Check SSL Certificate on HTTPs Connection
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
PhilmacFLy · 2017-05-03 09:36

I'm developing a small app which communicates with a backend on my
server.
In order to make sure that the app does indeed communicate with my
server and not to someone else, I'm trying to implement a check on the
fingerprint of the ssl certificate of the server.

Now with TFPHttpClient I can pretty easily access the server and send
https requests, but I get no info about the cert itself. It even
accepts self signed certs.

Is there a way to check the certificate of the server?

----------------------------------------------------------------------
PhilmacFLy · 2017-05-03 13:19

Well not quite, imagine a man-in-the-middle attack where the attacker
is (in which way ever) provide a valid cert for my domain. If I could
check the fingerprint of said cert I would know that they are not the
same (also known as certificate pinning)

Edit: Seems like someone deleted their post after I made mine

----------------------------------------------------------------------
Thaddy · 2017-05-03 14:03

Yes, I did, because I am preparing a better response.
But you seem to understand it.
What you need is not certification (that's done like in the deleted
post and still valid for self signed certificates that's why you
should not use those in real life) but a means of root-certification.
Any way of other certification is fruitless.

----------------------------------------------------------------------
PhilmacFLy · 2017-05-04 09:29

But isnt the root certificate part of the certification chain of my
own certificate? So if I can retrieve the certificate I can go along
the tree and check the fingerprints and issuers for the one I'm
searching. The Problem is just, that this leaves me with the problem
described that I dont know how to access the cert presented to me.

----------------------------------------------------------------------
PhilmacFLy · 2017-05-04 15:21

Ok it turns out in the end its a lot easier than thought, you just
have to utilize the TTCPBlockSocket from synapse as well as the
TSSLOpenSSL from the synapse openssl implementation. I made a little
showcase to post it here
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i procedure
TForm1.Button2Click(Sender: TObject);var  sock: TTCPBlockSocket;  ssl:
TSSLOpenSSL;  s: string;begin  sock := ttcpblocksocket.Create; 
sock.Connect('10.146.206.15', '3791');  if sock.LastError <> 0 then
begin    memo1.Lines.Add(sock.LastErrorDesc);     Exit;  end;  ssl :=
TSSLOpenSSL.Create(sock);  if ssl.LastError <> 0 then begin   
memo1.Lines.Add(ssl.LastErrorDesc);     Exit;  end;  ssl.Connect;  if
ssl.LastError <> 0 then begin    memo1.Lines.Add(ssl.LastErrorDesc);  
  Exit;  end;  memo1.Lines.Add(ssl.GetPeerIssuer); 
memo1.Lines.Add(ssl.GetPeerFingerprint); 
memo1.Lines.Add(ssl.GetCertInfo);end;
Now you can use the TSSLOpenSSL to access all infos that you want/need