Client certificate mandatory and verification
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
nummer8 · 2024-03-23 11:48

Hi,

Out of the info on the wiki I created a simple Webserver with a
server-certificate.
To get this code working you need to create the necessary certificate.
For this I used xca from https://hohnstaedt.de but you can use OpenSSL
to do the same.


Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i program
webserver; {$mode objfpc}{$H+} uses  {$ifdef UNIX}  cthreads, cmem, 
{$endif}  fphttpapp,  httpdefs,  httproute,  opensslsockets; var 
fUseSSL: boolean;const  fCertificatePassword: string = 'hello'; 
fCertificateHostName: string = 'localhost';  fCertificateFileName:
string = 'Server.crt';  fCertificatePrivateKey: string =
'Server.key';   procedure route1(aReq: TRequest; aResp: TResponse); 
begin    aResp.Content := '<html><body><h1>Route 1 The
Default</h1></body></html>';  end;   procedure route2(aReq: TRequest;
aResp: TResponse);  begin    aResp.Content := '<html><body><h1>Route
2</h1></body></html>';  end; begin  HTTPRouter.RegisterRoute('/',
@route1);  HTTPRouter.RegisterRoute('/2', @route2);  Application.Port
:= 1999;  fUseSSL :=true;  Application.UseSSL := fUseSSL;  if fUseSSL
then  begin    Application.CertificateData.KeyPassword :=
fCertificatePassword;    Application.CertificateData.HostName :=
fCertificateHostName;   
Application.CertificateData.Certificate.FileName :=
fCertificateFileName;   
Application.CertificateData.PrivateKey.FileName :=
fCertificatePrivateKey;  end;  Application.Threaded := True; 
Application.Initialize;  Application.Run;end. 
My questions are:
- How can I modify this example to enforce the use of a client
certificate?
- How can I verify a client certificate in the server?

In the TLS handshake a client certificate is optional but the server
can ensure that it is mandatory.

Any help, pointers, sample code is appreciated.

----------------------------------------------------------------------
Thaddy · 2024-03-23 11:56

Since a few days there is an example to do just that, but there is
also a small bug in that.
Thr bug is easy to spot and easy to fix for programmers that involve
themselves in certificates and really understand them.

----------------------------------------------------------------------
nummer8 · 2024-03-23 14:11

Just to be complete and if some one reads this post in the future.
I assume to refer to the fcm example in the fcl-web package?

https://gitlab.com/freepascal.org/fpc/source/-/tree/main/packages/fcl-
web/examples/fcm?ref_type=heads

----------------------------------------------------------------------
Thaddy · 2024-03-23 16:11

No the fcl-hash package.