Advertise Acceptable Client CA Names for Mutual TLS

See more Socket/SSL/TLS Examples

Demonstrates Socket.AddSslAcceptableClientCaDn, which adds a certificate-authority distinguished name to the list a TLS server advertises when requesting a client certificate for mutual TLS.

The file path is relative to the application's current working directory. An absolute path may also be used. Supply the path appropriate to your own environment.

load ./chilkat.dll

set success 0

set socket [new_CkSocket]

#  For mutual TLS, advertise the acceptable client-certificate CA distinguished names BEFORE
#  initializing server-side TLS.  Call once for each acceptable CA distinguished name.
set success [CkSocket_AddSslAcceptableClientCaDn $socket "CN=Example Root CA, O=Example, C=US"]
if {$success == 0} then {
    puts [CkSocket_lastErrorText $socket]
    delete_CkSocket $socket
    exit
}

set success [CkSocket_AddSslAcceptableClientCaDn $socket "CN=Example Intermediate CA, O=Example, C=US"]
if {$success == 0} then {
    puts [CkSocket_lastErrorText $socket]
    delete_CkSocket $socket
    exit
}

#  The file path is relative to the application's current working directory.  An absolute path
#  may also be used.  Supply the path appropriate to your own environment.
#  The PFX password should come from a secure source rather than being hard-coded.
set pfxPassword "myPfxPassword"
set cert [new_CkCert]

set success [CkCert_LoadPfxFile $cert "qa_data/server.pfx" $pfxPassword]
if {$success == 0} then {
    puts [CkCert_lastErrorText $cert]
    delete_CkSocket $socket
    delete_CkCert $cert
    exit
}

#  Initialize server-side TLS.  The server will now request a client certificate and advertise the
#  acceptable CA distinguished names added above.
set success [CkSocket_InitSslServer $socket $cert]
if {$success == 0} then {
    puts [CkSocket_lastErrorText $socket]
    delete_CkSocket $socket
    delete_CkCert $cert
    exit
}

puts "Server-side TLS configured to request client certificates."

delete_CkSocket $socket
delete_CkCert $cert