---
product: Chilkat
product_version: 11.7.0
language: delphidll
language_label: Delphi DLL
class: Cert
license: free
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/dd_CkCertRef.html
---
# Chilkat Cert — Delphi DLL — v11.7.0

> Chilkat 11.7.0 · language=delphidll · class=Cert
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/Cert.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/delphidll/guide.md`.

## Purpose

**Load, inspect, validate, and use X.509 certificates throughout Chilkat.**

`Chilkat.Cert` is the central certificate object used throughout Chilkat for TLS, S/MIME, PKCS7/CMS, PDF signing, XML signing, code signing, decryption, certificate stores, smart cards, HSMs, PKCS#11, and cloud-based signing. It provides a broad set of features for loading certificates, inspecting certificate fields, checking validity, accessing private keys, building chains, checking revocation status, exporting certificate data, and diagnosing certificate-related problems.

**Load certificates**

Load public certificates from PEM, DER, Base64, files, strings, binary data, certificate stores, PFX/P12 files, smart cards, and other sources.

**Inspect certificate details**

Read subject and issuer fields, serial numbers, fingerprints, validity dates, key usage, extensions, SAN values, and other X.509 information.

**Private key access**

Work with certificates backed by private keys from PFX/P12 files, OS certificate stores, smart cards, HSMs, PKCS#11 modules, or cloud signing providers.

**Trust and validation**

Build and inspect certificate chains, verify signatures, check expiration, examine trust-related information, and work with revocation data.

**Use across Chilkat**

Pass `Cert` objects to other Chilkat classes for TLS client authentication, S/MIME, signing, encryption, decryption, and verification.

**Export and diagnostics**

Export certificate data in common formats and use detailed diagnostic output to troubleshoot loading, validation, private-key, chain, or store problems.

**Common pattern:** Use certificate-only formats such as PEM or DER when only the public certificate is needed. Use PFX/P12, an OS certificate store, smart-card loading, PKCS#11 linking, HSM integration, or cloud-signing configuration when a private key operation is required.

For an extended overview, see [Cert Class Overview](https://www.chilkatsoft.com/cert_class_overview.asp).

## Object creation, unlocking and error handling

**Create/Dispose**

```pascal
var
myObject: HCkCert;

begin
myObject := CkCert_Create();

// ...

CkCert_Dispose(myObject);
end;
```

`function CkCert_Create: HCkCert; stdcall;`

Creates an instance of the HCkCert object and returns a handle (i.e. a Pointer). The handle is passed in the 1st argument for the functions listed on this page.

`procedure CkCert_Dispose(handle: HCkCert); stdcall;`

Objects created by calling CkCert_Create must be freed by calling this method. A memory leak occurs if a handle is not disposed by calling this function.

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Delphi DLL.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `procedure CkCert_getDebugLogFilePath(objHandle: HCkCert; outPropVal: HCkString); stdcall; procedure CkCert_putDebugLogFilePath(objHandle: HCkCert; newPropVal: PWideChar); stdcall; function CkCert__debugLogFilePath(objHandle: HCkCert): PWideChar; stdcall;` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `procedure CkCert_getLastErrorHtml(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__lastErrorHtml(objHandle: HCkCert): PWideChar; stdcall;` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `procedure CkCert_getLastErrorText(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__lastErrorText(objHandle: HCkCert): PWideChar; stdcall;` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `procedure CkCert_getLastErrorXml(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__lastErrorXml(objHandle: HCkCert): PWideChar; stdcall;` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `function CkCert_getLastMethodSuccess(objHandle: HCkCert): wordbool; stdcall; procedure CkCert_putLastMethodSuccess(objHandle: HCkCert; newPropVal: wordbool); stdcall;` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. |
| `VerboseLogging` | `function CkCert_getVerboseLogging(objHandle: HCkCert): wordbool; stdcall; procedure CkCert_putVerboseLogging(objHandle: HCkCert; newPropVal: wordbool); stdcall;` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `procedure CkCert_getVersion(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__version(objHandle: HCkCert): PWideChar; stdcall;` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `AuthorityKeyId` | property, read-only | `procedure CkCert_getAuthorityKeyId(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__authorityKeyId(objHandle: HCkCert): PWideChar; stdcall;` |
| `AvoidWindowsPkAccess` | property, read/write | `function CkCert_getAvoidWindowsPkAccess(objHandle: HCkCert): wordbool; stdcall; procedure CkCert_putAvoidWindowsPkAccess(objHandle: HCkCert; newPropVal: wordbool); stdcall;` |
| `CertVersion` | property, read-only | `function CkCert_getCertVersion(objHandle: HCkCert): Integer; stdcall;` |
| `Expired` | property, read-only | `function CkCert_getExpired(objHandle: HCkCert): wordbool; stdcall;` |
| `ExtendedKeyUsage` | property, read-only | `procedure CkCert_getExtendedKeyUsage(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__extendedKeyUsage(objHandle: HCkCert): PWideChar; stdcall;` |
| `ForClientAuthentication` | property, read-only | `function CkCert_getForClientAuthentication(objHandle: HCkCert): wordbool; stdcall;` |
| `ForCodeSigning` | property, read-only | `function CkCert_getForCodeSigning(objHandle: HCkCert): wordbool; stdcall;` |
| `ForSecureEmail` | property, read-only | `function CkCert_getForSecureEmail(objHandle: HCkCert): wordbool; stdcall;` |
| `ForServerAuthentication` | property, read-only | `function CkCert_getForServerAuthentication(objHandle: HCkCert): wordbool; stdcall;` |
| `ForTimeStamping` | property, read-only | `function CkCert_getForTimeStamping(objHandle: HCkCert): wordbool; stdcall;` |
| `IntendedKeyUsage` | property, read-only | `function CkCert_getIntendedKeyUsage(objHandle: HCkCert): LongWord; stdcall;` |
| `IsRoot` | property, read-only | `function CkCert_getIsRoot(objHandle: HCkCert): wordbool; stdcall;` |
| `IssuerC` | property, read-only | `procedure CkCert_getIssuerC(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__issuerC(objHandle: HCkCert): PWideChar; stdcall;` |
| `IssuerCN` | property, read-only | `procedure CkCert_getIssuerCN(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__issuerCN(objHandle: HCkCert): PWideChar; stdcall;` |
| `IssuerDN` | property, read-only | `procedure CkCert_getIssuerDN(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__issuerDN(objHandle: HCkCert): PWideChar; stdcall;` |
| `IssuerE` | property, read-only | `procedure CkCert_getIssuerE(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__issuerE(objHandle: HCkCert): PWideChar; stdcall;` |
| `IssuerL` | property, read-only | `procedure CkCert_getIssuerL(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__issuerL(objHandle: HCkCert): PWideChar; stdcall;` |
| `IssuerO` | property, read-only | `procedure CkCert_getIssuerO(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__issuerO(objHandle: HCkCert): PWideChar; stdcall;` |
| `IssuerOU` | property, read-only | `procedure CkCert_getIssuerOU(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__issuerOU(objHandle: HCkCert): PWideChar; stdcall;` |
| `IssuerS` | property, read-only | `procedure CkCert_getIssuerS(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__issuerS(objHandle: HCkCert): PWideChar; stdcall;` |
| `OcspUrl` | property, read-only | `procedure CkCert_getOcspUrl(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__ocspUrl(objHandle: HCkCert): PWideChar; stdcall;` |
| `PrivateKeyExportable` | property, read-only | `function CkCert_getPrivateKeyExportable(objHandle: HCkCert): wordbool; stdcall;` |
| `Revoked` | property, read-only | `function CkCert_getRevoked(objHandle: HCkCert): wordbool; stdcall;` |
| `Rfc822Name` | property, read-only | `procedure CkCert_getRfc822Name(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__rfc822Name(objHandle: HCkCert): PWideChar; stdcall;` |
| `SelfSigned` | property, read-only | `function CkCert_getSelfSigned(objHandle: HCkCert): wordbool; stdcall;` |
| `SerialDecimal` | property, read-only | `procedure CkCert_getSerialDecimal(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__serialDecimal(objHandle: HCkCert): PWideChar; stdcall;` |
| `SerialNumber` | property, read-only | `procedure CkCert_getSerialNumber(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__serialNumber(objHandle: HCkCert): PWideChar; stdcall;` |
| `Sha1Thumbprint` | property, read-only | `procedure CkCert_getSha1Thumbprint(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__sha1Thumbprint(objHandle: HCkCert): PWideChar; stdcall;` |
| `SignatureVerified` | property, read-only | `function CkCert_getSignatureVerified(objHandle: HCkCert): wordbool; stdcall;` |
| `SmartCardFailReason` | property, read-only | `function CkCert_getSmartCardFailReason(objHandle: HCkCert): Integer; stdcall;` |
| `SmartCardNoDialog` | property, read/write | `function CkCert_getSmartCardNoDialog(objHandle: HCkCert): wordbool; stdcall; procedure CkCert_putSmartCardNoDialog(objHandle: HCkCert; newPropVal: wordbool); stdcall;` |
| `SmartCardPin` | property, read/write | `procedure CkCert_getSmartCardPin(objHandle: HCkCert; outPropVal: HCkString); stdcall; procedure CkCert_putSmartCardPin(objHandle: HCkCert; newPropVal: PWideChar); stdcall; function CkCert__smartCardPin(objHandle: HCkCert): PWideChar; stdcall;` |
| `SubjectAlternativeName` | property, read-only | `procedure CkCert_getSubjectAlternativeName(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__subjectAlternativeName(objHandle: HCkCert): PWideChar; stdcall;` |
| `SubjectC` | property, read-only | `procedure CkCert_getSubjectC(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__subjectC(objHandle: HCkCert): PWideChar; stdcall;` |
| `SubjectCN` | property, read-only | `procedure CkCert_getSubjectCN(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__subjectCN(objHandle: HCkCert): PWideChar; stdcall;` |
| `SubjectDN` | property, read-only | `procedure CkCert_getSubjectDN(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__subjectDN(objHandle: HCkCert): PWideChar; stdcall;` |
| `SubjectE` | property, read-only | `procedure CkCert_getSubjectE(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__subjectE(objHandle: HCkCert): PWideChar; stdcall;` |
| `SubjectKeyId` | property, read-only | `procedure CkCert_getSubjectKeyId(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__subjectKeyId(objHandle: HCkCert): PWideChar; stdcall;` |
| `SubjectL` | property, read-only | `procedure CkCert_getSubjectL(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__subjectL(objHandle: HCkCert): PWideChar; stdcall;` |
| `SubjectO` | property, read-only | `procedure CkCert_getSubjectO(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__subjectO(objHandle: HCkCert): PWideChar; stdcall;` |
| `SubjectOU` | property, read-only | `procedure CkCert_getSubjectOU(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__subjectOU(objHandle: HCkCert): PWideChar; stdcall;` |
| `SubjectS` | property, read-only | `procedure CkCert_getSubjectS(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__subjectS(objHandle: HCkCert): PWideChar; stdcall;` |
| `TrustedRoot` | property, read-only | `function CkCert_getTrustedRoot(objHandle: HCkCert): wordbool; stdcall;` |
| `UncommonOptions` | property, read/write | `procedure CkCert_getUncommonOptions(objHandle: HCkCert; outPropVal: HCkString); stdcall; procedure CkCert_putUncommonOptions(objHandle: HCkCert; newPropVal: PWideChar); stdcall; function CkCert__uncommonOptions(objHandle: HCkCert): PWideChar; stdcall;` |
| `ValidFromStr` | property, read-only | `procedure CkCert_getValidFromStr(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__validFromStr(objHandle: HCkCert): PWideChar; stdcall;` |
| `ValidToStr` | property, read-only | `procedure CkCert_getValidToStr(objHandle: HCkCert; outPropVal: HCkString); stdcall; function CkCert__validToStr(objHandle: HCkCert): PWideChar; stdcall;` |
| `BuildCertChain` | method | `function CkCert_BuildCertChain(objHandle: HCkCert;     certChain: HCkCertChain): wordbool; stdcall;` |
| `CheckRevoked` | method | `function CkCert_CheckRevoked(objHandle: HCkCert): Integer; stdcall;` |
| `CheckSmartCardPin` | method | `function CkCert_CheckSmartCardPin(objHandle: HCkCert): Integer; stdcall;` |
| `ExportCertDerBd` | method | `function CkCert_ExportCertDerBd(objHandle: HCkCert;     cerData: HCkBinData): wordbool; stdcall;` |
| `ExportCertDerFile` | method | `function CkCert_ExportCertDerFile(objHandle: HCkCert;     path: PWideChar): wordbool; stdcall;` |
| `ExportCertPem` | method | `function CkCert_ExportCertPem(objHandle: HCkCert;     outStr: HCkString): wordbool; stdcall; function CkCert__exportCertPem(objHandle: HCkCert): PWideChar; stdcall;` |
| `ExportCertPemFile` | method | `function CkCert_ExportCertPemFile(objHandle: HCkCert;     path: PWideChar): wordbool; stdcall;` |
| `ExportCertXml` | method | `function CkCert_ExportCertXml(objHandle: HCkCert;     outStr: HCkString): wordbool; stdcall; function CkCert__exportCertXml(objHandle: HCkCert): PWideChar; stdcall;` |
| `ExportToPfxBd` | method | `function CkCert_ExportToPfxBd(objHandle: HCkCert;     password: PWideChar;     includeCertChain: wordbool;     pfxData: HCkBinData): wordbool; stdcall;` |
| `ExportToPfxFile` | method | `function CkCert_ExportToPfxFile(objHandle: HCkCert;     pfxFilename: PWideChar;     pfxPassword: PWideChar;     bIncludeCertChain: wordbool): wordbool; stdcall;` |
| `FindIssuer` | method | `function CkCert_FindIssuer(objHandle: HCkCert): HCkCert; stdcall;` |
| `GetEncoded` | method | `function CkCert_GetEncoded(objHandle: HCkCert;     outStr: HCkString): wordbool; stdcall; function CkCert__getEncoded(objHandle: HCkCert): PWideChar; stdcall;` |
| `GetExtensionAsText` | method | `function CkCert_GetExtensionAsText(objHandle: HCkCert;     oid: PWideChar;     outStr: HCkString): wordbool; stdcall; function CkCert__getExtensionAsText(objHandle: HCkCert;     oid: PWideChar): PWideChar; stdcall;` |
| `GetExtensionAsXml` | method | `function CkCert_GetExtensionAsXml(objHandle: HCkCert;     oid: PWideChar;     outStr: HCkString): wordbool; stdcall; function CkCert__getExtensionAsXml(objHandle: HCkCert;     oid: PWideChar): PWideChar; stdcall;` |
| `GetExtensionBd` | method | `function CkCert_GetExtensionBd(objHandle: HCkCert;     oid: PWideChar;     bd: HCkBinData): wordbool; stdcall;` |
| `GetIssuer` | method | `function CkCert_GetIssuer(objHandle: HCkCert;     issuer: HCkCert): wordbool; stdcall;` |
| `GetPrivateKey` | method | `function CkCert_GetPrivateKey(objHandle: HCkCert;     privKey: HCkPrivateKey): wordbool; stdcall;` |
| `GetPrivateKeyPem` | method | `function CkCert_GetPrivateKeyPem(objHandle: HCkCert;     outStr: HCkString): wordbool; stdcall; function CkCert__getPrivateKeyPem(objHandle: HCkCert): PWideChar; stdcall;` |
| `GetPubKeyDer` | method | `function CkCert_GetPubKeyDer(objHandle: HCkCert;     preferPkcs1: wordbool;     bd: HCkBinData): wordbool; stdcall;` |
| `GetPublicKey` | method | `function CkCert_GetPublicKey(objHandle: HCkCert;     pubKey: HCkPublicKey): wordbool; stdcall;` |
| `GetSignature` | method | `function CkCert_GetSignature(objHandle: HCkCert;     bd: HCkBinData): wordbool; stdcall;` |
| `GetSpkiFingerprint` | method | `function CkCert_GetSpkiFingerprint(objHandle: HCkCert;     hashAlg: PWideChar;     encoding: PWideChar;     outStr: HCkString): wordbool; stdcall; function CkCert__getSpkiFingerprint(objHandle: HCkCert;     hashAlg: PWideChar;     encoding: PWideChar): PWideChar; stdcall;` |
| `GetSubjectPart` | method | `function CkCert_GetSubjectPart(objHandle: HCkCert;     partNameOrOid: PWideChar;     outStr: HCkString): wordbool; stdcall; function CkCert__getSubjectPart(objHandle: HCkCert;     partNameOrOid: PWideChar): PWideChar; stdcall;` |
| `HashOf` | method | `function CkCert_HashOf(objHandle: HCkCert;     part: PWideChar;     hashAlg: PWideChar;     encoding: PWideChar;     outStr: HCkString): wordbool; stdcall; function CkCert__hashOf(objHandle: HCkCert;     part: PWideChar;     hashAlg: PWideChar;     encoding: PWideChar): PWideChar; stdcall;` |
| `HasPrivateKey` | method | `function CkCert_HasPrivateKey(objHandle: HCkCert): wordbool; stdcall;` |
| `IsEcdsa` | method | `function CkCert_IsEcdsa(objHandle: HCkCert): wordbool; stdcall;` |
| `IsRsa` | method | `function CkCert_IsRsa(objHandle: HCkCert): wordbool; stdcall;` |
| `LinkPkcs11` | method | `function CkCert_LinkPkcs11(objHandle: HCkCert;     session: HCkPkcs11): wordbool; stdcall;` |
| `LoadByCommonName` | method | `function CkCert_LoadByCommonName(objHandle: HCkCert;     cn: PWideChar): wordbool; stdcall;` |
| `LoadByEmailAddress` | method | `function CkCert_LoadByEmailAddress(objHandle: HCkCert;     emailAddress: PWideChar): wordbool; stdcall;` |
| `LoadByIssuerAndSerialNumber` | method | `function CkCert_LoadByIssuerAndSerialNumber(objHandle: HCkCert;     issuerCN: PWideChar;     serialNumber: PWideChar): wordbool; stdcall;` |
| `LoadBySubjectOid` | method | `function CkCert_LoadBySubjectOid(objHandle: HCkCert;     oid: PWideChar;     value: PWideChar): wordbool; stdcall;` |
| `LoadByThumbprint` | method | `function CkCert_LoadByThumbprint(objHandle: HCkCert;     thumbprint: PWideChar;     encoding: PWideChar): wordbool; stdcall;` |
| `LoadFromBase64` | method | `function CkCert_LoadFromBase64(objHandle: HCkCert;     encodedCert: PWideChar): wordbool; stdcall;` |
| `LoadFromBd` | method | `function CkCert_LoadFromBd(objHandle: HCkCert;     certBytes: HCkBinData): wordbool; stdcall;` |
| `LoadFromFile` | method | `function CkCert_LoadFromFile(objHandle: HCkCert;     path: PWideChar): wordbool; stdcall;` |
| `LoadFromSmartcard` | method | `function CkCert_LoadFromSmartcard(objHandle: HCkCert;     certSpec: PWideChar): wordbool; stdcall;` |
| `LoadPem` | method | `function CkCert_LoadPem(objHandle: HCkCert;     strPem: PWideChar): wordbool; stdcall;` |
| `LoadPfxBd` | method | `function CkCert_LoadPfxBd(objHandle: HCkCert;     pfxData: HCkBinData;     password: PWideChar): wordbool; stdcall;` |
| `LoadPfxFile` | method | `function CkCert_LoadPfxFile(objHandle: HCkCert;     pfxPath: PWideChar;     password: PWideChar): wordbool; stdcall;` |
| `LoadTaskResult` | method | `function CkCert_LoadTaskResult(objHandle: HCkCert;     task: HCkTask): wordbool; stdcall;` |
| `PemFileToDerFile` | method | `function CkCert_PemFileToDerFile(objHandle: HCkCert;     fromPath: PWideChar;     toPath: PWideChar): wordbool; stdcall;` |
| `SaveToFile` | method | `function CkCert_SaveToFile(objHandle: HCkCert;     path: PWideChar): wordbool; stdcall;` |
| `SetCloudSigner` | method | `function CkCert_SetCloudSigner(objHandle: HCkCert;     json: HCkJsonObject): wordbool; stdcall;` |
| `SetFromEncoded` | method | `function CkCert_SetFromEncoded(objHandle: HCkCert;     encodedCert: PWideChar): wordbool; stdcall;` |
| `SetPrivateKey` | method | `function CkCert_SetPrivateKey(objHandle: HCkCert;     privKey: HCkPrivateKey): wordbool; stdcall;` |
| `SetPrivateKeyPem` | method | `function CkCert_SetPrivateKeyPem(objHandle: HCkCert;     privKeyPem: PWideChar): wordbool; stdcall;` |
| `Unload` | method | `function CkCert_Unload(objHandle: HCkCert): wordbool; stdcall;` |
| `UploadToCloud` | method | `function CkCert_UploadToCloud(objHandle: HCkCert;     jsonIn: HCkJsonObject;     jsonOut: HCkJsonObject): wordbool; stdcall;` |
| `UseCertVault` | method | `function CkCert_UseCertVault(objHandle: HCkCert;     vault: HCkXmlCertVault): wordbool; stdcall;` |
| `VerifySignature` | method | `function CkCert_VerifySignature(objHandle: HCkCert): wordbool; stdcall;` |
| `X509PKIPathv1` | method | `function CkCert_X509PKIPathv1(objHandle: HCkCert;     outStr: HCkString): wordbool; stdcall; function CkCert__x509PKIPathv1(objHandle: HCkCert): PWideChar; stdcall;` |

Deprecated members are listed at the end of this file with their replacements; do not use them in new code.

## Properties

### Cert.AuthorityKeyId

`Chilkat 11.7.0 · delphidll · Cert · AuthorityKeyId · property · read-only · since 9.5.0.40`

```pascal
procedure CkCert_getAuthorityKeyId(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__authorityKeyId(objHandle: HCkCert): PWideChar; stdcall;
```

The authority key identifier of the certificate in base64 string format. This is only present if the certificate contains the extension OID 2.5.29.35.

### Cert.AvoidWindowsPkAccess

`Chilkat 11.7.0 · delphidll · Cert · AvoidWindowsPkAccess · property · read/write`

```pascal
function CkCert_getAvoidWindowsPkAccess(objHandle: HCkCert): wordbool; stdcall;
procedure CkCert_putAvoidWindowsPkAccess(objHandle: HCkCert; newPropVal: wordbool); stdcall;
```

Applies only when running on a Microsoft Windows operating system. If `True`, then any method that returns a certificate will not try to also access the associated private key, assuming one exists. This is useful if the certificate was installed with high-security such that a private key access would trigger the Windows OS to display a security warning dialog. The default value of this property is `False`.

### Cert.CertVersion

`Chilkat 11.7.0 · delphidll · Cert · CertVersion · property · read-only`

```pascal
function CkCert_getCertVersion(objHandle: HCkCert): Integer; stdcall;
```

The version of the certificate (1, 2, or 3). A value of 0 indicates an error -- the most likely cause being that the certificate object is empty (i.e. was never loaded with a certificate). Note: This is not the version of the software, it is the version of the X.509 certificate object. The version of the Chilkat certificate software is indicated by the Version property.

### Cert.Expired

`Chilkat 11.7.0 · delphidll · Cert · Expired · property · read-only`

```pascal
function CkCert_getExpired(objHandle: HCkCert): wordbool; stdcall;
```

Has a value of `True` if the certificate or any certificate in the chain of authority has expired. (This information is not available when running on Windows 95/98 computers.)

### Cert.ExtendedKeyUsage

`Chilkat 11.7.0 · delphidll · Cert · ExtendedKeyUsage · property · read-only · since 9.5.0.85`

```pascal
procedure CkCert_getExtendedKeyUsage(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__extendedKeyUsage(objHandle: HCkCert): PWideChar; stdcall;
```

Returns a string containing a comma separated list of keywords with the extended key usages of the certificate. The list of possible extended key usages are:

- serverAuth - TLS WWW server authentication
- clientAuth - TLS WWW client authentication
- codeSigning - Signing of downloadable executable code
- emailProtection - Email protection
- timeStamping - Binding the hash of an object to a time
- OCSPSigning - Signing OCSP responses

### Cert.ForClientAuthentication

`Chilkat 11.7.0 · delphidll · Cert · ForClientAuthentication · property · read-only`

```pascal
function CkCert_getForClientAuthentication(objHandle: HCkCert): wordbool; stdcall;
```

`True` if this certificate can be used for client authentication, otherwise `False`.

### Cert.ForCodeSigning

`Chilkat 11.7.0 · delphidll · Cert · ForCodeSigning · property · read-only`

```pascal
function CkCert_getForCodeSigning(objHandle: HCkCert): wordbool; stdcall;
```

`True` if this certificate can be used for code signing, otherwise `False`.

### Cert.ForSecureEmail

`Chilkat 11.7.0 · delphidll · Cert · ForSecureEmail · property · read-only`

```pascal
function CkCert_getForSecureEmail(objHandle: HCkCert): wordbool; stdcall;
```

`True` if this certificate can be used for sending secure email, otherwise `False`.

### Cert.ForServerAuthentication

`Chilkat 11.7.0 · delphidll · Cert · ForServerAuthentication · property · read-only`

```pascal
function CkCert_getForServerAuthentication(objHandle: HCkCert): wordbool; stdcall;
```

`True` if this certificate can be used for server authentication, otherwise `False`.

### Cert.ForTimeStamping

`Chilkat 11.7.0 · delphidll · Cert · ForTimeStamping · property · read-only`

```pascal
function CkCert_getForTimeStamping(objHandle: HCkCert): wordbool; stdcall;
```

`True` if this certificate can be used for time stamping, otherwise `False`.

### Cert.IntendedKeyUsage

`Chilkat 11.7.0 · delphidll · Cert · IntendedKeyUsage · property · read-only`

```pascal
function CkCert_getIntendedKeyUsage(objHandle: HCkCert): LongWord; stdcall;
```

Bitflags indicating the intended usages of the certificate. The flags are:  
Digital Signature: 0x80  
Non-Repudiation: 0x40  
Key Encipherment: 0x20  
Data Encipherment: 0x10  
Key Agreement: 0x08  
Certificate Signing: 0x04  
CRL Signing: 0x02  
Encipher-Only: 0x01

### Cert.IsRoot

`Chilkat 11.7.0 · delphidll · Cert · IsRoot · property · read-only`

```pascal
function CkCert_getIsRoot(objHandle: HCkCert): wordbool; stdcall;
```

`True` if this is the root certificate, otherwise `False`.

### Cert.IssuerC

`Chilkat 11.7.0 · delphidll · Cert · IssuerC · property · read-only`

```pascal
procedure CkCert_getIssuerC(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__issuerC(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate issuer's country.

### Cert.IssuerCN

`Chilkat 11.7.0 · delphidll · Cert · IssuerCN · property · read-only`

```pascal
procedure CkCert_getIssuerCN(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__issuerCN(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate issuer's common name.

### Cert.IssuerDN

`Chilkat 11.7.0 · delphidll · Cert · IssuerDN · property · read-only`

```pascal
procedure CkCert_getIssuerDN(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__issuerDN(objHandle: HCkCert): PWideChar; stdcall;
```

The issuer's full distinguished name.

### Cert.IssuerE

`Chilkat 11.7.0 · delphidll · Cert · IssuerE · property · read-only`

```pascal
procedure CkCert_getIssuerE(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__issuerE(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate issuer's email address.

### Cert.IssuerL

`Chilkat 11.7.0 · delphidll · Cert · IssuerL · property · read-only`

```pascal
procedure CkCert_getIssuerL(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__issuerL(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate issuer's locality, which could be a city, count, township, or other geographic region.

### Cert.IssuerO

`Chilkat 11.7.0 · delphidll · Cert · IssuerO · property · read-only`

```pascal
procedure CkCert_getIssuerO(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__issuerO(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate issuer's organization, which is typically the company name.

### Cert.IssuerOU

`Chilkat 11.7.0 · delphidll · Cert · IssuerOU · property · read-only`

```pascal
procedure CkCert_getIssuerOU(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__issuerOU(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate issuer's organizational unit, which is the unit within the organization.

### Cert.IssuerS

`Chilkat 11.7.0 · delphidll · Cert · IssuerS · property · read-only`

```pascal
procedure CkCert_getIssuerS(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__issuerS(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate issuer's state or province.

### Cert.OcspUrl

`Chilkat 11.7.0 · delphidll · Cert · OcspUrl · property · read-only`

```pascal
procedure CkCert_getOcspUrl(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__ocspUrl(objHandle: HCkCert): PWideChar; stdcall;
```

If present in the certificate's extensions, returns the OCSP URL of the certificate. (The Online Certificate Status Protocol (OCSP) is an Internet protocol used for obtaining the revocation status of an X.509 digital certificate.)

### Cert.PrivateKeyExportable

`Chilkat 11.7.0 · delphidll · Cert · PrivateKeyExportable · property · read-only`

```pascal
function CkCert_getPrivateKeyExportable(objHandle: HCkCert): wordbool; stdcall;
```

(Relevant only when running on a Microsoft Windows operating system.) Indicates whether the private key was installed with security settings that allow it to be re-exported.

### Cert.Revoked

`Chilkat 11.7.0 · delphidll · Cert · Revoked · property · read-only`

```pascal
function CkCert_getRevoked(objHandle: HCkCert): wordbool; stdcall;
```

**Deprecated:** This property does not check the revocation status of the certificate, and always returns `False`. Do not use it to decide whether a certificate is revoked.

To check whether a certificate has been revoked, call `CheckRevoked` (Windows only), which returns 1 (revoked), 0 (not revoked), or -1 (unable to check). Applications on any operating system can also send an OCSP request to the certificate's `OcspUrl`, if the certificate has one.

(A property cannot do this work because checking revocation can require contacting a CRL distribution point or an OCSP responder over the network, which can take a long time. In some programming languages, properties are evaluated at design time in the IDE.)

**Note:** Chilkat does not check certificate revocation status during the TLS handshake. Settings such as `RequireSslCertVerify` verify signatures, expiration, and the chain to a trusted root, but not revocation. To reject a revoked server certificate, the application must check it after connecting.

### Cert.Rfc822Name

`Chilkat 11.7.0 · delphidll · Cert · Rfc822Name · property · read-only`

```pascal
procedure CkCert_getRfc822Name(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__rfc822Name(objHandle: HCkCert): PWideChar; stdcall;
```

The RFC822 name of the certificate. (The RFC822 name is one part of the Subject Alternative Name extension of a certificate, if it exists. It is often the only part of the SAN.)

If the certificate contains a list of RFC822 names then this property will return the comma separated list of names.

Starting in Chilkat v9.5.0.85, to get the complete Subject Alternative Name extension as XML, use the SubjectAlternativeName property.

### Cert.SelfSigned

`Chilkat 11.7.0 · delphidll · Cert · SelfSigned · property · read-only`

```pascal
function CkCert_getSelfSigned(objHandle: HCkCert): wordbool; stdcall;
```

`True` if this is a self-signed certificate, otherwise `False`.

### Cert.SerialDecimal

`Chilkat 11.7.0 · delphidll · Cert · SerialDecimal · property · read-only · since 9.5.0.75`

```pascal
procedure CkCert_getSerialDecimal(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__serialDecimal(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate's serial number as a decimal string.

### Cert.SerialNumber

`Chilkat 11.7.0 · delphidll · Cert · SerialNumber · property · read-only`

```pascal
procedure CkCert_getSerialNumber(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__serialNumber(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate's serial number as a hexidecimal string.

### Cert.Sha1Thumbprint

`Chilkat 11.7.0 · delphidll · Cert · Sha1Thumbprint · property · read-only`

```pascal
procedure CkCert_getSha1Thumbprint(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__sha1Thumbprint(objHandle: HCkCert): PWideChar; stdcall;
```

Hexidecimal string of the SHA-1 thumbprint for the certificate. (This is the SHA1 hash of the binary DER representation of the entire X.509 certificate.)

### Cert.SignatureVerified

`Chilkat 11.7.0 · delphidll · Cert · SignatureVerified · property · read-only`

```pascal
function CkCert_getSignatureVerified(objHandle: HCkCert): wordbool; stdcall;
```

Returns `True` if the certificate and all certificates in the chain of authority have valid signatures, otherwise returns `False`.

### Cert.SmartCardFailReason

`Chilkat 11.7.0 · delphidll · Cert · SmartCardFailReason · property · read-only · since 10.1.0`

```pascal
function CkCert_getSmartCardFailReason(objHandle: HCkCert): Integer; stdcall;
```

Set after calling LoadFromSmartcard. Possible values are:

- 0 - No failure. The call to LoadFromSmartcard was successful.
- 1 - No smartcard or USB token was detected.
- 2 - The SmartCardPin was provided and the PIN login failed. (Note: Chilkat only PIN authenticates if PKCS11 was the chosen means for communicating with the smartcard.)
- 3 - The certificate matching the specified criteria was not found.
- 99 - Some other undefined failure. Consult the LastErrorText for more information.

### Cert.SmartCardNoDialog

`Chilkat 11.7.0 · delphidll · Cert · SmartCardNoDialog · property · read/write · since 9.5.0.77`

```pascal
function CkCert_getSmartCardNoDialog(objHandle: HCkCert): wordbool; stdcall;
procedure CkCert_putSmartCardNoDialog(objHandle: HCkCert; newPropVal: wordbool); stdcall;
```

If set to `True`, then no dialog will automatically popup if the SmartCardPin is incorrect. Instead, the method requiring the private key on the smart card will fail. The default value of this property is `False`, which means that if the SmartCardPin property is incorrect, a dialog with prompt will be displayed.

### Cert.SmartCardPin

`Chilkat 11.7.0 · delphidll · Cert · SmartCardPin · property · read/write · since 9.5.0.75`

```pascal
procedure CkCert_getSmartCardPin(objHandle: HCkCert; outPropVal: HCkString); stdcall;
procedure CkCert_putSmartCardPin(objHandle: HCkCert; newPropVal: PWideChar); stdcall;
function CkCert__smartCardPin(objHandle: HCkCert): PWideChar; stdcall;
```

Can be set to the PIN value for a certificate / private key stored on a smart card.

### Cert.SubjectAlternativeName

`Chilkat 11.7.0 · delphidll · Cert · SubjectAlternativeName · property · read-only · since 9.5.0.85`

```pascal
procedure CkCert_getSubjectAlternativeName(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__subjectAlternativeName(objHandle: HCkCert): PWideChar; stdcall;
```

The subject alternative name (SAN) name of the certificate returned as XML. See the examples linked below.

### Cert.SubjectC

`Chilkat 11.7.0 · delphidll · Cert · SubjectC · property · read-only`

```pascal
procedure CkCert_getSubjectC(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__subjectC(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate subject's country.

### Cert.SubjectCN

`Chilkat 11.7.0 · delphidll · Cert · SubjectCN · property · read-only`

```pascal
procedure CkCert_getSubjectCN(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__subjectCN(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate subject's common name.

### Cert.SubjectDN

`Chilkat 11.7.0 · delphidll · Cert · SubjectDN · property · read-only`

```pascal
procedure CkCert_getSubjectDN(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__subjectDN(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate subject's full distinguished name.

### Cert.SubjectE

`Chilkat 11.7.0 · delphidll · Cert · SubjectE · property · read-only`

```pascal
procedure CkCert_getSubjectE(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__subjectE(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate subject's email address.

### Cert.SubjectKeyId

`Chilkat 11.7.0 · delphidll · Cert · SubjectKeyId · property · read-only · since 9.5.0.40`

```pascal
procedure CkCert_getSubjectKeyId(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__subjectKeyId(objHandle: HCkCert): PWideChar; stdcall;
```

The subject key identifier of the certificate in base64 string format. This is only present if the certificate contains the extension OID 2.5.29.14.

### Cert.SubjectL

`Chilkat 11.7.0 · delphidll · Cert · SubjectL · property · read-only`

```pascal
procedure CkCert_getSubjectL(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__subjectL(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate subject's locality, which could be a city, count, township, or other geographic region.

### Cert.SubjectO

`Chilkat 11.7.0 · delphidll · Cert · SubjectO · property · read-only`

```pascal
procedure CkCert_getSubjectO(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__subjectO(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate subject's organization, which is typically the company name.

### Cert.SubjectOU

`Chilkat 11.7.0 · delphidll · Cert · SubjectOU · property · read-only`

```pascal
procedure CkCert_getSubjectOU(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__subjectOU(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate subject's organizational unit, which is the unit within the organization.

### Cert.SubjectS

`Chilkat 11.7.0 · delphidll · Cert · SubjectS · property · read-only`

```pascal
procedure CkCert_getSubjectS(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__subjectS(objHandle: HCkCert): PWideChar; stdcall;
```

The certificate subject's state or province.

### Cert.TrustedRoot

`Chilkat 11.7.0 · delphidll · Cert · TrustedRoot · property · read-only`

```pascal
function CkCert_getTrustedRoot(objHandle: HCkCert): wordbool; stdcall;
```

Returns `True` if the certificate has a trusted root authority, otherwise returns `False`.

Note: As of version 9.5.0.41, the notion of what your application deems as trusted becomes more specific. The TrustedRoots class/object was added in v9.5.0.0. Prior to this, a certificate was considered to be anchored by a trusted root if the certificate chain could be established to a root (self-signed) certificate, AND if the root certificate was located somewhere in the Windows registry-based certificate stores. There are two problems with this: (1) it's a Windows-only solution. This property would always return `False` on non-Windows systems, and (2) it might be considered not a strong enough set of conditions for trusting a root certificate.

As of version 9.5.0.41, this property pays attention to the new TrustedRoots class/object, which allows for an application to specificallly indicate which root certificates are to be trusted. Certificates may be added to the TrustedRoots object via the LoadCaCertsPem or AddCert methods, and then activated by calling the TrustedRoots.Activate method. The activated trusted roots are deemed to be trusted in any Chilkat API method/property that needs to make this determination. In addition, the TrustedRoots object has a property named TrustSystemCaRoots, which defaults to `True`, which allows for backward compatibility. It will trust CA certificates stored in the Windows registry-based certificate stores, or if on Linux, will trust certificates found in /etc/ssl/certs/ca-certificates.crt.

### Cert.UncommonOptions

`Chilkat 11.7.0 · delphidll · Cert · UncommonOptions · property · read/write · since 9.5.0.87`

```pascal
procedure CkCert_getUncommonOptions(objHandle: HCkCert; outPropVal: HCkString); stdcall;
procedure CkCert_putUncommonOptions(objHandle: HCkCert; newPropVal: PWideChar); stdcall;
function CkCert__uncommonOptions(objHandle: HCkCert): PWideChar; stdcall;
```

This is a catch-all property to be used for uncommon needs. This property defaults to the empty string, and should typically remain empty. Possible comma separated keywords can include:

- `CheckRevokedCacheOnly`: Added in `v11.2.0`. In the `CheckRevoked` method, prevents network access and only checks the cached revocation information on the local computer.

### Cert.ValidFromStr

`Chilkat 11.7.0 · delphidll · Cert · ValidFromStr · property · read-only`

```pascal
procedure CkCert_getValidFromStr(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__validFromStr(objHandle: HCkCert): PWideChar; stdcall;
```

The date (in RFC822 string format) that this certificate becomes (or became) valid. It is a GMT/UTC date that is returned.

### Cert.ValidToStr

`Chilkat 11.7.0 · delphidll · Cert · ValidToStr · property · read-only`

```pascal
procedure CkCert_getValidToStr(objHandle: HCkCert; outPropVal: HCkString); stdcall;
function CkCert__validToStr(objHandle: HCkCert): PWideChar; stdcall;
```

The date (in RFC822 string format) that this certificate expires. It is a GMT/UTC date that is returned.

## Methods

### Cert.BuildCertChain

`Chilkat 11.7.0 · delphidll · Cert · BuildCertChain · method · since 11.0.0`

```pascal
function CkCert_BuildCertChain(objHandle: HCkCert;
    certChain: HCkCertChain): wordbool; stdcall;
```

Builds the certificate chain in `certChain` containing all the certificates (including this one), in the chain of authentication to the trusted root (if possible). If this certificate object was loaded from a PFX, then the certiicates contained in the PFX are automatically available for building the certificate chain. The UseCertVault method can be called to provide additional certificates that might be required to build the cert chain. Finally, the TrustedRoots object can be used to provide a way of making trusted root certificates available.

Note: Returns `True` even if certificate chain is not completed to the root. The certificate chain's ReachesRoot property can be examined to see if the chain was completed to the root.

On Windows systems, the registry-based certificate stores are automatically consulted if needed to locate intermediate or root certificates in the chain. Chilkat searches certificate stores in the following order. See [System Store Locations](https://docs.microsoft.com/en-us/windows/desktop/seccrypto/system-store-locations) for more information.

1. Current-User `CA` Certificate Store
2. Local-Machine `CA` Certificate Store
3. Current-User `Root` Certificate Store
4. Local-Machine `Root` Certificate Store
5. Current-User `MY` Certificate Store
6. Local-Machine `MY` Certificate Store
7. Current-User `ADDRESSBOOK` Certificate Store (if it exists)
8. Local-Machine `ADDRESSBOOK` Certificate Store (if it exists)

Returns True for success, False for failure.

### Cert.CheckRevoked

`Chilkat 11.7.0 · delphidll · Cert · CheckRevoked · method`

```pascal
function CkCert_CheckRevoked(objHandle: HCkCert): Integer; stdcall;
```

Returns 1 if the certificate has been revoked, 0 if not revoked, and -1 if unable to check the revocation status.

**Note:** This method is only implemented on Windows systems. It uses the underlying Microsoft CertVerifyRevocation Platform SDK function to check the revocation status of a certificate. (Search `CertVerifyRevocation` to get information about it.) Starting in `v11.2.0`, the keyword `"CheckRevokedCacheOnly"` can be included in the `UncommonOptions` to prevent the Microsoft revocation handler from accessing any network based resources for revocation checking. In other words, just check the cached revocation information on the local computer.

`CertVerifyRevocation` can use the certificate's CRL distribution points as well as OCSP. If it returns -1, see the `LastErrorText`. One cause is that the issuing intermediate CA certificate is not present in the Windows certificate store.

Non-Windows (and Windows) applications can send an OCSP request as shown in the example below. Note that some CAs publish revocation status only through CRLs, not OCSP. For example, Let's Encrypt removed the OCSP URL from its certificates in May 2025 and shut down its OCSP responders in August 2025, so an OCSP request is not possible for current Let's Encrypt certificates.

### Cert.CheckSmartCardPin

`Chilkat 11.7.0 · delphidll · Cert · CheckSmartCardPin · method · since 9.5.0.77`

```pascal
function CkCert_CheckSmartCardPin(objHandle: HCkCert): Integer; stdcall;
```

Verifies that the SmartCardPin property setting is correct. Returns 1 if correct, 0 if incorrect, and -1 if unable to check because the underlying CSP does not support the functionality.

### Cert.ExportCertDerBd

`Chilkat 11.7.0 · delphidll · Cert · ExportCertDerBd · method · since 9.5.0.70`

```pascal
function CkCert_ExportCertDerBd(objHandle: HCkCert;
    cerData: HCkBinData): wordbool; stdcall;
```

Exports the digital certificate in ASN.1 DER format to a BinData object.

Returns True for success, False for failure.

### Cert.ExportCertDerFile

`Chilkat 11.7.0 · delphidll · Cert · ExportCertDerFile · method`

```pascal
function CkCert_ExportCertDerFile(objHandle: HCkCert;
    path: PWideChar): wordbool; stdcall;
```

Exports the digital certificate to ASN.1 DER format binary file.

Returns True for success, False for failure.

### Cert.ExportCertPem

`Chilkat 11.7.0 · delphidll · Cert · ExportCertPem · method`

```pascal
function CkCert_ExportCertPem(objHandle: HCkCert;
    outStr: HCkString): wordbool; stdcall;
function CkCert__exportCertPem(objHandle: HCkCert): PWideChar; stdcall;
```

Exports the digital certificate to an unencrypted PEM formatted string.

Returns True for success, False for failure.

See the notes about [PWideChar memory ownership and validity](https://www.chilkatsoft.com/delphi_pwidechar.asp).

### Cert.ExportCertPemFile

`Chilkat 11.7.0 · delphidll · Cert · ExportCertPemFile · method`

```pascal
function CkCert_ExportCertPemFile(objHandle: HCkCert;
    path: PWideChar): wordbool; stdcall;
```

Exports the digital certificate to an unencrypted PEM formatted file.

Returns True for success, False for failure.

### Cert.ExportCertXml

`Chilkat 11.7.0 · delphidll · Cert · ExportCertXml · method`

```pascal
function CkCert_ExportCertXml(objHandle: HCkCert;
    outStr: HCkString): wordbool; stdcall;
function CkCert__exportCertXml(objHandle: HCkCert): PWideChar; stdcall;
```

Exports a certificate to an XML format where the XML tags are the names of the ASN.1 objects that compose the X.509 certificate. Binary data is either hex or base64 encoded. (The binary data for a `bits` ASN.1 tag is hex encoded, whereas for all other ASN.1 tags, such as `octets`, it is base64.)

Returns True for success, False for failure.

See the notes about [PWideChar memory ownership and validity](https://www.chilkatsoft.com/delphi_pwidechar.asp).

### Cert.ExportToPfxBd

`Chilkat 11.7.0 · delphidll · Cert · ExportToPfxBd · method · since 9.5.0.70`

```pascal
function CkCert_ExportToPfxBd(objHandle: HCkCert;
    password: PWideChar;
    includeCertChain: wordbool;
    pfxData: HCkBinData): wordbool; stdcall;
```

Exports the certificate and private key (if available) to `pfxData`. The `password` is what will be required to access the PFX contents at a later time. If `includeCertChain` is `True`, then the certificates in the chain of authority are also included in the PFX.

Returns True for success, False for failure.

### Cert.ExportToPfxFile

`Chilkat 11.7.0 · delphidll · Cert · ExportToPfxFile · method`

```pascal
function CkCert_ExportToPfxFile(objHandle: HCkCert;
    pfxFilename: PWideChar;
    pfxPassword: PWideChar;
    bIncludeCertChain: wordbool): wordbool; stdcall;
```

Exports the certificate and private key (if available) to a PFX (.pfx or .p12) file. The output PFX is secured using the `pfxPassword`. If `bIncludeCertChain` is `True`, then the certificates in the chain of authority are also included in the PFX output file.

Returns True for success, False for failure.

### Cert.FindIssuer

`Chilkat 11.7.0 · delphidll · Cert · FindIssuer · method`

```pascal
function CkCert_FindIssuer(objHandle: HCkCert): HCkCert; stdcall;
```

Finds and returns the issuer certificate. If the certificate is a root or self-issued, then the certificate returned is a copy of the caller certificate. (The IsRoot property can be check to see if the certificate is a root (or self-issued) certificate.)

Returns `nil` on failure

### Cert.GetEncoded

`Chilkat 11.7.0 · delphidll · Cert · GetEncoded · method`

```pascal
function CkCert_GetEncoded(objHandle: HCkCert;
    outStr: HCkString): wordbool; stdcall;
function CkCert__getEncoded(objHandle: HCkCert): PWideChar; stdcall;
```

Returns a base64 encoded string representation of the certificate's binary DER format, which can be passed to SetFromEncoded to recreate the certificate object.

Returns True for success, False for failure.

See the notes about [PWideChar memory ownership and validity](https://www.chilkatsoft.com/delphi_pwidechar.asp).

### Cert.GetExtensionAsText

`Chilkat 11.7.0 · delphidll · Cert · GetExtensionAsText · method · since 9.5.0.89`

```pascal
function CkCert_GetExtensionAsText(objHandle: HCkCert;
    oid: PWideChar;
    outStr: HCkString): wordbool; stdcall;
function CkCert__getExtensionAsText(objHandle: HCkCert;
    oid: PWideChar): PWideChar; stdcall;
```

Returns the certificate extension data as a string. This method should only be called for those extensions with text values NOT stored as binary ASN.1. In most cases, applications should call GetExtensionAsXml because most extensions contain ASN.1 values that need to be decoded..

Returns True for success, False for failure.

See the notes about [PWideChar memory ownership and validity](https://www.chilkatsoft.com/delphi_pwidechar.asp).

### Cert.GetExtensionAsXml

`Chilkat 11.7.0 · delphidll · Cert · GetExtensionAsXml · method · since 9.5.0.49`

```pascal
function CkCert_GetExtensionAsXml(objHandle: HCkCert;
    oid: PWideChar;
    outStr: HCkString): wordbool; stdcall;
function CkCert__getExtensionAsXml(objHandle: HCkCert;
    oid: PWideChar): PWideChar; stdcall;
```

Returns the certificate extension data in XML format (converted from ASN.1). The `oid` is an OID, such as the ones listed here: http://www.alvestrand.no/objectid/2.5.29.html

Note: In many cases, the data within the XML is returned base64 encoded. An application may need to take one further step to base64 decode the information contained within the XML.

Returns True for success, False for failure.

See the notes about [PWideChar memory ownership and validity](https://www.chilkatsoft.com/delphi_pwidechar.asp).

### Cert.GetExtensionBd

`Chilkat 11.7.0 · delphidll · Cert · GetExtensionBd · method · since 9.5.0.96`

```pascal
function CkCert_GetExtensionBd(objHandle: HCkCert;
    oid: PWideChar;
    bd: HCkBinData): wordbool; stdcall;
```

Returns the certificate extension data specified by `oid` in `bd`.

Returns True for success, False for failure.

### Cert.GetIssuer

`Chilkat 11.7.0 · delphidll · Cert · GetIssuer · method · since 11.0.0`

```pascal
function CkCert_GetIssuer(objHandle: HCkCert;
    issuer: HCkCert): wordbool; stdcall;
```

Finds and returns the issuer certificate in `issuer`. If the certificate is a root or self-issued, then the certificate returned is a copy of the caller certificate. (The IsRoot property can be check to see if the certificate is a root (or self-issued) certificate.)

Returns True for success, False for failure.

### Cert.GetPrivateKey

`Chilkat 11.7.0 · delphidll · Cert · GetPrivateKey · method · since 11.0.0`

```pascal
function CkCert_GetPrivateKey(objHandle: HCkCert;
    privKey: HCkPrivateKey): wordbool; stdcall;
```

Loads the `privKey` with the certificate's private key, if it exists. Returns `False` if the certificate has no associated private key.

Returns True for success, False for failure.

### Cert.GetPrivateKeyPem

`Chilkat 11.7.0 · delphidll · Cert · GetPrivateKeyPem · method`

```pascal
function CkCert_GetPrivateKeyPem(objHandle: HCkCert;
    outStr: HCkString): wordbool; stdcall;
function CkCert__getPrivateKeyPem(objHandle: HCkCert): PWideChar; stdcall;
```

Exports the certificate's private key to a PEM string (if the private key is available).

Returns True for success, False for failure.

See the notes about [PWideChar memory ownership and validity](https://www.chilkatsoft.com/delphi_pwidechar.asp).

### Cert.GetPubKeyDer

`Chilkat 11.7.0 · delphidll · Cert · GetPubKeyDer · method · since 9.5.0.92`

```pascal
function CkCert_GetPubKeyDer(objHandle: HCkCert;
    preferPkcs1: wordbool;
    bd: HCkBinData): wordbool; stdcall;
```

Loads the `bd` with the certificate's public key in ASN.1 DER format. If the key type (such as RSA) supports both PKCS1 and PKCS8 formats, then `preferPkcs1` selects which format to return.

Returns True for success, False for failure.

### Cert.GetPublicKey

`Chilkat 11.7.0 · delphidll · Cert · GetPublicKey · method · since 11.0.0`

```pascal
function CkCert_GetPublicKey(objHandle: HCkCert;
    pubKey: HCkPublicKey): wordbool; stdcall;
```

Loads the `pubKey` with the certificate's public key.

Returns True for success, False for failure.

### Cert.GetSignature

`Chilkat 11.7.0 · delphidll · Cert · GetSignature · method · since 9.5.0.92`

```pascal
function CkCert_GetSignature(objHandle: HCkCert;
    bd: HCkBinData): wordbool; stdcall;
```

Loads the `bd` with the certificate's signature.

Returns True for success, False for failure.

### Cert.GetSpkiFingerprint

`Chilkat 11.7.0 · delphidll · Cert · GetSpkiFingerprint · method · since 9.5.0.55`

```pascal
function CkCert_GetSpkiFingerprint(objHandle: HCkCert;
    hashAlg: PWideChar;
    encoding: PWideChar;
    outStr: HCkString): wordbool; stdcall;
function CkCert__getSpkiFingerprint(objHandle: HCkCert;
    hashAlg: PWideChar;
    encoding: PWideChar): PWideChar; stdcall;
```

**Full documentation for this method (same in every language):** [List of Chilkat Encoding Modes](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md)

Returns the SPKI Fingerprint suitable for use in pinning. (See RFC 7469.) An SPKI Fingerprint is defined as the output of a known cryptographic hash algorithm whose input is the DER-encoded ASN.1 representation of the Subject Public Key Info (SPKI) of an X.509 certificate. The `hashAlg` specifies the hash algorithm and may be `sha256`, `sha384`, `sha512`, `sha1`, `md2`, `md5`, `haval`, `ripemd128`, `ripemd160`,`ripemd256`, or `ripemd320`. The `encoding` specifies the encoding, and may be `base64`, `hex`, or any of the encoding modes specified in the article at the link below.

Returns True for success, False for failure.

See the notes about [PWideChar memory ownership and validity](https://www.chilkatsoft.com/delphi_pwidechar.asp).

### Cert.GetSubjectPart

`Chilkat 11.7.0 · delphidll · Cert · GetSubjectPart · method · since 9.5.0.85`

```pascal
function CkCert_GetSubjectPart(objHandle: HCkCert;
    partNameOrOid: PWideChar;
    outStr: HCkString): wordbool; stdcall;
function CkCert__getSubjectPart(objHandle: HCkCert;
    partNameOrOid: PWideChar): PWideChar; stdcall;
```

Returns a part of the certificate's subject by name or OID. The `partNameOrOid` can be a part name, such as `CN`, `O`, `OU`, `E`, `S`, `L`, `C`, or `SERIALNUMBER`, or it can be an OID such as `2.5.4.3`.

Returns True for success, False for failure.

See the notes about [PWideChar memory ownership and validity](https://www.chilkatsoft.com/delphi_pwidechar.asp).

### Cert.HashOf

`Chilkat 11.7.0 · delphidll · Cert · HashOf · method · since 9.5.0.75`

```pascal
function CkCert_HashOf(objHandle: HCkCert;
    part: PWideChar;
    hashAlg: PWideChar;
    encoding: PWideChar;
    outStr: HCkString): wordbool; stdcall;
function CkCert__hashOf(objHandle: HCkCert;
    part: PWideChar;
    hashAlg: PWideChar;
    encoding: PWideChar): PWideChar; stdcall;
```

Returns an encoded hash of a particular part of the certificate. The `part` may be one of the following:

- IssuerDN
- IssuerPublicKey
- SubjectDN
- SubjectPublicKey

The `hashAlg` is the name of the hash algorithm, such as `sha1`, `sha256`, `sha384`, `sha512`, `md5`, etc. The `encoding` is the format to return, such as `hex`, `base64`, etc.

Returns True for success, False for failure.

See the notes about [PWideChar memory ownership and validity](https://www.chilkatsoft.com/delphi_pwidechar.asp).

### Cert.HasPrivateKey

`Chilkat 11.7.0 · delphidll · Cert · HasPrivateKey · method`

```pascal
function CkCert_HasPrivateKey(objHandle: HCkCert): wordbool; stdcall;
```

Returns `True` if a private key associated with the certificate is available.

### Cert.IsEcdsa

`Chilkat 11.7.0 · delphidll · Cert · IsEcdsa · method · since 10.1.0`

```pascal
function CkCert_IsEcdsa(objHandle: HCkCert): wordbool; stdcall;
```

Returns `True` if certificate is ECDSA-based (i.e. has an ECDSA key).

### Cert.IsRsa

`Chilkat 11.7.0 · delphidll · Cert · IsRsa · method · since 10.1.0`

```pascal
function CkCert_IsRsa(objHandle: HCkCert): wordbool; stdcall;
```

Returns `True` if certificate is RSA-based (i.e. has an RSA key).

### Cert.LinkPkcs11

`Chilkat 11.7.0 · delphidll · Cert · LinkPkcs11 · method · since 9.5.0.96`

```pascal
function CkCert_LinkPkcs11(objHandle: HCkCert;
    session: HCkPkcs11): wordbool; stdcall;
```

Links to the certificate's private key located on an HSM (smart card, token, or cloud HSM). Once linked, the certificate can be used for signing where the signing occurs on the HSM. See the example below for more detailed information.

Returns True for success, False for failure.

### Cert.LoadByCommonName

`Chilkat 11.7.0 · delphidll · Cert · LoadByCommonName · method`

```pascal
function CkCert_LoadByCommonName(objHandle: HCkCert;
    cn: PWideChar): wordbool; stdcall;
```

This method searches for a certificate with the specified common name (CN) on different operating systems. - On `Windows`, it searches the `Local Machine` and `Current User` certificate stores. - On `macOS` and `iOS`, it searches the Default and System `Keychains`. If the certificate is found, it is loaded and ready for use.

Note: Chilkat v10.0.0 or later is needed for Apple Keychain.

Returns True for success, False for failure.

### Cert.LoadByEmailAddress

`Chilkat 11.7.0 · delphidll · Cert · LoadByEmailAddress · method`

```pascal
function CkCert_LoadByEmailAddress(objHandle: HCkCert;
    emailAddress: PWideChar): wordbool; stdcall;
```

This method searches for a certificate with the specified email address on different operating systems. - On `Windows`, it searches the `Local Machine` and `Current User` certificate stores. - On `macOS` and `iOS`, it searches the Default and System `Keychains`. If the certificate is found, it is loaded and ready for use.

Note: Chilkat v10.0.0 or later is needed for Apple Keychain.

Returns True for success, False for failure.

### Cert.LoadByIssuerAndSerialNumber

`Chilkat 11.7.0 · delphidll · Cert · LoadByIssuerAndSerialNumber · method`

```pascal
function CkCert_LoadByIssuerAndSerialNumber(objHandle: HCkCert;
    issuerCN: PWideChar;
    serialNumber: PWideChar): wordbool; stdcall;
```

This method searches for a certificate with the specified issuer common name (`issuerCN`) and serial number (`serialNumber`) on different operating systems. - On `Windows`, it searches the `Local Machine` and `Current User` certificate stores. - On `macOS` and `iOS`, it searches the Default and System `Keychains`. If the certificate is found, it is loaded and ready for use.

Note: Chilkat v10.0.0 or later is needed for Apple Keychain.

Returns True for success, False for failure.

### Cert.LoadBySubjectOid

`Chilkat 11.7.0 · delphidll · Cert · LoadBySubjectOid · method · since 9.5.0.85`

```pascal
function CkCert_LoadBySubjectOid(objHandle: HCkCert;
    oid: PWideChar;
    value: PWideChar): wordbool; stdcall;
```

**Full documentation for this method (same in every language):** [Common Certificate Subject OIDs](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/cert_subject_oids.md)

This method searches for a certificate containing a subject part matching the `oid` and `value`. On `Windows`, it searches the `Local Machine` and `Current User` certificate stores. - On `macOS` and `iOS`, it searches the Default and System `Keychains`. If the certificate is found, it is loaded and ready for use.

Note: Chilkat v10.0.0 or later is needed for Apple Keychain.

Returns True for success, False for failure.

### Cert.LoadByThumbprint

`Chilkat 11.7.0 · delphidll · Cert · LoadByThumbprint · method · since 9.5.0.83`

```pascal
function CkCert_LoadByThumbprint(objHandle: HCkCert;
    thumbprint: PWideChar;
    encoding: PWideChar): wordbool; stdcall;
```

This method searches for a certificate with the specified `thumbprint`. The `thumbprint` is passed as a string using the encoding specified by `encoding` (such as `base64`, `hex`, etc.).

On `Windows`, it searches the `Local Machine` and `Current User` certificate stores. - On `macOS` and `iOS`, it searches the Default and System `Keychains`. If the certificate is found, it is loaded and ready for use.

Note: Chilkat v10.0.0 or later is needed for Apple Keychain.

Returns True for success, False for failure.

### Cert.LoadFromBase64

`Chilkat 11.7.0 · delphidll · Cert · LoadFromBase64 · method`

```pascal
function CkCert_LoadFromBase64(objHandle: HCkCert;
    encodedCert: PWideChar): wordbool; stdcall;
```

Loads an ASN.1 or DER encoded certificate represented in a Base64 string.

Returns True for success, False for failure.

### Cert.LoadFromBd

`Chilkat 11.7.0 · delphidll · Cert · LoadFromBd · method · since 9.5.0.70`

```pascal
function CkCert_LoadFromBd(objHandle: HCkCert;
    certBytes: HCkBinData): wordbool; stdcall;
```

Loads an X.509 certificate from data contained in `certBytes`.

**Note:** The `certBytes` may contain the certificate in any format. It can be binary DER (ASN.1), PEM, Base64, etc. Chilkat will automatically detect the format.

Returns True for success, False for failure.

### Cert.LoadFromFile

`Chilkat 11.7.0 · delphidll · Cert · LoadFromFile · method`

```pascal
function CkCert_LoadFromFile(objHandle: HCkCert;
    path: PWideChar): wordbool; stdcall;
```

Loads a certificate from a .cer, .crt, .p7b, or .pem file. This method accepts certificates from files in any of the following formats:  
1\. DER encoded binary X.509 (.CER)  
2\. Base-64 encoded X.509 (.CER)  
3\. Cryptographic Message Syntax Standard - PKCS #7 Certificates (.P7B)  
4\. PEM format  
This method decodes the certificate based on the contents if finds within the file, and not based on the file extension. If your certificate is in a file having a different extension, try loading it using this method before assuming it won't work. This method does not load .p12 or .pfx (PKCS #12) files.

Returns True for success, False for failure.

### Cert.LoadFromSmartcard

`Chilkat 11.7.0 · delphidll · Cert · LoadFromSmartcard · method · since 9.5.0.77`

```pascal
function CkCert_LoadFromSmartcard(objHandle: HCkCert;
    certSpec: PWideChar): wordbool; stdcall;
```

**Important:** It's important to set the SmartCardPin property **before** calling this method.

Loads a certificate and its associated private key (if available) from a connected USB token or smart card. This function works on Windows, Linux, MacOS, iOS, and Alpine Linux. If multiple USB tokens and/or smartcards are connected to the system, then each will be searched and the first matching certificate will be loaded.

The `certSpec` can have the following formats and values:

- **Empty String**: Passing the empty string is the most common way to call this function. Pass the empty string when only one HSM (USB token or smart card) is connected to the system, and it contains only one certificate with a private key. The HSM can contain other certificates, but Chilkat will automatically choose and load the certificate that has the associated private key also located on the HSM.
- **cn=\<cert subject common name>**: Finds and loads the certificate having the specified subject common name (CN).
- **subjectdn_withtags=\<distinguished name with tags>**: Finds and loads the certificate having the specified DN with tags. For example, subjectdn_withtags=C=US, O=Example Corporation, OU=IT Department, CN=www.example.com
- **subjectdn=\<distinguished name without tags>**: Finds and loads the certificate having the specified DN without tags. For example, subjectdn=US, California, San Francisco, Example Corp, Engineering, www.example.com, support@example.com
- **issuercn=\<subject hex serial:issuer common name>**: Finds and loads the certificate having the specified hex serial number and an issuer with the specified common name. For example, `01020304: Let's Encrypt Authority X1`
- **serial=\<hex serial number>**: Finds and loads the certificate having the specified hexidecimal serial number.
- **thumbprint=\<hex SHA1 thumbprint>**: Finds and loads the certificate having the specified hexidecimal SHA1 thumbprint.
- **policyoid=\<certificate policy OID>**: Finds and loads the certificate having a policy OID equal to the specified value, such as 2.16.840.1.101.2.1.11.39.
- **o=\<subject organization>**: Finds and loads the certificate having the `O` subject part equal to the specified value.
- **c=\<subject country>**: Finds and loads the certificate having the `C` subject part equal to the specified value.
- **l=\<subject locality>**: Finds and loads the certificate having the `L` subject part equal to the specified value.
- **ou=\<subject organizational unit>**: Finds and loads the certificate having the `OU` subject part equal to the specified value.
- **st=\<subject state>**: Finds and loads the certificate having the `ST` subject part equal to the specified value.
- **e=\<subject email>**: Finds and loads the certificate having the `E` subject part equal to the specified value.

On Windows systems, `certSpec` can specify a CSP (Cryptographic Service Provider) name, such as `YubiHSM Key Storage Provider.` This option is retained for legacy support, as Chilkat initially handled USB tokens and smartcards only on Windows via CSPs. Chilkat now supports HSMs across multiple platforms (Windows, Linux, macOS, iOS, Alpine Linux) and uses various methods to communicate with HSMs, including PKCS11, macOS Keychain services, Windows ScMinidriver, MsCNG, and legacy Windows CryptoAPI. Chilkat automatically detects the HSM make/model and selects the optimal communication method.

Some possible CSP values are:

- Microsoft Smart Card Key Storage Provider
- Microsoft Base Smart Card Crypto Provider
- Bit4id Universal Middleware Provider
- YubiHSM Key Storage Provider (starting in v9.5.0.83)
- SafeSign Standard Cryptographic Service Provider
- SafeSign Standard RSA and AES Cryptographic Service Provider
- eToken Base Cryptographic Provider
- cryptoCertum3 CSP
- FTSafe ePass1000 RSA Cryptographic Service Provider
- SecureStoreCSP
- EnterSafe ePass2003 CSP v2.0
- Gemalto Classic Card CSP
- PROXKey CSP India V1.0
- PROXKey CSP India V2.0
- TRUST KEY CSP V1.0
- Watchdata Brazil CSP V1.0
- Luna Cryptographic Services for Microsoft Windows
- Luna SChannel Cryptographic Services for Microsoft Windows
- Safenet RSA Full Cryptographic Provider
- nCipher Enhanced Cryptographic Provider
- MySmartLogon NFC CSP
- NFC Connector Enterprise
- ActivClient Cryptographic Service Provider
- EnterSafe ePass2003 CSP v1.0
- Oberthur Card Systems Cryptographic Provider
- Athena ASECard Crypto CSP
- many others...

Returns True for success, False for failure.

### Cert.LoadPem

`Chilkat 11.7.0 · delphidll · Cert · LoadPem · method · since 9.5.0.49`

```pascal
function CkCert_LoadPem(objHandle: HCkCert;
    strPem: PWideChar): wordbool; stdcall;
```

Loads the certificate from a PEM string.

Returns True for success, False for failure.

### Cert.LoadPfxBd

`Chilkat 11.7.0 · delphidll · Cert · LoadPfxBd · method · since 9.5.0.70`

```pascal
function CkCert_LoadPfxBd(objHandle: HCkCert;
    pfxData: HCkBinData;
    password: PWideChar): wordbool; stdcall;
```

Loads the certificate from the PFX contained in `pfxData`. Note: If the PFX contains multiple certificates, the 1st certificate in the PFX is loaded.

Returns True for success, False for failure.

### Cert.LoadPfxFile

`Chilkat 11.7.0 · delphidll · Cert · LoadPfxFile · method`

```pascal
function CkCert_LoadPfxFile(objHandle: HCkCert;
    pfxPath: PWideChar;
    password: PWideChar): wordbool; stdcall;
```

Loads a PFX file. Note: If the PFX contains multiple certificates, the 1st certificate in the PFX is loaded.

Returns True for success, False for failure.

### Cert.LoadTaskResult

`Chilkat 11.7.0 · delphidll · Cert · LoadTaskResult · method · since 9.5.0.52`

```pascal
function CkCert_LoadTaskResult(objHandle: HCkCert;
    task: HCkTask): wordbool; stdcall;
```

Loads the certificate from a completed asynchronous task.

Returns True for success, False for failure.

### Cert.PemFileToDerFile

`Chilkat 11.7.0 · delphidll · Cert · PemFileToDerFile · method`

```pascal
function CkCert_PemFileToDerFile(objHandle: HCkCert;
    fromPath: PWideChar;
    toPath: PWideChar): wordbool; stdcall;
```

Converts a PEM file to a DER file.

Returns True for success, False for failure.

### Cert.SaveToFile

`Chilkat 11.7.0 · delphidll · Cert · SaveToFile · method`

```pascal
function CkCert_SaveToFile(objHandle: HCkCert;
    path: PWideChar): wordbool; stdcall;
```

Saves a certificate object to a .cer file.

Returns True for success, False for failure.

### Cert.SetCloudSigner

`Chilkat 11.7.0 · delphidll · Cert · SetCloudSigner · method · since 9.5.0.96`

```pascal
function CkCert_SetCloudSigner(objHandle: HCkCert;
    json: HCkJsonObject): wordbool; stdcall;
```

Provides information for a cloud signing service to do the signing via a remote signing server. Current supported services are AWS KMS, Azure Key Vault, and ARSS (Aruba Remote Signing Service). See the examples below.

Returns True for success, False for failure.

Async variant: `SetCloudSignerAsync` — same arguments, returns a `Task` (see Async variants below).

### Cert.SetFromEncoded

`Chilkat 11.7.0 · delphidll · Cert · SetFromEncoded · method`

```pascal
function CkCert_SetFromEncoded(objHandle: HCkCert;
    encodedCert: PWideChar): wordbool; stdcall;
```

Initializes the certificate object from a base64 encoded string representation of the certificate's binary DER format.

Returns True for success, False for failure.

### Cert.SetPrivateKey

`Chilkat 11.7.0 · delphidll · Cert · SetPrivateKey · method`

```pascal
function CkCert_SetPrivateKey(objHandle: HCkCert;
    privKey: HCkPrivateKey): wordbool; stdcall;
```

Used to associate a private key with the certificate for subsequent (PKCS7) signature creation or decryption.

Returns True for success, False for failure.

### Cert.SetPrivateKeyPem

`Chilkat 11.7.0 · delphidll · Cert · SetPrivateKeyPem · method`

```pascal
function CkCert_SetPrivateKeyPem(objHandle: HCkCert;
    privKeyPem: PWideChar): wordbool; stdcall;
```

Same as SetPrivateKey, but the key is provided in unencrypted PEM format. (Note: The `privKeyPem` is not a file path, it is the actual PEM text.)

Returns True for success, False for failure.

### Cert.Unload

`Chilkat 11.7.0 · delphidll · Cert · Unload · method · since 11.0.0`

```pascal
function CkCert_Unload(objHandle: HCkCert): wordbool; stdcall;
```

Unload the certificate, which could mean closing a PKCS11 session if the certificate was loaded from a smart card.

Returns True for success, False for failure.

### Cert.UploadToCloud

`Chilkat 11.7.0 · delphidll · Cert · UploadToCloud · method · since 9.5.0.96`

```pascal
function CkCert_UploadToCloud(objHandle: HCkCert;
    jsonIn: HCkJsonObject;
    jsonOut: HCkJsonObject): wordbool; stdcall;
```

This is an open-ended method to accomodate uploading the private key to a cloud service, such as AWS KMS, or Azure Key Vault. For details, see the examples below.

Returns True for success, False for failure.

Async variant: `UploadToCloudAsync` — same arguments, returns a `Task` (see Async variants below).

### Cert.UseCertVault

`Chilkat 11.7.0 · delphidll · Cert · UseCertVault · method · since 9.5.0.40`

```pascal
function CkCert_UseCertVault(objHandle: HCkCert;
    vault: HCkXmlCertVault): wordbool; stdcall;
```

Adds an XML certificate vault to the object's internal list of sources to be searched for certificates for help in building certificate chains and verifying the certificate signature to the trusted root.

Returns True for success, False for failure.

### Cert.VerifySignature

`Chilkat 11.7.0 · delphidll · Cert · VerifySignature · method · since 9.5.0.40`

```pascal
function CkCert_VerifySignature(objHandle: HCkCert): wordbool; stdcall;
```

Verifies the certificate signature, as well as the signatures of all certificates in the chain of authentication to the trusted root. Returns `True` if all signatures are verified to the trusted root. Otherwise returns `False`.

### Cert.X509PKIPathv1

`Chilkat 11.7.0 · delphidll · Cert · X509PKIPathv1 · method · since 9.5.0.77`

```pascal
function CkCert_X509PKIPathv1(objHandle: HCkCert;
    outStr: HCkString): wordbool; stdcall;
function CkCert__x509PKIPathv1(objHandle: HCkCert): PWideChar; stdcall;
```

Returns the base64 representation of an X509PKIPathv1 containing just the calling certificate. This is typically used in an X.509 Binary Security Token. It is a PKIPath that contains an ordered list of X.509 public certificates packaged in a PKIPath. The X509PKIPathv1 token type may be used to represent a certificate path. (This is sometimes used in XAdES signatures.)

Returns True for success, False for failure.

See the notes about [PWideChar memory ownership and validity](https://www.chilkatsoft.com/delphi_pwidechar.asp).

## Events and callbacks

### Cert.AbortCheck (event)

`Chilkat 11.7.0 · delphidll · Cert · AbortCheck · event`

```pascal
function MyAbortCheck(): Integer; cdecl;
```

Enables a method call to be aborted by triggering the AbortCheck event at intervals defined by the `HeartbeatMs` property. If HeartbeatMs is set to its default value of 0, no events will occur. For instance, set HeartbeatMs to 200 to trigger 5 AbortCheck events per second. Return `True` to abort; return `False` to continue (not abort)

### Cert.PercentDone (event)

`Chilkat 11.7.0 · delphidll · Cert · PercentDone · event`

```pascal
function MyPercentDone(pctDone: Integer): Integer; cdecl;
```

This provides the percentage completion for any method involving network communications or time-consuming processing, assuming the progress can be measured as a percentage. This event is triggered only when it's possible and logical to express the operation's progress as a percentage. The `pctDone` argument will range from 1 to 100. For methods that finish quickly, the number of PercentDone callbacks may vary, but the final callback will have `pctDone` equal to 100. For longer operations, callbacks will not exceed one per percentage point (e.g., 1, 2, 3, ..., 98, 99, 100).

The PercentDone callback also acts as an `AbortCheck` event. For fast methods where PercentDone fires, an AbortCheck event may not trigger since the PercentDone callback already provides an opportunity to abort. For longer operations, where time between PercentDone callbacks is extended, AbortCheck callbacks enable more responsive operation termination.

Return `True` to abort; return `False` to continue (not abort)

### Cert.ProgressInfo (event)

`Chilkat 11.7.0 · delphidll · Cert · ProgressInfo · event`

```pascal
procedure MyProgressInfo(name: PWideChar; value: PWideChar) cdecl;
```

This event callback provides `tag name`/value pairs that detail what occurs during a method call. To discover existing tag names, create code to handle the event, emit the pairs, and review them. Most tag names are self-explanatory.

Note: Some Chilkat methods don't fire any ProgressInfo events.

### Cert.TaskCompleted (event)

`Chilkat 11.7.0 · delphidll · Cert · TaskCompleted · event`

```pascal
procedure MyTaskCompleted(task: HCkTask) cdecl;
```

Called from the background thread when an asynchronous task completes.

## Async variants

Each returns a `Task` instead of the result and takes the same arguments as the synchronous method; run the task, wait for `Finished`, then read the result from the task. No new Async methods are added from 11.7.0 on.

```pascal
function CkCert_SetCloudSignerAsync(objHandle: HCkCert;
    json: HCkJsonObject): HCkTask; stdcall;
function CkCert_UploadToCloudAsync(objHandle: HCkCert;
    jsonIn: HCkJsonObject;
    jsonOut: HCkJsonObject): HCkTask; stdcall;
```

## Deprecated members — do not use in new code

| Member | Kind | Deprecated in | Use instead |
|---|---|---|---|
| `ExportCertDer` | method | before 11.6.1 | — |
| `ExportPrivateKey` | method | before 11.6.1 | — |
| `ExportPublicKey` | method | before 11.6.1 | — |
| `ExportToPfxData` | method | before 11.6.1 | — |
| `GetCertChain` | method | before 11.6.1 | `BuildCertChain` |
| `GetValidFromDt` | method | before 11.6.1 | — |
| `GetValidToDt` | method | before 11.6.1 | — |
| `LoadFromBinary` | method | before 11.6.1 | — |
| `LoadPfxData` | method | before 11.6.1 | — |

## Related classes

[`BinData`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/delphidll/classes/BinData.md), [`CertChain`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/delphidll/classes/CertChain.md), [`JsonObject`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/delphidll/classes/JsonObject.md), [`Pkcs11`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/delphidll/classes/Pkcs11.md), [`PrivateKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/delphidll/classes/PrivateKey.md), [`PublicKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/delphidll/classes/PublicKey.md), [`Task`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/delphidll/classes/Task.md), [`XmlCertVault`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/delphidll/classes/XmlCertVault.md)