Xbase++
(PKCS11) Use a Smart Card Certificate + Private Key for SSL/TLS Authentication

Demonstrates how to use a certificate + private key located on a smart card for the TLS client certificate in an HTTPS request.
Chilkat Xbase++ Downloads

Download Chilkat for Xbase++
Xbase++
LOCAL nSuccess
LOCAL oPkcs11
LOCAL nSlotID
LOCAL nReadWrite
LOCAL nUserType
LOCAL cPin
LOCAL oCert
LOCAL oHttp
LOCAL cResponseBody

nSuccess := 0

//  This example requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

oPkcs11 := CreateObject("Chilkat.Pkcs11")

//  Set your shared lib path -- either a full path to the DLL, .so, or .dylib,
//  or just the filename if the driver is in a location that can be automatically found. (Such as in C:\Windows\System32)
oPkcs11:SharedLibPath := "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll"

nSuccess := oPkcs11:Initialize()
IF (nSuccess == 0)
    ? oPkcs11:LastErrorText
    oPkcs11:destroy()
    RETURN
ENDIF

//  Pass -1 for the slotID to open a session on the first non-empty slot.
nSlotID := -1

//  Open a session.
nReadWrite := 1
nSuccess := oPkcs11:OpenSession(nSlotID, nReadWrite)
IF (nSuccess == 0)
    ? oPkcs11:LastErrorText
    oPkcs11:destroy()
    RETURN
ENDIF

//  Make it an authenticated session by calling Login.
//  
//  If we don't authenticate, then we won't be able to see the private keys, and thus
//  we won't know which certificates have an associated private key stored on the smart card.

//  The smart card PIN is passed to the Login method.
//  userType 1 indicates a "Normal User".
nUserType := 1
cPin := "0000"
nSuccess := oPkcs11:Login(nUserType, cPin)
IF (nSuccess == 0)
    ? oPkcs11:LastErrorText
    nSuccess := oPkcs11:CloseSession()
    oPkcs11:destroy()
    RETURN
ENDIF

oCert := CreateObject("Chilkat.Cert")

//  Find a certificate by the Subject Common Name
nSuccess := oPkcs11:FindCert("subjectCN", "BadSSL Client Certificate", oCert)
IF (nSuccess == 1)
    ? "Found: " + oCert:SubjectCN
ELSE
    ? "Not found: " + oCert:SubjectCN
    nSuccess := oPkcs11:CloseSession()
    oPkcs11:destroy()
    oCert:destroy()
    RETURN
ENDIF

? "Successfully loaded the cert object from the smart card / USB token."

//  Note: When successful, the cert object is internally linked to the Pkcs11 object's authenticated session.
//  The cert object can now be used to sign or do other cryptographic operations that occur on the smart card / USB token.

//  ------------------------------------------------------------------------------------------------------------

//  Send an HTTPS request to https://client.badssl.com
//  https://client.badssl.com (part of the badssl.com service) lets you test authentication using client SSL certificates. 
//  The client certificate can be downloaded from https://badssl.com/download/.
//  This server returns 200 OK if the correct client certificate is provided, and 400 Bad Request otherwise.

oHttp := CreateObject("Chilkat.Http")

//  Provide the client certificate (linked internally to our authenticated smartcard session)
nSuccess := oHttp:SetSslClientCert(oCert)
IF (nSuccess == 0)
    ? oHttp:LastErrorText
    nSuccess := oPkcs11:CloseSession()
    oPkcs11:destroy()
    oCert:destroy()
    oHttp:destroy()
    RETURN
ENDIF

cResponseBody := oHttp:QuickGetStr("https://client.badssl.com/")
IF (oHttp:LastMethodSuccess == 0)
    ? oHttp:LastErrorText
    nSuccess := oPkcs11:CloseSession()
    oPkcs11:destroy()
    oCert:destroy()
    oHttp:destroy()
    RETURN
ENDIF

? "Response status code: " + Str(oHttp:LastStatus)
? "Response body: "
? cResponseBody

//  ------------------------------------------------------------------------------------------------------------
//  Revert to an unauthenticated session by calling Logout.
nSuccess := oPkcs11:Logout()
IF (nSuccess == 0)
    ? oPkcs11:LastErrorText
    nSuccess := oPkcs11:CloseSession()
    oPkcs11:destroy()
    oCert:destroy()
    oHttp:destroy()
    RETURN
ENDIF

//  When finished, close the session.
//  It is important to close the session (memory leaks will occur if the session is not properly closed).
nSuccess := oPkcs11:CloseSession()
IF (nSuccess == 0)
    ? oPkcs11:LastErrorText
    oPkcs11:destroy()
    oCert:destroy()
    oHttp:destroy()
    RETURN
ENDIF

? "Success."

oPkcs11:destroy()
oCert:destroy()
oHttp:destroy()