---
product: Chilkat
product_version: 11.7.0
language: phpext
language_label: PHP Extension
class: TrustedRoots
class_name: CkTrustedRoots
license: free
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/phpCkTrustedRootsRef.html
---
# Chilkat TrustedRoots — PHP Extension — v11.7.0

> Chilkat 11.7.0 · language=phpext · class=TrustedRoots (CkTrustedRoots)
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/TrustedRoots.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/phpext/guide.md`.

## Purpose

**Configure the trusted root certificates used by Chilkat certificate validation.**

`Chilkat.TrustedRoots` manages a collection of trusted CA and self-signed root certificates used Chilkat-wide for PKCS7/CMS signature validation and SSL/TLS server certificate validation. It can add individual certificates, import trusted certificates from a Java keystore, load PEM CA bundles, activate or deactivate the trusted-root set, and control whether system CA roots and self-signed server certificates are trusted.

**Custom trusted roots**

Add root or CA certificates that should be trusted by Chilkat validation operations.

**PEM CA bundles**

Load one or more trusted CA certificates from PEM bundle files used by many TLS and certificate-validation workflows.

**Java keystore import**

Import trusted certificates from a `JavaKeyStore` when trust anchors are maintained in JKS-style storage.

**System CA root control**

Choose whether Chilkat should also trust the operating system's CA root certificates.

**Self-signed certificate policy**

Control whether self-signed server certificates are rejected or accepted during certificate validation.

**Activate Chilkat-wide trust**

Activate the configured trusted-root set so it is used by Chilkat classes that perform TLS or signature certificate validation.

**Common pattern:** Create a `TrustedRoots` object, add trusted certificates or load a PEM CA bundle, configure whether system roots and self-signed certificates should be trusted, then call `Activate`. Treat trusted roots as Chilkat-wide validation configuration, not as private state for a single object.

For an extended overview, see [TrustedRoots Class Overview](https://www.chilkatsoft.com/trustedroots_class_overview.asp).

## Object creation, unlocking and error handling

**Object Creation**

```php
$obj = new CkTrustedRoots();
```

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in PHP Extension.

How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `string debugLogFilePath(); void put_DebugLogFilePath(string strVal);` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `(read-only) string lastErrorHtml();` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `(read-only) string lastErrorText();` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `(read-only) string lastErrorXml();` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `bool get_LastMethodSuccess() void put_LastMethodSuccess(bool boolVal);` | read/write | Indicates the success or failure of the most recent method call: `true` means success, `false` means failure. |
| `Utf8` | `bool get_Utf8() void put_Utf8(bool boolVal);` | read/write | When set to `true`, all `string` arguments and return values are interpreted as UTF-8 strings. |
| `VerboseLogging` | `bool get_VerboseLogging() void put_VerboseLogging(bool boolVal);` | read/write | If set to `true`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `(read-only) string version();` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `NumCerts` | property, read-only | `(read-only) int get_NumCerts()` |
| `RejectSelfSignedCerts` | property, read/write | `bool get_RejectSelfSignedCerts() void put_RejectSelfSignedCerts(bool boolVal);` |
| `TrustSystemCaRoots` | property, read/write | `bool get_TrustSystemCaRoots() void put_TrustSystemCaRoots(bool boolVal);` |
| `Activate` | method | `bool Activate();` |
| `AddCert` | method | `bool AddCert(CkCert $cert);` |
| `AddJavaKeyStore` | method | `bool AddJavaKeyStore(CkJavaKeyStore $keystore);` |
| `CertAt` | method | `bool CertAt(int $index, CkCert $cert);` |
| `Deactivate` | method | `bool Deactivate();` |
| `LoadCaCertsPem` | method | `bool LoadCaCertsPem(string $path);` |
| `LoadTaskCaller` | method | `bool LoadTaskCaller(CkTask $task);` |

Deprecated members are listed at the end of this file with their replacements; do not use them in new code.

## Properties

### TrustedRoots.NumCerts

`Chilkat 11.7.0 · phpext · TrustedRoots · NumCerts · property · read-only · since 9.5.0.38`

```php
(read-only)

int get_NumCerts()
```

The number of certificates explicitly contained in this object. The count includes certificates added by `AddCert`, `AddJavaKeyStore`, and `LoadCaCertsPem`.

Use indexes from `0` through `NumCerts - 1` with `CertAt`.

**Scope of the count:** This property does not include operating-system CA roots made available by `TrustSystemCaRoots`. It reports only the certificates stored in this object.

### TrustedRoots.RejectSelfSignedCerts

`Chilkat 11.7.0 · phpext · TrustedRoots · RejectSelfSignedCerts · property · read/write · since 9.5.0.80`

```php
bool get_RejectSelfSignedCerts()

void put_RejectSelfSignedCerts(bool boolVal);
```

Controls the special case in which an SSL/TLS server presents a certificate chain containing exactly one certificate and that certificate is self-signed. The default value is `false`.

| Value | Behavior |
| :--- | :--- |
| `false` | Do not reject a one-certificate TLS chain solely because the certificate is self-signed. |
| `true` | Reject TLS server chains consisting of one self-signed certificate. |

This property applies to the TLS server-certificate case described above. It does not reject a self-signed CA certificate merely because that certificate appears as the trust anchor above a longer chain.

**Security guidance:** A self-signed certificate has no external issuer establishing trust. Accept it only when the certificate or its public-key fingerprint has been authenticated through a separate trusted channel.

### TrustedRoots.TrustSystemCaRoots

`Chilkat 11.7.0 · phpext · TrustedRoots · TrustSystemCaRoots · property · read/write · since 9.5.0.41`

```php
bool get_TrustSystemCaRoots()

void put_TrustSystemCaRoots(bool boolVal);
```

Controls whether operating-system CA roots are included when this object's trust configuration is activated. The default value is `true`.

| Value | Behavior |
| :--- | :--- |
| `true` | Trust explicitly added certificates and the system-provided CA roots available to Chilkat. |
| `false` | Do not automatically trust system-provided CA roots; use the explicitly configured collection and the selected self-signed-certificate policy. |

On Windows, system roots come from registry-based certificate stores. On Linux, Chilkat may use a system CA bundle such as `/etc/ssl/certs/ca-certificates.crt` when available.

System roots are not added to this object's explicit collection and therefore are not included in `NumCerts` or returned by `CertAt`.

## Methods

### TrustedRoots.Activate

`Chilkat 11.7.0 · phpext · TrustedRoots · Activate · method · since 9.5.0.38`

```php
bool Activate();
```

Activates this object's trust configuration for Chilkat-wide certificate validation. The active configuration includes:

- Certificates explicitly added to this object by `AddCert`, `AddJavaKeyStore`, or `LoadCaCertsPem`.
- Operating-system CA roots when `TrustSystemCaRoots` is `true`.
- The self-signed TLS certificate policy selected by `RejectSelfSignedCerts`.

After activation, Chilkat classes that validate PKCS7/CMS signatures or SSL/TLS server certificate chains use this trust configuration. Returns `true` if the configuration was activated successfully; otherwise returns `false`.

**Trust-anchor note:** Activating a certificate as trusted supplies a starting point for certificate-path validation. It does not, by itself, prove that every certificate issued beneath that anchor is valid for every purpose; the applicable validation operation may also evaluate signatures, validity periods, identity, key usage, constraints, and other policy requirements.

Returns true for success, false for failure.

### TrustedRoots.AddCert

`Chilkat 11.7.0 · phpext · TrustedRoots · AddCert · method · since 9.5.0.41`

```php
bool AddCert(CkCert $cert);
```

Adds the certificate in `cert` to this object's explicit trusted-certificate collection. The certificate is subsequently treated as a trust anchor when this configuration is activated.

Returns `true` if the certificate was added successfully; otherwise returns `false`.

**Security-sensitive operation:** Calling this method is an explicit trust decision. It does not first determine whether the certificate is self-signed, belongs to a public CA, is currently valid, or is appropriate for the intended application. Add only certificates obtained and verified through a trustworthy process.

Returns true for success, false for failure.

### TrustedRoots.AddJavaKeyStore

`Chilkat 11.7.0 · phpext · TrustedRoots · AddJavaKeyStore · method · since 9.5.0.44`

```php
bool AddJavaKeyStore(CkJavaKeyStore $keystore);
```

Adds the certificates designated as trusted entries in the `keystore` `JavaKeyStore` to this object's explicit trusted-certificate collection.

Private keys and secret keys are not imported. Returns `true` if the trusted certificates were added successfully; otherwise returns `false`.

**Java keystore terminology:** A trusted-certificate entry represents a certificate that the keystore owner has chosen to trust. Importing it preserves that trust decision; it does not independently validate the certificate or build a certification path for it.

Returns true for success, false for failure.

Async variant: `AddJavaKeyStoreAsync` — same arguments, returns a `Task` (see Async variants below).

### TrustedRoots.CertAt

`Chilkat 11.7.0 · phpext · TrustedRoots · CertAt · method · since 11.0.0`

```php
bool CertAt(int $index, CkCert $cert);
```

Copies the certificate at zero-based `index` into the caller-supplied `Cert` object in `cert`.

Valid indexes are from `0` through `NumCerts - 1`. Returns `true` if the certificate was retrieved successfully; otherwise returns `false`, such as when the index is outside the valid range.

This method enumerates only certificates explicitly contained in this `TrustedRoots` object. Operating-system roots enabled through `TrustSystemCaRoots` are not included.

Returns true for success, false for failure.

### TrustedRoots.Deactivate

`Chilkat 11.7.0 · phpext · TrustedRoots · Deactivate · method · since 9.5.0.40`

```php
bool Deactivate();
```

Deactivates the previously activated Chilkat-wide trusted-root configuration. After deactivation, roots and single-certificate self-signed certificates are implicitly trusted.

Returns `true` if the active configuration was deactivated successfully; otherwise returns `false`.

**Security warning:** This is a permissive mode. It does not merely restore a conventional “trust the operating-system CA store” policy. Use `Deactivate` only when implicitly trusting arbitrary roots and self-signed certificates is intentional and acceptable for the application.

Returns true for success, false for failure.

### TrustedRoots.LoadCaCertsPem

`Chilkat 11.7.0 · phpext · TrustedRoots · LoadCaCertsPem · method · since 9.5.0.38`

```php
bool LoadCaCertsPem(string $path);
```

Loads one or more PEM-encoded certificates from the file at `path` and adds them to this object's explicit trusted-certificate collection. A CA bundle normally contains consecutive `-----BEGIN CERTIFICATE-----` / `-----END CERTIFICATE-----` blocks.

This method can load a curated application bundle, a Mozilla-derived CA bundle, or a platform bundle such as `/etc/ssl/certs/ca-certificates.crt` when that file exists. Returns `true` if the bundle was loaded successfully; otherwise returns `false`.

**Trust implication:** Certificates loaded by this method are treated as trusted anchors after activation. The file is not merely a source of intermediate certificates. Review and protect the bundle as security-sensitive configuration.

Returns true for success, false for failure.

Async variant: `LoadCaCertsPemAsync` — same arguments, returns a `Task` (see Async variants below).

### TrustedRoots.LoadTaskCaller

`Chilkat 11.7.0 · phpext · TrustedRoots · LoadTaskCaller · method · since 9.5.0.80`

```php
bool LoadTaskCaller(CkTask $task);
```

Associates `task` with the object that initiated the task's asynchronous method call. This supports Chilkat's asynchronous task infrastructure and is not normally called directly by application code.

Returns `true` if the task caller was loaded successfully; otherwise returns `false`.

Returns true for success, false for failure.

## Events and callbacks

This binding has no event callbacks. For progress, percent-done or cancellation use the `*Async` variant of a method and poll the returned `Task` (`PercentDone`, `Finished`, `Cancel`).

## Async variants

Each returns a `Task` instead of the result and takes the same arguments as the synchronous method; run the task, wait for `Finished`, then read the result from the task. No new Async methods are added from 11.7.0 on.

```php
CkTask AddJavaKeyStoreAsync(CkJavaKeyStore $keystore);
CkTask LoadCaCertsPemAsync(string $path);
```

## Deprecated members — do not use in new code

| Member | Kind | Deprecated in | Use instead |
|---|---|---|---|
| `GetCert` | method | before 11.6.1 | `CertAt` |

## Related classes

[`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/phpext/classes/Cert.md), [`JavaKeyStore`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/phpext/classes/JavaKeyStore.md), [`Task`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/phpext/classes/Task.md)