Add a Certificate Identity to a PFX

See more PFX/P12 Examples

Demonstrates Pfx.AddCert, which adds a certificate as an identity in the PFX. The example loads the certificate from a .cer file and associates its private key from a PEM file (via Cert.SetPrivateKeyPem) before adding it.

The file paths are relative to the application's current working directory. Absolute paths may also be used. Supply the paths appropriate to your own environment.

--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @success int
    SELECT @success = 0

    DECLARE @pfx int
    EXEC @hr = sp_OACreate 'Chilkat.Pfx', @pfx OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    --  The file paths are relative to the application's current working directory.  Absolute paths may
    --  also be used.  Supply the paths appropriate to your own environment.

    --  Load the certificate from a .cer file.
    DECLARE @cert int
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert OUT

    EXEC sp_OAMethod @cert, 'LoadFromFile', @success OUT, 'qa_data/certificate.cer'
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @pfx
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    --  Load the matching private key from a PEM file and associate it with the certificate.  AddCert
    --  requires the certificate to have an accessible private key -- Chilkat must be able to obtain and
    --  copy the actual private-key bytes.
    DECLARE @sbPem int
    EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbPem OUT

    EXEC sp_OAMethod @sbPem, 'LoadFile', @success OUT, 'qa_data/private_key.pem', 'utf-8'
    IF @success = 0
      BEGIN

        PRINT 'Failed to load the private key PEM.'
        EXEC @hr = sp_OADestroy @pfx
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @sbPem
        RETURN
      END
    EXEC sp_OAMethod @sbPem, 'GetAsString', @sTmp0 OUT
    EXEC sp_OAMethod @cert, 'SetPrivateKeyPem', @success OUT, @sTmp0
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @pfx
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @sbPem
        RETURN
      END

    --  Add the certificate (and its chain) as an identity in the PFX.  Set the 2nd argument to 1 to
    --  include the certificate's chain of authority.
    DECLARE @bIncludeChain int
    SELECT @bIncludeChain = 1
    EXEC sp_OAMethod @pfx, 'AddCert', @success OUT, @cert, @bIncludeChain
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @pfx, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @pfx
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @sbPem
        RETURN
      END

    PRINT 'Certificate added to the PFX.'

    --  Note: the private-key material must be accessible to the application.  A certificate whose private
    --  key is non-exportable -- for example a non-exportable key in a Windows certificate store or an
    --  Apple keychain, or a key on a smartcard/HSM -- cannot be added to a PFX, because the private-key
    --  bytes are inaccessible.  A certificate with an exportable key in a Windows certificate store or an
    --  Apple keychain, however, can be added, because its private-key bytes can be obtained.

    EXEC @hr = sp_OADestroy @pfx
    EXEC @hr = sp_OADestroy @cert
    EXEC @hr = sp_OADestroy @sbPem


END
GO