---
product: Chilkat
product_version: 11.7.0
language: pascal
language_label: Lazarus Pascal
class: TrustedRoots
license: free
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/pascal_TrustedRootsRef.html
---
# Chilkat TrustedRoots — Lazarus Pascal — v11.7.0

> Chilkat 11.7.0 · language=pascal · class=TrustedRoots
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/TrustedRoots.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/guide.md`.

## Purpose

**Configure the trusted root certificates used by Chilkat certificate validation.**

`Chilkat.TrustedRoots` manages a collection of trusted CA and self-signed root certificates used Chilkat-wide for PKCS7/CMS signature validation and SSL/TLS server certificate validation. It can add individual certificates, import trusted certificates from a Java keystore, load PEM CA bundles, activate or deactivate the trusted-root set, and control whether system CA roots and self-signed server certificates are trusted.

**Custom trusted roots**

Add root or CA certificates that should be trusted by Chilkat validation operations.

**PEM CA bundles**

Load one or more trusted CA certificates from PEM bundle files used by many TLS and certificate-validation workflows.

**Java keystore import**

Import trusted certificates from a `JavaKeyStore` when trust anchors are maintained in JKS-style storage.

**System CA root control**

Choose whether Chilkat should also trust the operating system's CA root certificates.

**Self-signed certificate policy**

Control whether self-signed server certificates are rejected or accepted during certificate validation.

**Activate Chilkat-wide trust**

Activate the configured trusted-root set so it is used by Chilkat classes that perform TLS or signature certificate validation.

**Common pattern:** Create a `TrustedRoots` object, add trusted certificates or load a PEM CA bundle, configure whether system roots and self-signed certificates should be trusted, then call `Activate`. Treat trusted roots as Chilkat-wide validation configuration, not as private state for a single object.

For an extended overview, see [TrustedRoots Class Overview](https://www.chilkatsoft.com/trustedroots_class_overview.asp).

## Object creation, unlocking and error handling

**Create / Free**

```pascal
uses
  Chilkat.TrustedRoots;

var
  obj: TTrustedRoots;
begin
  obj := TTrustedRoots.Create;
  try
    if not obj.IsValid then
      raise Exception.Create('Failed to create a TTrustedRoots instance.');

    // ... use obj ...

  finally
    obj.Free;
  end;
end;
```

`constructor Create;`

Allocates the underlying CkTrustedRoots object and returns a new TTrustedRoots instance. Simply adding **Chilkat.TrustedRoots** to the unit's `uses` clause is enough to locate and bind to the Chilkat shared library (DLL / .so / .dylib) at runtime — no separate load step is required. Check `obj.IsValid` after calling `Create`; it is `False` if the underlying library could not be found/loaded or the object could not be allocated (for example, when unlicensed).

`destructor Destroy; override;`

Every TTrustedRoots created by calling `Create` should eventually be released by calling `.Free` (inherited from `TObject`). The destructor automatically disposes the underlying CkTrustedRoots handle. A native (unmanaged) memory leak occurs if the object is never freed.

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Lazarus Pascal.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `property DebugLogFilePath: string read GetDebugLogFilePath write SetDebugLogFilePath;` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `property LastErrorHtml: string read GetLastErrorHtml;` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `property LastErrorText: string read GetLastErrorText;` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `property LastErrorXml: string read GetLastErrorXml;` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `property LastMethodSuccess: Boolean read GetLastMethodSuccess write SetLastMethodSuccess;` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. |
| `VerboseLogging` | `property VerboseLogging: Boolean read GetVerboseLogging write SetVerboseLogging;` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `property Version: string read GetVersion;` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `NumCerts` | property, read-only | `property NumCerts: Integer read GetNumCerts;` |
| `RejectSelfSignedCerts` | property, read/write | `property RejectSelfSignedCerts: Boolean read GetRejectSelfSignedCerts write SetRejectSelfSignedCerts;` |
| `TrustSystemCaRoots` | property, read/write | `property TrustSystemCaRoots: Boolean read GetTrustSystemCaRoots write SetTrustSystemCaRoots;` |
| `Activate` | method | `function Activate: Boolean;` |
| `AddCert` | method | `// cert is a TCert object. function AddCert(cert: TChilkatBase): Boolean;` |
| `AddJavaKeyStore` | method | `// keystore is a TJavaKeyStore object. function AddJavaKeyStore(keystore: TChilkatBase): Boolean;` |
| `CertAt` | method | `// cert is a TCert object. function CertAt(index: Integer;     cert: TChilkatBase): Boolean;` |
| `Deactivate` | method | `function Deactivate: Boolean;` |
| `LoadCaCertsPem` | method | `function LoadCaCertsPem(const path: string): Boolean;` |
| `LoadTaskCaller` | method | `// task is a TTask object. function LoadTaskCaller(task: TChilkatBase): Boolean;` |

## Properties

### TrustedRoots.NumCerts

`Chilkat 11.7.0 · pascal · TrustedRoots · NumCerts · property · read-only · since 9.5.0.38`

```pascal
property NumCerts: Integer read GetNumCerts;
```

The number of certificates explicitly contained in this object. The count includes certificates added by `AddCert`, `AddJavaKeyStore`, and `LoadCaCertsPem`.

Use indexes from `0` through `NumCerts - 1` with `CertAt`.

**Scope of the count:** This property does not include operating-system CA roots made available by `TrustSystemCaRoots`. It reports only the certificates stored in this object.

### TrustedRoots.RejectSelfSignedCerts

`Chilkat 11.7.0 · pascal · TrustedRoots · RejectSelfSignedCerts · property · read/write · since 9.5.0.80`

```pascal
property RejectSelfSignedCerts: Boolean read GetRejectSelfSignedCerts write SetRejectSelfSignedCerts;
```

Controls the special case in which an SSL/TLS server presents a certificate chain containing exactly one certificate and that certificate is self-signed. The default value is `False`.

| Value | Behavior |
| :--- | :--- |
| `False` | Do not reject a one-certificate TLS chain solely because the certificate is self-signed. |
| `True` | Reject TLS server chains consisting of one self-signed certificate. |

This property applies to the TLS server-certificate case described above. It does not reject a self-signed CA certificate merely because that certificate appears as the trust anchor above a longer chain.

**Security guidance:** A self-signed certificate has no external issuer establishing trust. Accept it only when the certificate or its public-key fingerprint has been authenticated through a separate trusted channel.

### TrustedRoots.TrustSystemCaRoots

`Chilkat 11.7.0 · pascal · TrustedRoots · TrustSystemCaRoots · property · read/write · since 9.5.0.41`

```pascal
property TrustSystemCaRoots: Boolean read GetTrustSystemCaRoots write SetTrustSystemCaRoots;
```

Controls whether operating-system CA roots are included when this object's trust configuration is activated. The default value is `True`.

| Value | Behavior |
| :--- | :--- |
| `True` | Trust explicitly added certificates and the system-provided CA roots available to Chilkat. |
| `False` | Do not automatically trust system-provided CA roots; use the explicitly configured collection and the selected self-signed-certificate policy. |

On Windows, system roots come from registry-based certificate stores. On Linux, Chilkat may use a system CA bundle such as `/etc/ssl/certs/ca-certificates.crt` when available.

System roots are not added to this object's explicit collection and therefore are not included in `NumCerts` or returned by `CertAt`.

## Methods

### TrustedRoots.Activate

`Chilkat 11.7.0 · pascal · TrustedRoots · Activate · method · since 9.5.0.38`

```pascal
function  Activate: Boolean;
```

Activates this object's trust configuration for Chilkat-wide certificate validation. The active configuration includes:

- Certificates explicitly added to this object by `AddCert`, `AddJavaKeyStore`, or `LoadCaCertsPem`.
- Operating-system CA roots when `TrustSystemCaRoots` is `True`.
- The self-signed TLS certificate policy selected by `RejectSelfSignedCerts`.

After activation, Chilkat classes that validate PKCS7/CMS signatures or SSL/TLS server certificate chains use this trust configuration. Returns `True` if the configuration was activated successfully; otherwise returns `False`.

**Trust-anchor note:** Activating a certificate as trusted supplies a starting point for certificate-path validation. It does not, by itself, prove that every certificate issued beneath that anchor is valid for every purpose; the applicable validation operation may also evaluate signatures, validity periods, identity, key usage, constraints, and other policy requirements.

Returns True for success, False for failure.

### TrustedRoots.AddCert

`Chilkat 11.7.0 · pascal · TrustedRoots · AddCert · method · since 9.5.0.41`

```pascal
// cert is a TCert object.

function  AddCert(cert: TChilkatBase): Boolean;
```

Adds the certificate in `cert` to this object's explicit trusted-certificate collection. The certificate is subsequently treated as a trust anchor when this configuration is activated.

Returns `True` if the certificate was added successfully; otherwise returns `False`.

**Security-sensitive operation:** Calling this method is an explicit trust decision. It does not first determine whether the certificate is self-signed, belongs to a public CA, is currently valid, or is appropriate for the intended application. Add only certificates obtained and verified through a trustworthy process.

Returns True for success, False for failure.

### TrustedRoots.AddJavaKeyStore

`Chilkat 11.7.0 · pascal · TrustedRoots · AddJavaKeyStore · method · since 9.5.0.44`

```pascal
// keystore is a TJavaKeyStore object.

function  AddJavaKeyStore(keystore: TChilkatBase): Boolean;
```

Adds the certificates designated as trusted entries in the `keystore` `JavaKeyStore` to this object's explicit trusted-certificate collection.

Private keys and secret keys are not imported. Returns `True` if the trusted certificates were added successfully; otherwise returns `False`.

**Java keystore terminology:** A trusted-certificate entry represents a certificate that the keystore owner has chosen to trust. Importing it preserves that trust decision; it does not independently validate the certificate or build a certification path for it.

Returns True for success, False for failure.

### TrustedRoots.CertAt

`Chilkat 11.7.0 · pascal · TrustedRoots · CertAt · method · since 11.0.0`

```pascal
// cert is a TCert object.

function  CertAt(index: Integer;
    cert: TChilkatBase): Boolean;
```

Copies the certificate at zero-based `index` into the caller-supplied `Cert` object in `cert`.

Valid indexes are from `0` through `NumCerts - 1`. Returns `True` if the certificate was retrieved successfully; otherwise returns `False`, such as when the index is outside the valid range.

This method enumerates only certificates explicitly contained in this `TrustedRoots` object. Operating-system roots enabled through `TrustSystemCaRoots` are not included.

Returns True for success, False for failure.

### TrustedRoots.Deactivate

`Chilkat 11.7.0 · pascal · TrustedRoots · Deactivate · method · since 9.5.0.40`

```pascal
function  Deactivate: Boolean;
```

Deactivates the previously activated Chilkat-wide trusted-root configuration. After deactivation, roots and single-certificate self-signed certificates are implicitly trusted.

Returns `True` if the active configuration was deactivated successfully; otherwise returns `False`.

**Security warning:** This is a permissive mode. It does not merely restore a conventional “trust the operating-system CA store” policy. Use `Deactivate` only when implicitly trusting arbitrary roots and self-signed certificates is intentional and acceptable for the application.

Returns True for success, False for failure.

### TrustedRoots.LoadCaCertsPem

`Chilkat 11.7.0 · pascal · TrustedRoots · LoadCaCertsPem · method · since 9.5.0.38`

```pascal
function  LoadCaCertsPem(const path: string): Boolean;
```

Loads one or more PEM-encoded certificates from the file at `path` and adds them to this object's explicit trusted-certificate collection. A CA bundle normally contains consecutive `-----BEGIN CERTIFICATE-----` / `-----END CERTIFICATE-----` blocks.

This method can load a curated application bundle, a Mozilla-derived CA bundle, or a platform bundle such as `/etc/ssl/certs/ca-certificates.crt` when that file exists. Returns `True` if the bundle was loaded successfully; otherwise returns `False`.

**Trust implication:** Certificates loaded by this method are treated as trusted anchors after activation. The file is not merely a source of intermediate certificates. Review and protect the bundle as security-sensitive configuration.

Returns True for success, False for failure.

### TrustedRoots.LoadTaskCaller

`Chilkat 11.7.0 · pascal · TrustedRoots · LoadTaskCaller · method · since 9.5.0.80`

```pascal
// task is a TTask object.

function  LoadTaskCaller(task: TChilkatBase): Boolean;
```

Associates `task` with the object that initiated the task's asynchronous method call. This supports Chilkat's asynchronous task infrastructure and is not normally called directly by application code.

Returns `True` if the task caller was loaded successfully; otherwise returns `False`.

Returns True for success, False for failure.

## Events and callbacks

Chilkat for Pascal supports three synchronous event callbacks: `OnAbortCheck`, `OnPercentDone`, and `OnProgressInfo`. Each is a property of the class; assign a method of one of your own objects (an *of object* handler) to receive the callbacks, or assign `nil` to unhook. The handler types are declared in the `Chilkat.Base` unit:

```pascal
TChilkatAbortCheckEvent   = function(Sender: TChilkatBase): Boolean of object;
TChilkatPercentDoneEvent  = function(Sender: TChilkatBase; PctDone: Integer): Boolean of object;
TChilkatProgressInfoEvent = procedure(Sender: TChilkatBase; const Name, Value: string) of object;
```

All Chilkat methods are synchronous, so callbacks are invoked on the thread that called the method -- if the method was called from the main thread, it is safe to access UI elements from the handler. The `HeartbeatMs` property controls the frequency of `OnAbortCheck` callbacks (the default of 0 means no AbortCheck events fire). Returning `True` from an `OnAbortCheck` or `OnPercentDone` handler aborts the running method.

### TrustedRoots.AbortCheck (event)

`Chilkat 11.7.0 · pascal · TrustedRoots · AbortCheck · event`

```pascal
// TChilkatAbortCheckEvent = function(Sender: TChilkatBase): Boolean of object;

property OnAbortCheck: TChilkatAbortCheckEvent;
```

Enables a method call to be aborted by triggering the AbortCheck event at intervals defined by the `HeartbeatMs` property. If HeartbeatMs is set to its default value of 0, no events will occur. For instance, set HeartbeatMs to 200 to trigger 5 AbortCheck events per second.

**Event callback implementation:**

```pascal
// A handler is a method of one of your own classes, e.g. a form:
function TMyObject.TrustedRootsAbortCheck(Sender: TChilkatBase): Boolean;
begin
  // Called every HeartbeatMs milliseconds while a method is running.
  // Return True to abort the method; return False to continue.
  Result := False;
end;
```

**To add an event handler:**

```pascal
trustedroots := TTrustedRoots.Create;
trustedroots.HeartbeatMs := 250;   // fire OnAbortCheck 4 times per second
trustedroots.OnAbortCheck := MyObject.TrustedRootsAbortCheck;
```

### TrustedRoots.PercentDone (event)

`Chilkat 11.7.0 · pascal · TrustedRoots · PercentDone · event`

```pascal
// TChilkatPercentDoneEvent = function(Sender: TChilkatBase; PctDone: Integer): Boolean of object;

property OnPercentDone: TChilkatPercentDoneEvent;
```

This provides the percentage completion for any method involving network communications or time-consuming processing, assuming the progress can be measured as a percentage. This event is triggered only when it's possible and logical to express the operation's progress as a percentage. The `pctDone` argument will range from 1 to 100. For methods that finish quickly, the number of PercentDone callbacks may vary, but the final callback will have `pctDone` equal to 100. For longer operations, callbacks will not exceed one per percentage point (e.g., 1, 2, 3, ..., 98, 99, 100).

The PercentDone callback also acts as an `AbortCheck` event. For fast methods where PercentDone fires, an AbortCheck event may not trigger since the PercentDone callback already provides an opportunity to abort. For longer operations, where time between PercentDone callbacks is extended, AbortCheck callbacks enable more responsive operation termination.

To abort the operation, set the `abort` output argument to `True`. This will cause the method to terminate and return a failure status or corresponding failure value.

**Event callback implementation:**

```pascal
// A handler is a method of one of your own classes, e.g. a form:
function TMyObject.TrustedRootsPercentDone(Sender: TChilkatBase; PctDone: Integer): Boolean;
begin
  // PctDone ranges from 1 to 100.
  WriteLn('Percent done: ', PctDone);
  // Return True to abort the method; return False to continue.
  Result := False;
end;
```

**To add an event handler:**

```pascal
trustedroots := TTrustedRoots.Create;
trustedroots.OnPercentDone := MyObject.TrustedRootsPercentDone;
```

### TrustedRoots.ProgressInfo (event)

`Chilkat 11.7.0 · pascal · TrustedRoots · ProgressInfo · event`

```pascal
// TChilkatProgressInfoEvent = procedure(Sender: TChilkatBase; const Name, Value: string) of object;

property OnProgressInfo: TChilkatProgressInfoEvent;
```

This event callback provides `tag name`/value pairs that detail what occurs during a method call. To discover existing tag names, create code to handle the event, emit the pairs, and review them. Most tag names are self-explanatory.

Note: Some Chilkat methods don't fire any ProgressInfo events.

**Event callback implementation:**

```pascal
// A handler is a method of one of your own classes, e.g. a form:
procedure TMyObject.TrustedRootsProgressInfo(Sender: TChilkatBase; const Name, Value: string);
begin
  WriteLn(Name, ': ', Value);
end;
```

**To add an event handler:**

```pascal
trustedroots := TTrustedRoots.Create;
trustedroots.OnProgressInfo := MyObject.TrustedRootsProgressInfo;
```

## Related classes

[`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/Cert.md), [`JavaKeyStore`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/JavaKeyStore.md)