Advertise Acceptable Client CA Names for Mutual TLS

See more Socket/SSL/TLS Examples

Demonstrates Socket.AddSslAcceptableClientCaDn, which adds a certificate-authority distinguished name to the list a TLS server advertises when requesting a client certificate for mutual TLS.

The file path is relative to the application's current working directory. An absolute path may also be used. Supply the path appropriate to your own environment.

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @success int
    SELECT @success = 0

    DECLARE @socket int
    EXEC @hr = sp_OACreate 'Chilkat.Socket', @socket OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    --  For mutual TLS, advertise the acceptable client-certificate CA distinguished names BEFORE
    --  initializing server-side TLS.  Call once for each acceptable CA distinguished name.
    EXEC sp_OAMethod @socket, 'AddSslAcceptableClientCaDn', @success OUT, 'CN=Example Root CA, O=Example, C=US'
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @socket, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @socket
        RETURN
      END
    EXEC sp_OAMethod @socket, 'AddSslAcceptableClientCaDn', @success OUT, 'CN=Example Intermediate CA, O=Example, C=US'
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @socket, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @socket
        RETURN
      END

    --  The file path is relative to the application's current working directory.  An absolute path
    --  may also be used.  Supply the path appropriate to your own environment.
    --  The PFX password should come from a secure source rather than being hard-coded.
    DECLARE @pfxPassword nvarchar(4000)
    SELECT @pfxPassword = 'myPfxPassword'
    DECLARE @cert int
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert OUT

    EXEC sp_OAMethod @cert, 'LoadPfxFile', @success OUT, 'qa_data/server.pfx', @pfxPassword
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @socket
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    --  Initialize server-side TLS.  The server will now request a client certificate and advertise the
    --  acceptable CA distinguished names added above.
    EXEC sp_OAMethod @socket, 'InitSslServer', @success OUT, @cert
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @socket, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @socket
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    PRINT 'Server-side TLS configured to request client certificates.'

    EXEC @hr = sp_OADestroy @socket
    EXEC @hr = sp_OADestroy @cert


END
GO