STARTTLS

[mirko12]

How to implement STARTTLS on server side?
I want to switch to TLS when client sends STARTTLS. I tried everything I could think of, no success.
Can you please help me with this?
Thank you.

[wqweto]

I don't have sample code ready but after accepting the client connection and after negotiating STARTTLS in plain text on the accepted cTlsSocket, try calling InitServerTls on this same cTlsSocket instance.

Will try cobbling an SMTP server emulation that supports STARTTLS for test purposes when time permits.

[wqweto]

Try running Project1.vbp in test/Basic directory and check out SMTP with STARTTLS button if it is working with gmail.com

Then check out the code in Command7_Click handler which calls SyncStartTls method after sending STARTTLS command.

[mirko12]

Thank you. I managed to get STARTTLS working, using BareboneTls from test folder. Now I'm facing another problem - it works fine with PkiGenerSelfSignedCertificate, but then I get certificate error (works with ucsTlsIgnoreServerCertificateErrors). Is there a way to use e.eg. Lets' Encrypt certificate? I tried with ImportPemRootCaCertStore and InitServerTls with .pem certificate, it doesn't throw any error, but then TLS handshake fails. On server side I get Unexpected record type (21) and on the client side Unsupported public key OID (1.2.840.113549.1.1.1).

[wqweto]

You need ImportPemRootCaCertStore only for clients to set additional trust anchors to be used when validating server certs.

Of course you can use Let’s Encrypt and any other CA issued certificate. Just make sure to provide both cert and key and also all intermediary certs in one or more PEM files. Or you can bundle certs + key in a PFX file too.

[mirko12]

That makes sense.

.pfx import doesn't work on Windows XP (PFXImportCertStore returns 0 for Let's Encrypt certicate). It works on Windows 8, but then it fails in handshake: NCryptOpenKey returns -2146893802. On Windows 10 everything works.

So I got everything working now. Thank you for sharing this wonderful code.

[wqweto]

This could be because they issue ECDSA signed certs and XP crypto does not support Elliptic Curves at all. Win8 problem is weird, will have to investigate it here.

Btw, you can bundle cert + key + intermediary in a single PEM file or pass pipe-delimited several filenames for CertFile parameter. It also supports PBES encrypted key files in PEM format through Password parameter.

Edit: NCryptOpenKey error is weird (-2146893802 = NTE_BAD_KEYSET) as this is only called when using certificates from system stores i.e. ones imported using certmgr.msc. Could it be that your PFX contains one or more certifcates but misses the key for the leaf-level certificate?

[junnylc]

How to implement STARTTLS on server side?
I want to switch to TLS when client sends STARTTLS. I tried everything I could think of, no success.
Can you please help me with this?
Thank you.

in your programe:

Private Sub ws_SendComplete()
    If ChangeProtocol Then
        ws.UseTlsProtocol PfxFile, ExtraPass '###########Attention!#############
        ChangeProtocol = False
        StartTlsMode = True
    End If
    
    PartSendComplete = True
    If LogOutOk Then Unload Me
End Sub

in file ctxWinSocket.ctl, add new function:

Public Function UseTlsProtocol(ByVal CertFile As String, Optional ByVal Password As String) As Boolean 
    If pvSocket.InitServerTls(CertFile, Password, , , , , , False) Then  '###########Attention!#############
        pvSocket.UseTlsProtocol
        pvState = sckConnected 
        m_eProtocol = sckTLSProtocol
        PropertyChanged
        UseTlsProtocol = True
    End If
End Function

in file oTlsSocket.cls:

Public Function InitServerTls( _
            Optional CertFile As String, _
            Optional Password As String, _
            Optional CertSubject As String, _
            Optional Certificates As Collection, _
            Optional PrivateKey As Collection, _
            Optional AlpnProtocols As String, _
            Optional ByVal LocalFeatures As UcsTlsLocalFeaturesEnum, _
            Optional IsServerByZdc As Boolean = True) As Boolean 'IsServerByZdc added vy zdc###########Attention!#############
    ......
    ......
StartTls:
    m_bUseTls = True
    m_bIsServer = IsServerByZdc 'edit by zdc 2024-12-5###########Attention!#############
    m_oSocket.GetPeerName m_sRemoteHostName, 0
    m_sAlpnProtocols = AlpnProtocols
    If (LocalFeatures And ucsTlsSupportAll) = 0 Then
        m_eLocalFeatures = LocalFeatures Or ucsTlsSupportAll
    Else
        m_eLocalFeatures = LocalFeatures
    End If
    If Not TlsInitServer(m_uCtx, m_sRemoteHostName, cCerts, cPrivKey, m_sAlpnProtocols, m_eLocalFeatures, IsServerByZdc) Then
        GoTo QH
    End If
    '--- success
    InitServerTls = True
    ......
    ......
End Function