---
product: Chilkat
product_version: 11.7.0
language: js
language_label: JavaScript
class: TrustedRoots
license: free
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/jsTrustedRootsRef.html
---
# Chilkat TrustedRoots — JavaScript — v11.7.0

> Chilkat 11.7.0 · language=js · class=TrustedRoots
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/TrustedRoots.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/js/guide.md`.

## Purpose

**Configure the trusted root certificates used by Chilkat certificate validation.**

`Chilkat.TrustedRoots` manages a collection of trusted CA and self-signed root certificates used Chilkat-wide for PKCS7/CMS signature validation and SSL/TLS server certificate validation. It can add individual certificates, import trusted certificates from a Java keystore, load PEM CA bundles, activate or deactivate the trusted-root set, and control whether system CA roots and self-signed server certificates are trusted.

**Custom trusted roots**

Add root or CA certificates that should be trusted by Chilkat validation operations.

**PEM CA bundles**

Load one or more trusted CA certificates from PEM bundle files used by many TLS and certificate-validation workflows.

**Java keystore import**

Import trusted certificates from a `JavaKeyStore` when trust anchors are maintained in JKS-style storage.

**System CA root control**

Choose whether Chilkat should also trust the operating system's CA root certificates.

**Self-signed certificate policy**

Control whether self-signed server certificates are rejected or accepted during certificate validation.

**Activate Chilkat-wide trust**

Activate the configured trusted-root set so it is used by Chilkat classes that perform TLS or signature certificate validation.

**Common pattern:** Create a `TrustedRoots` object, add trusted certificates or load a PEM CA bundle, configure whether system roots and self-signed certificates should be trusted, then call `Activate`. Treat trusted roots as Chilkat-wide validation configuration, not as private state for a single object.

For an extended overview, see [TrustedRoots Class Overview](https://www.chilkatsoft.com/trustedroots_class_overview.asp).

## Object creation, unlocking and error handling

**Object Creation**

Note: This is intended for running within a [Chilkat.Js embedded JavaScript engine](https://www.chilkatsoft.com/chilkat_javascript_engine.asp).

```
var obj = new CkTrustedRoots();
```

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in JavaScript.

How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `DebugLogFilePath` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `LastErrorHtml` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `LastErrorText` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `LastErrorXml` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `LastMethodSuccess` | read/write | Indicates the success or failure of the most recent method call: `true` means success, `false` means failure. |
| `VerboseLogging` | `VerboseLogging` | read/write | If set to `true`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `Version` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `NumCerts` | property, read-only | `NumCerts` |
| `RejectSelfSignedCerts` | property, read/write | `RejectSelfSignedCerts` |
| `TrustSystemCaRoots` | property, read/write | `TrustSystemCaRoots` |
| `Activate` | method | `var success = Activate();` |
| `AddCert` | method | `var success = AddCert(cert);` |
| `AddJavaKeyStore` | method | `var success = AddJavaKeyStore(keystore);` |
| `CertAt` | method | `var success = CertAt(index, cert);` |
| `Deactivate` | method | `var success = Deactivate();` |
| `LoadCaCertsPem` | method | `var success = LoadCaCertsPem(path);` |

## Properties

### TrustedRoots.NumCerts

`Chilkat 11.7.0 · js · TrustedRoots · NumCerts · property · read-only · since 9.5.0.38`

```javascript
NumCerts
```

· `int`, `read-only`

The number of certificates explicitly contained in this object. The count includes certificates added by `AddCert`, `AddJavaKeyStore`, and `LoadCaCertsPem`.

Use indexes from `0` through `NumCerts - 1` with `CertAt`.

**Scope of the count:** This property does not include operating-system CA roots made available by `TrustSystemCaRoots`. It reports only the certificates stored in this object.

### TrustedRoots.RejectSelfSignedCerts

`Chilkat 11.7.0 · js · TrustedRoots · RejectSelfSignedCerts · property · read/write · since 9.5.0.80`

```javascript
RejectSelfSignedCerts
```

· `boolean`

Controls the special case in which an SSL/TLS server presents a certificate chain containing exactly one certificate and that certificate is self-signed. The default value is `false`.

| Value | Behavior |
| :--- | :--- |
| `false` | Do not reject a one-certificate TLS chain solely because the certificate is self-signed. |
| `true` | Reject TLS server chains consisting of one self-signed certificate. |

This property applies to the TLS server-certificate case described above. It does not reject a self-signed CA certificate merely because that certificate appears as the trust anchor above a longer chain.

**Security guidance:** A self-signed certificate has no external issuer establishing trust. Accept it only when the certificate or its public-key fingerprint has been authenticated through a separate trusted channel.

### TrustedRoots.TrustSystemCaRoots

`Chilkat 11.7.0 · js · TrustedRoots · TrustSystemCaRoots · property · read/write · since 9.5.0.41`

```javascript
TrustSystemCaRoots
```

· `boolean`

Controls whether operating-system CA roots are included when this object's trust configuration is activated. The default value is `true`.

| Value | Behavior |
| :--- | :--- |
| `true` | Trust explicitly added certificates and the system-provided CA roots available to Chilkat. |
| `false` | Do not automatically trust system-provided CA roots; use the explicitly configured collection and the selected self-signed-certificate policy. |

On Windows, system roots come from registry-based certificate stores. On Linux, Chilkat may use a system CA bundle such as `/etc/ssl/certs/ca-certificates.crt` when available.

System roots are not added to this object's explicit collection and therefore are not included in `NumCerts` or returned by `CertAt`.

## Methods

### TrustedRoots.Activate

`Chilkat 11.7.0 · js · TrustedRoots · Activate · method · since 9.5.0.38`

```javascript
var success = Activate();
```

· return: `boolean`; `true` for success, `false` for failure

Activates this object's trust configuration for Chilkat-wide certificate validation. The active configuration includes:

- Certificates explicitly added to this object by `AddCert`, `AddJavaKeyStore`, or `LoadCaCertsPem`.
- Operating-system CA roots when `TrustSystemCaRoots` is `true`.
- The self-signed TLS certificate policy selected by `RejectSelfSignedCerts`.

After activation, Chilkat classes that validate PKCS7/CMS signatures or SSL/TLS server certificate chains use this trust configuration. Returns `true` if the configuration was activated successfully; otherwise returns `false`.

**Trust-anchor note:** Activating a certificate as trusted supplies a starting point for certificate-path validation. It does not, by itself, prove that every certificate issued beneath that anchor is valid for every purpose; the applicable validation operation may also evaluate signatures, validity periods, identity, key usage, constraints, and other policy requirements.

Returns true for success, false for failure.

### TrustedRoots.AddCert

`Chilkat 11.7.0 · js · TrustedRoots · AddCert · method · since 9.5.0.41`

```javascript
var success = AddCert(cert);
```

· return: `boolean`; `true` for success, `false` for failure  
· cert: `CkCert`

Adds the certificate in `cert` to this object's explicit trusted-certificate collection. The certificate is subsequently treated as a trust anchor when this configuration is activated.

Returns `true` if the certificate was added successfully; otherwise returns `false`.

**Security-sensitive operation:** Calling this method is an explicit trust decision. It does not first determine whether the certificate is self-signed, belongs to a public CA, is currently valid, or is appropriate for the intended application. Add only certificates obtained and verified through a trustworthy process.

Returns true for success, false for failure.

### TrustedRoots.AddJavaKeyStore

`Chilkat 11.7.0 · js · TrustedRoots · AddJavaKeyStore · method · since 9.5.0.44`

```javascript
var success = AddJavaKeyStore(keystore);
```

· return: `boolean`; `true` for success, `false` for failure  
· keystore: `CkJavaKeyStore`

Adds the certificates designated as trusted entries in the `keystore` `JavaKeyStore` to this object's explicit trusted-certificate collection.

Private keys and secret keys are not imported. Returns `true` if the trusted certificates were added successfully; otherwise returns `false`.

**Java keystore terminology:** A trusted-certificate entry represents a certificate that the keystore owner has chosen to trust. Importing it preserves that trust decision; it does not independently validate the certificate or build a certification path for it.

Returns true for success, false for failure.

### TrustedRoots.CertAt

`Chilkat 11.7.0 · js · TrustedRoots · CertAt · method · since 11.0.0`

```javascript
var success = CertAt(index, cert);
```

· return: `boolean`; `true` for success, `false` for failure  
· index: `int`  
· cert: `CkCert`

Copies the certificate at zero-based `index` into the caller-supplied `Cert` object in `cert`.

Valid indexes are from `0` through `NumCerts - 1`. Returns `true` if the certificate was retrieved successfully; otherwise returns `false`, such as when the index is outside the valid range.

This method enumerates only certificates explicitly contained in this `TrustedRoots` object. Operating-system roots enabled through `TrustSystemCaRoots` are not included.

Returns true for success, false for failure.

### TrustedRoots.Deactivate

`Chilkat 11.7.0 · js · TrustedRoots · Deactivate · method · since 9.5.0.40`

```javascript
var success = Deactivate();
```

· return: `boolean`; `true` for success, `false` for failure

Deactivates the previously activated Chilkat-wide trusted-root configuration. After deactivation, roots and single-certificate self-signed certificates are implicitly trusted.

Returns `true` if the active configuration was deactivated successfully; otherwise returns `false`.

**Security warning:** This is a permissive mode. It does not merely restore a conventional “trust the operating-system CA store” policy. Use `Deactivate` only when implicitly trusting arbitrary roots and self-signed certificates is intentional and acceptable for the application.

Returns true for success, false for failure.

### TrustedRoots.LoadCaCertsPem

`Chilkat 11.7.0 · js · TrustedRoots · LoadCaCertsPem · method · since 9.5.0.38`

```javascript
var success = LoadCaCertsPem(path);
```

· return: `boolean`; `true` for success, `false` for failure  
· path: `string`

Loads one or more PEM-encoded certificates from the file at `path` and adds them to this object's explicit trusted-certificate collection. A CA bundle normally contains consecutive `-----BEGIN CERTIFICATE-----` / `-----END CERTIFICATE-----` blocks.

This method can load a curated application bundle, a Mozilla-derived CA bundle, or a platform bundle such as `/etc/ssl/certs/ca-certificates.crt` when that file exists. Returns `true` if the bundle was loaded successfully; otherwise returns `false`.

**Trust implication:** Certificates loaded by this method are treated as trusted anchors after activation. The file is not merely a source of intermediate certificates. Review and protect the bundle as security-sensitive configuration.

Returns true for success, false for failure.

## Events and callbacks

This binding has no event callbacks.

## Related classes

[`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/js/classes/Cert.md), [`JavaKeyStore`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/js/classes/JavaKeyStore.md)