verified.
    EXEC sp_OAGetProperty @ftp, 'SslServerCertVerified', @iTmp0 OUT
    IF @iTmp0
      BEGIN

        PRINT 'The server certificate was verified.'
      END

    EXEC sp_OAMethod @ftp, 'Disconnect', @success OUT
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @ftp, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ftp
        RETURN
      END

    EXEC @hr = sp_OADestroy @ftp


END
GO