Server certificates...

[gpauk]

Hi..
Please can you advise me on this...
Looking at example basicserver (barebonestls) this works fine except for the certificate.

Private Sub Listen(sAddr As String, ByVal lPort As Long)
    If Not PkiGenerSelfSignedCertificate(m_cCerts, m_cPrivKey) Then
        Exit Sub
    End If
    ReDim m_uCtx(0 To 0)
    wscSocket(0).Bind lPort, sAddr
    wscSocket(0).Listen
End Sub

How do I either
1 - Customise the certificate generated by "PkiGenerSelfSignedCertificate" or
2 - Load my own certificate.

Thanks for any assistance!

[wqweto]

Hi,

How do I either
1 - Customise the certificate generated by "PkiGenerSelfSignedCertificate" or

You just edit the source code of PkiGenerSelfSignedCertificate in sample's Module1 if you need to customize anything about the self-signed certificate generation.

2 - Load my own certificate.

PkiGenerSelfSignedCertificate generates the result in two collections with byte-arrays -- one collection for the certificates and second for the private key -- which are passed to TlsInitServer function. The first collection contains server's certificate byte-array as first entry and then more intermediate certificates (if needed) that form the certificate chain to a trust anchor (usually a root certificate). The second collection has just one byte-array with the server's certificate private key.

Take a look at src\cTlsSocket.cls class -- it has PkiPemImportCertificates and PkiPkcs12ImportCertificates methods which are able to load PEM encoded certificate bundles (one or more certificates and one private key) and password protected P12/PFX certificate containers. I just copies PkiGenerSelfSignedCertificate from there for the barebones sample so these methods produce compatible results -- two collections with byte-arrays.

Try this first but easiest would be to just use cTlsSocket class which has certificate generation/loading already implemented, otherwise you'll have to copy a bit of source code from there to the barebones sample and probably understand it beforehand to be sure nothing breaks up.

[gpauk]

Thanks for the very helpful reply.
I looked at PkiGenerSelfSignedCertificate but could only find some of the cert parameters there, CN for example is easy to set, but other attributes like locality, state, country name... I couldn't see where those are set...

I've experimented with the cTlsSocket too - got the cert loading working fine with that! I got stuck with, for example TlsSocket.vbp (TlsSocketTest). That receives data fine, but I'm struggling with sending data back to the connected client.

Apologies for the newbie questions -- I'm new to vb6!
Thanks again...

[wqweto]

PkiGenerSelfSignedCertificate just uses CertStrToName function and this API supports a lot of X.500 keys, just check out the link in MSDN.

Btw, there is an optional Subject parameter to PkiGenerSelfSignedCertificate which accepts the string to be passed to CertStrToName so you can actually use something like "CN=MyCommonName,L=MyLocality,ST=MyState,C=MyCountry" and so on (keys as described in the MSDN dicumentation for CertStrToNameA) without modifying the source code of PkiGenerSelfSignedCertificate in the end.

For a sample server using cTlsSocket you can take a look at test\Secure directory. This implements both an https client and an https server on port 127.0.0.1:10443 loading certificates in Form2 like this

    Const PEM_FILES     As String = "eccert.pem|ecprivkey.pem|fullchain2.pem"
    Const PFX_FILE      As String = "eccert.pfx"
    Const PFX_PASSWORD  As String = ""
    ...
    If Not m_oServerSocket.InitServerTls(PemFiles:=PEM_FILES, PfxFile:=PFX_FILE, Password:=PFX_PASSWORD) Then
        MsgBox "Error starting TLS server on localhost:10443" & vbCrLf & vbCrLf & "No private key found!", vbExclamation
        GoTo QH
    End If

This loads the sample ECC certificates files (generated with openssl) located in the same directory. Notice that PemFiles parameter accepts pipe separated list of files if server certificate, intermediate certificates and server certificate's private key are in separate files (as they usually are).

[gpauk]

Thanks... Works a treat!
Thanks again for the quick and helpful replies!

[junnylc]

You should do this:

    With yourSock
         .Close_
         .Protocol = sckTLSProtocol 
         .Bind yourPort, yourIP
         .Listen "", yourPfxFile, yourPass 
    End With