load multiple certificates

[junnylc]

How does the listen method load multiple certificates(pfx or pem) at once when using the ctxWinsock control?

[wqweto]

CertFile parameter allows for pipe-delimited PEM files i.e. cert.pem|intermediary.pem|root.pem|key.pem

For PFX it is expected to bundle all cerificates and keys into a single PFX certificate store.

Btw, it is possible to bundle all cerificates and keys into a single PEM file - just copy/paste multiple PEM files into a text editor and save as a single bundled PEM file.

Another option is to directly use Certificates collection parameter by populating it with X509 certs as byte-arrays. You’ll have to implement X509 certs decoding from files though.

Last option is to impl OnCertificate event (currently not available in ctxWinsock) which allows dynamicly switching server cert based on client IP, server/host IP used to connect to or anything else that can be used as a distinguisher.

[junnylc]

CertFile parameter allows for pipe-delimited PEM files i.e. cert.pem|intermediary.pem|root.pem|key.pem

For PFX it is expected to bundle all cerificates and keys into a single PFX certificate store.

Btw, it is possible to bundle all cerificates and keys into a single PEM file - just copy/paste multiple PEM files into a text editor and save as a single bundled PEM file.

Another option is to directly use Certificates collection parameter by populating it with X509 certs as byte-arrays. You’ll have to implement X509 certs decoding from files though.

Last option is to impl OnCertificate event (currently not available in ctxWinsock) which allows dynamicly switching server cert based on client IP, server/host IP used to connect to or anything else that can be used as a distinguisher.

Thanks verry verry much!!

[junnylc]

CertFile parameter allows for pipe-delimited PEM files i.e. cert.pem|intermediary.pem|root.pem|key.pem

For PFX it is expected to bundle all cerificates and keys into a single PFX certificate store.

Btw, it is possible to bundle all cerificates and keys into a single PEM file - just copy/paste multiple PEM files into a text editor and save as a single bundled PEM file.

Another option is to directly use Certificates collection parameter by populating it with X509 certs as byte-arrays. You’ll have to implement X509 certs decoding from files though.

Last option is to impl OnCertificate event (currently not available in ctxWinsock) which allows dynamicly switching server cert based on client IP, server/host IP used to connect to or anything else that can be used as a distinguisher.

When I load multiple certificates(pem), in line 5696 of the file mdTlsThunks.bas, the code is "If . Item(IDX_PROVTYPE) = PROV_RSA_FULL Then", an error occurred with the error message "Error 13 type mismatch". I think the mistake is that the collection variable "cPrivKey" really can't be used that way.

What do you think?
Added: Load a single PEM certificate without such an error

[wqweto]

You are probably trying to load multiple private keys which is not supported. You can have the private key for the leaf level certificate only.

What is the use case? Do you really need to serve two and more host certificates (not counting the intermediary ones)?

[junnylc]

You are probably trying to load multiple private keys which is not supported. You can have the private key for the leaf level certificate only.

What is the use case? Do you really need to serve two and more host certificates (not counting the intermediary ones)?

1. It is no problem to use a single certificate.
2. I used this control to write a web server that provides https access links

[wqweto]

I mean what is the use-case to have two leaf/host certificates loaded?

[junnylc]

Port 433 of https is required to support multiple domain names, such as www.aaa.com, aa.com, bb.com, mail.bb.com, cc.com

[junnylc]

My PEM certificate format is:

-----BEGIN CERTIFICATE-----
MIIF8jCCBNqgAwIBAgIQDxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
.........
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxsSbGgpkds=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEqjCCA5KgAwIBAgIQDxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
...........
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxnfl0JQjJNSg==
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
............
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxr0C8X/ttg9CXw==
-----END RSA PRIVATE KEY-----

[wqweto]

I see what's the use-case but this currently is not supported by ctxWinsock.

[junnylc]

Thank you

[wqweto]

I just added event OnServerCertificate in version 1.0.7 for WinsockTls in releases which can be used with Server Name Indicator to customize server certificate based on the requested SNI like in your use-case like this:

Private Sub ctxServer_OnServerCertificate(Index As Integer, Socket As Object, Certificates As Object, PrivateKey As Object, Confirmed As Boolean)
    Const STR_CERTFILE  As String = "..."
    Const STR_PASSWORD  As String = "..."
    
    If Socket.SniRequested = "localhost.saas.bg" Then
        Socket.ImportPemCertificates STR_CERTFILE, STR_PASSWORD
        Confirmed = True
    End If
End Sub

The idea is to start TLS server with no certificates (this will auto-generate a self-signed certificate) and then in OnServerCertificate to call Socket.ImportPemCertificates based on server name in Socket.SniRequested.

Another more performant strategy for OnServerCertificate implementation is to call ImportPemCertificates (or any of the other ImportXxxCertificates methods) once on a dedicated cTlsSocket instrance and then on each request directly to use such cached certificates and private key w/o importing them from a file anymore:

Private Sub ctxServer_OnServerCertificate(Index As Integer, Socket As Object, Certificates As Object, PrivateKey As Object, Confirmed As Boolean)
    Const STR_CERTFILE  As String = "localhost.saas.bg.pem|localhost.saas.bg.key"
    Const STR_PASSWORD  As String = ""
    Static oCache As cTlsSocket
    
    If Socket.SniRequested = "localhost.saas.bg" Then
        If oCache Is Nothing Then
            Set oCache = New cTlsSocket
            oCache.ImportPemCertificates STR_CERTFILE, STR_PASSWORD
        End If
        Set Certificates = oCache.LocalCertificates
        Set PrivateKey = oCache.LocalPrivateKey
        Confirmed = True
    End If
End Sub

[junnylc]

Thank you

I just added event in version 1.0.7 for WinsockTls in releases which can be used with Server Name Indicator to customize server certificate based on the requested SNI like in your use-case like this:OnServerCertificate

Private Sub ctxServer_OnServerCertificate(Index As Integer, Socket As Object, Certificates As Object, PrivateKey As Object, Confirmed As Boolean)
    Const STR_CERTFILE  As String = "..."
    Const STR_PASSWORD  As String = "..."
    
    If Socket.SniRequested = "localhost.saas.bg" Then
        Socket.ImportPemCertificates STR_CERTFILE, STR_PASSWORD
        Confirmed = True
    End If
End Sub

The idea is to start TLS server with no certificates (this will auto-generate a self-signed certificate) and then in to call based on server name in .OnServerCertificate``Socket.ImportPemCertificates``Socket.SniRequested

Another more performant strategy for implementation is to call (or any of the other methods) once on a dedicated instrance and then on each request directly to use such cached certificates and private key w/o importing them from a file anymore:OnServerCertificate``ImportPemCertificates``ImportXxxCertificates``cTlsSocket

Private Sub ctxServer_OnServerCertificate(Index As Integer, Socket As Object, Certificates As Object, PrivateKey As Object, Confirmed As Boolean)
    Const STR_CERTFILE  As String = "localhost.saas.bg.pem|localhost.saas.bg.key"
    Const STR_PASSWORD  As String = ""
    Static oCache As cTlsSocket
    
    If Socket.SniRequested = "localhost.saas.bg" Then
        If oCache Is Nothing Then
            Set oCache = New cTlsSocket
            oCache.ImportPemCertificates STR_CERTFILE, STR_PASSWORD
        End If
        Set Certificates = oCache.LocalCertificates
        Set PrivateKey = oCache.LocalPrivateKey
        Confirmed = True
    End If
End Sub

Thank you sincerely for your answer. I will study it carefully to see how to use it.

[junnylc]

I've found that the code needs to be changed like this to work:

Private Sub sckPost_OnServerCertificate(Index As Integer, Socket As Object, Certificates As Object, PrivateKey As Object, Confirmed As Boolean)
    Dim mStr As String
    
    mStr = Socket.SniRequested
    If Socket.ImportPemCertificates(PemFilePath + mStr + ".pem") Then
        Set Certificates = Socket.LocalCertificates
        Set PrivateKey = Socket.LocalPrivateKey
        Confirmed = True
    End If
End Sub

The painful thing is that the certificate needs to be reloaded every time. I want to cache these certificates, and I need to modify some properties of the object socket in this event, but I'm not sure which ones, please advise, thank you.