---
product: Chilkat
product_version: 11.7.0
language: pascal
language_label: Lazarus Pascal
class: XmlCertVault
license: free
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/pascal_XmlCertVaultRef.html
---
# Chilkat XmlCertVault — Lazarus Pascal — v11.7.0

> Chilkat 11.7.0 · language=pascal · class=XmlCertVault
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/XmlCertVault.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/guide.md`.

## Purpose

**Collect certificates, certificate chains, PEM data, and PFX private keys in an XML vault.**

`Chilkat.XmlCertVault` stores certificates and private-key material in a portable XML-based certificate vault. It can add individual certificates, certificate chains, DER or encoded certificates, PEM files, certificate strings, and PFX/PKCS12 data from files, memory, encoded text, or existing Chilkat objects. The vault can then be exported as XML, loaded from XML, or saved to an XML file for later reuse by other Chilkat certificate and TLS workflows.

**Add certificates**

Add certificates from `Cert` objects, files, PEM strings, binary DER bytes, or encoded data such as Base64 or hex.

**Add certificate chains**

Import an entire `CertChain` when related issuer and intermediate certificates should be kept together in the vault.

**Add PEM content**

Load PEM files containing one or more certificates and/or private keys, including encrypted PEM content when a password is supplied.

**Add PFX / PKCS12**

Add PFX data from a `Pfx` object, file, byte array, or encoded string, using the PFX password to import private-key material.

**Master password protection**

Use `MasterPassword` to protect access to private keys stored in the vault.

**Load and save XML**

Export the vault with `GetXml`, load it with `LoadXml` or `LoadXmlFile`, and persist it with `SaveXml`.

**Common pattern:** Create an `XmlCertVault`, set `MasterPassword` when the vault will contain private keys, add certificates or PFX/PEM material, then save the vault with `SaveXml` or keep the XML string from `GetXml`. Later, reload the same vault with `LoadXml` or `LoadXmlFile` and provide the same master password before using private keys.

**Security note:** Certificates are stored unencrypted, but private keys are stored using 256-bit AES encryption. The individual PFX passwords are also stored encrypted with the vault's `MasterPassword`, which is required to access any private keys contained in the XML vault.

## Object creation, unlocking and error handling

**Create / Free**

```pascal
uses
  Chilkat.XmlCertVault;

var
  obj: TXmlCertVault;
begin
  obj := TXmlCertVault.Create;
  try
    if not obj.IsValid then
      raise Exception.Create('Failed to create a TXmlCertVault instance.');

    // ... use obj ...

  finally
    obj.Free;
  end;
end;
```

`constructor Create;`

Allocates the underlying CkXmlCertVault object and returns a new TXmlCertVault instance. Simply adding **Chilkat.XmlCertVault** to the unit's `uses` clause is enough to locate and bind to the Chilkat shared library (DLL / .so / .dylib) at runtime — no separate load step is required. Check `obj.IsValid` after calling `Create`; it is `False` if the underlying library could not be found/loaded or the object could not be allocated (for example, when unlicensed).

`destructor Destroy; override;`

Every TXmlCertVault created by calling `Create` should eventually be released by calling `.Free` (inherited from `TObject`). The destructor automatically disposes the underlying CkXmlCertVault handle. A native (unmanaged) memory leak occurs if the object is never freed.

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Lazarus Pascal.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `property DebugLogFilePath: string read GetDebugLogFilePath write SetDebugLogFilePath;` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `property LastErrorHtml: string read GetLastErrorHtml;` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `property LastErrorText: string read GetLastErrorText;` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `property LastErrorXml: string read GetLastErrorXml;` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `property LastMethodSuccess: Boolean read GetLastMethodSuccess write SetLastMethodSuccess;` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. |
| `VerboseLogging` | `property VerboseLogging: Boolean read GetVerboseLogging write SetVerboseLogging;` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `property Version: string read GetVersion;` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `MasterPassword` | property, read/write | `property MasterPassword: string read GetMasterPassword write SetMasterPassword;` |
| `AddCert` | method | `// cert is a TCert object. function AddCert(cert: TChilkatBase): Boolean;` |
| `AddCertChain` | method | `// certChain is a TCertChain object. function AddCertChain(certChain: TChilkatBase): Boolean;` |
| `AddCertEncoded` | method | `function AddCertEncoded(const encodedBytes: string;     const encoding: string): Boolean;` |
| `AddCertFile` | method | `function AddCertFile(const path: string): Boolean;` |
| `AddCertString` | method | `function AddCertString(const certData: string): Boolean;` |
| `AddPemFile` | method | `function AddPemFile(const path: string;     const password: string): Boolean;` |
| `AddPfx` | method | `// pfx is a TPfx object. function AddPfx(pfx: TChilkatBase): Boolean;` |
| `AddPfxEncoded` | method | `function AddPfxEncoded(const encodedBytes: string;     const encoding: string;     const password: string): Boolean;` |
| `AddPfxFile` | method | `function AddPfxFile(const path: string;     const password: string): Boolean;` |
| `GetXml` | method | `function GetXml: string;` |
| `LoadXml` | method | `function LoadXml(const xml: string): Boolean;` |
| `LoadXmlFile` | method | `function LoadXmlFile(const path: string): Boolean;` |
| `SaveXml` | method | `function SaveXml(const path: string): Boolean;` |

## Properties

### XmlCertVault.MasterPassword

`Chilkat 11.7.0 · pascal · XmlCertVault · MasterPassword · property · read/write · since 9.5.0.40`

```pascal
property MasterPassword: string read GetMasterPassword write SetMasterPassword;
```

The master password for the vault. Certificates are stored unencrypted, but private keys are stored 256-bit AES encrypted using the individual PFX passwords. The PFX passwords are stored 256-bit AES encrypted using the master password. The master password is required to acces any of the private keys stored within the XML vault.

## Methods

### XmlCertVault.AddCert

`Chilkat 11.7.0 · pascal · XmlCertVault · AddCert · method · since 9.5.0.40`

```pascal
// cert is a TCert object.

function  AddCert(cert: TChilkatBase): Boolean;
```

Adds a certificate to the XML vault.

Returns True for success, False for failure.

### XmlCertVault.AddCertChain

`Chilkat 11.7.0 · pascal · XmlCertVault · AddCertChain · method · since 9.5.0.40`

```pascal
// certChain is a TCertChain object.

function  AddCertChain(certChain: TChilkatBase): Boolean;
```

Adds a chain of certificates to the XML vault.

Returns True for success, False for failure.

### XmlCertVault.AddCertEncoded

`Chilkat 11.7.0 · pascal · XmlCertVault · AddCertEncoded · method · since 9.5.0.40`

```pascal
function  AddCertEncoded(const encodedBytes: string;
    const encoding: string): Boolean;
```

Adds a certificate to the XML vault where certificate is passed directly from encoded bytes (such as Base64, Hex, etc.). The encoding is indicated by `encoding`.

Returns True for success, False for failure.

### XmlCertVault.AddCertFile

`Chilkat 11.7.0 · pascal · XmlCertVault · AddCertFile · method · since 9.5.0.40`

```pascal
function  AddCertFile(const path: string): Boolean;
```

Adds a certificate to the XML vault.

Returns True for success, False for failure.

### XmlCertVault.AddCertString

`Chilkat 11.7.0 · pascal · XmlCertVault · AddCertString · method · since 9.5.0.40`

```pascal
function  AddCertString(const certData: string): Boolean;
```

Adds a certificate from any string representation format such as PEM.

Returns True for success, False for failure.

### XmlCertVault.AddPemFile

`Chilkat 11.7.0 · pascal · XmlCertVault · AddPemFile · method · since 9.5.0.40`

```pascal
function  AddPemFile(const path: string;
    const password: string): Boolean;
```

Adds the contents of a PEM file to the XML vault. The PEM file may be encrypted, and it may contain one or more certificates and/or private keys. The password is optional and only required if the PEM file contains encrypted content that requires a password.

Returns True for success, False for failure.

### XmlCertVault.AddPfx

`Chilkat 11.7.0 · pascal · XmlCertVault · AddPfx · method · since 9.5.0.40`

```pascal
// pfx is a TPfx object.

function  AddPfx(pfx: TChilkatBase): Boolean;
```

Adds a PFX (PKCS12) to the XML vault.

Returns True for success, False for failure.

### XmlCertVault.AddPfxEncoded

`Chilkat 11.7.0 · pascal · XmlCertVault · AddPfxEncoded · method`

```pascal
function  AddPfxEncoded(const encodedBytes: string;
    const encoding: string;
    const password: string): Boolean;
```

Adds a PFX to the XML vault where PFX is passed directly from encoded bytes (such as Base64, Hex, etc.). The encoding is indicated by `encoding`.

Returns True for success, False for failure.

### XmlCertVault.AddPfxFile

`Chilkat 11.7.0 · pascal · XmlCertVault · AddPfxFile · method · since 9.5.0.40`

```pascal
function  AddPfxFile(const path: string;
    const password: string): Boolean;
```

Adds a PFX file to the XML vault.

Returns True for success, False for failure.

### XmlCertVault.GetXml

`Chilkat 11.7.0 · pascal · XmlCertVault · GetXml · method · since 9.5.0.40`

```pascal
function  GetXml: string;
```

Returns the contents of the cert vault as an XML string.

Returns True for success, False for failure.

### XmlCertVault.LoadXml

`Chilkat 11.7.0 · pascal · XmlCertVault · LoadXml · method · since 9.5.0.40`

```pascal
function  LoadXml(const xml: string): Boolean;
```

Loads from an XML string.

Returns True for success, False for failure.

### XmlCertVault.LoadXmlFile

`Chilkat 11.7.0 · pascal · XmlCertVault · LoadXmlFile · method · since 9.5.0.40`

```pascal
function  LoadXmlFile(const path: string): Boolean;
```

Loads from an XML file.

Returns True for success, False for failure.

### XmlCertVault.SaveXml

`Chilkat 11.7.0 · pascal · XmlCertVault · SaveXml · method · since 9.5.0.40`

```pascal
function  SaveXml(const path: string): Boolean;
```

Saves the contents to an XML file.

Returns True for success, False for failure.

## Related classes

[`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/Cert.md), [`CertChain`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/CertChain.md), [`Pfx`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/Pfx.md)