Tcl

Use a TLS Client Certificate

Demonstrates the Chilkat MailMan.SetSslClientCert method, which sets the client-side certificate to use for SSL/TLS connections. This is typically not required — most SSL/TLS connections authenticate the server only. This example loads a client certificate from a PFX and uses it when connecting.

Background: In an ordinary TLS handshake only the server presents a certificate, and the client proves who it is later with a password. Mutual TLS adds a second leg: the client also presents a certificate, so it is authenticated cryptographically at the transport layer. Some corporate or high-security mail servers require this. Because the client must prove possession of the key, the certificate needs its private key — hence loading from a PFX.

Chilkat Tcl Downloads

Download Chilkat for Tcl

Tcl


load ./chilkat.dll

set success 0

#  Demonstrates the MailMan.SetSslClientCert method, which sets the client-side certificate
#  to use for SSL/TLS connections.  This is typically not required -- most SSL/TLS
#  connections authenticate the server only.

set mailman [new_CkMailMan]

#  Configure the SMTP server connection.
CkMailMan_put_SmtpHost $mailman "smtp.example.com"
CkMailMan_put_SmtpPort $mailman 465
CkMailMan_put_SmtpSsl $mailman 1
CkMailMan_put_SmtpUsername $mailman "user@example.com"
CkMailMan_put_SmtpPassword $mailman "myPassword"

#  Load the client certificate (with its private key) from a PFX file.
set cert [new_CkCert]

set success [CkCert_LoadPfxFile $cert "qa_data/certs/client.pfx" "pfx_password"]
if {$success == 0} then {
    puts [CkCert_lastErrorText $cert]
    delete_CkMailMan $mailman
    delete_CkCert $cert
    exit
}

#  Use this certificate to identify the client during the TLS handshake.
set success [CkMailMan_SetSslClientCert $mailman $cert]
if {$success == 0} then {
    puts [CkMailMan_lastErrorText $mailman]
    delete_CkMailMan $mailman
    delete_CkCert $cert
    exit
}

set success [CkMailMan_VerifySmtpLogin $mailman]
if {$success == 0} then {
    puts [CkMailMan_lastErrorText $mailman]
    delete_CkMailMan $mailman
    delete_CkCert $cert
    exit
}

puts "Connected using a TLS client certificate."

#  Note: The path "qa_data/certs/client.pfx" is a relative local filesystem path,
#  relative to the current working directory of the running application.

delete_CkMailMan $mailman
delete_CkCert $cert