---
product: Chilkat
product_version: 11.7.0
language: python
language_label: Python
class: TrustedRoots
license: free
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/pythonTrustedRootsRef.html
---
# Chilkat TrustedRoots — Python — v11.7.0

> Chilkat 11.7.0 · language=python · class=TrustedRoots
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/TrustedRoots.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/python/guide.md`.

## Purpose

**Configure the trusted root certificates used by Chilkat certificate validation.**

`Chilkat.TrustedRoots` manages a collection of trusted CA and self-signed root certificates used Chilkat-wide for PKCS7/CMS signature validation and SSL/TLS server certificate validation. It can add individual certificates, import trusted certificates from a Java keystore, load PEM CA bundles, activate or deactivate the trusted-root set, and control whether system CA roots and self-signed server certificates are trusted.

**Custom trusted roots**

Add root or CA certificates that should be trusted by Chilkat validation operations.

**PEM CA bundles**

Load one or more trusted CA certificates from PEM bundle files used by many TLS and certificate-validation workflows.

**Java keystore import**

Import trusted certificates from a `JavaKeyStore` when trust anchors are maintained in JKS-style storage.

**System CA root control**

Choose whether Chilkat should also trust the operating system's CA root certificates.

**Self-signed certificate policy**

Control whether self-signed server certificates are rejected or accepted during certificate validation.

**Activate Chilkat-wide trust**

Activate the configured trusted-root set so it is used by Chilkat classes that perform TLS or signature certificate validation.

**Common pattern:** Create a `TrustedRoots` object, add trusted certificates or load a PEM CA bundle, configure whether system roots and self-signed certificates should be trusted, then call `Activate`. Treat trusted roots as Chilkat-wide validation configuration, not as private state for a single object.

For an extended overview, see [TrustedRoots Class Overview](https://www.chilkatsoft.com/trustedroots_class_overview.asp).

## Object creation, unlocking and error handling

**Object Creation**

```python
obj = chilkat2.TrustedRoots()
```

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Python.

Minimal complete program:

```python
import chilkat2

# Required once per process. Any string unlocks a 30-day trial; use your purchased code in production.
glob = chilkat2.Global()
if not glob.UnlockBundle("Anything for 30-day trial"):
    print(glob.LastErrorText)
    raise SystemExit(1)

trustedRoots = chilkat2.TrustedRoots()

success = trustedRoots.LoadCaCertsPem("<path>")
if not success:
    print(trustedRoots.LastErrorText)   # full diagnostic of what went wrong
    raise SystemExit(1)
```

How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `string DebugLogFilePath` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `string LastErrorHtml (read-only)` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `string LastErrorText (read-only)` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `string LastErrorXml (read-only)` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `bool LastMethodSuccess` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. |
| `VerboseLogging` | `bool VerboseLogging` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `string Version (read-only)` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `NumCerts` | property, read-only | `int NumCerts (read-only)` |
| `RejectSelfSignedCerts` | property, read/write | `bool RejectSelfSignedCerts` |
| `TrustSystemCaRoots` | property, read/write | `bool TrustSystemCaRoots` |
| `Activate` | method | `bool Activate()` |
| `AddCert` | method | `bool AddCert(Cert cert)` |
| `AddJavaKeyStore` | method | `bool AddJavaKeyStore(JavaKeyStore keystore)` |
| `CertAt` | method | `bool CertAt(int index, Cert cert)` |
| `Deactivate` | method | `bool Deactivate()` |
| `LoadCaCertsPem` | method | `bool LoadCaCertsPem(string path)` |
| `LoadTaskCaller` | method | `bool LoadTaskCaller(Task task)` |

Deprecated members are listed at the end of this file with their replacements; do not use them in new code.

## Properties

### TrustedRoots.NumCerts

`Chilkat 11.7.0 · python · TrustedRoots · NumCerts · property · read-only · since 9.5.0.38`

```python
int NumCerts (read-only)
```

The number of certificates explicitly contained in this object. The count includes certificates added by `AddCert`, `AddJavaKeyStore`, and `LoadCaCertsPem`.

Use indexes from `0` through `NumCerts - 1` with `CertAt`.

**Scope of the count:** This property does not include operating-system CA roots made available by `TrustSystemCaRoots`. It reports only the certificates stored in this object.

### TrustedRoots.RejectSelfSignedCerts

`Chilkat 11.7.0 · python · TrustedRoots · RejectSelfSignedCerts · property · read/write · since 9.5.0.80`

```python
bool RejectSelfSignedCerts
```

Controls the special case in which an SSL/TLS server presents a certificate chain containing exactly one certificate and that certificate is self-signed. The default value is `False`.

| Value | Behavior |
| :--- | :--- |
| `False` | Do not reject a one-certificate TLS chain solely because the certificate is self-signed. |
| `True` | Reject TLS server chains consisting of one self-signed certificate. |

This property applies to the TLS server-certificate case described above. It does not reject a self-signed CA certificate merely because that certificate appears as the trust anchor above a longer chain.

**Security guidance:** A self-signed certificate has no external issuer establishing trust. Accept it only when the certificate or its public-key fingerprint has been authenticated through a separate trusted channel.

### TrustedRoots.TrustSystemCaRoots

`Chilkat 11.7.0 · python · TrustedRoots · TrustSystemCaRoots · property · read/write · since 9.5.0.41`

```python
bool TrustSystemCaRoots
```

Controls whether operating-system CA roots are included when this object's trust configuration is activated. The default value is `True`.

| Value | Behavior |
| :--- | :--- |
| `True` | Trust explicitly added certificates and the system-provided CA roots available to Chilkat. |
| `False` | Do not automatically trust system-provided CA roots; use the explicitly configured collection and the selected self-signed-certificate policy. |

On Windows, system roots come from registry-based certificate stores. On Linux, Chilkat may use a system CA bundle such as `/etc/ssl/certs/ca-certificates.crt` when available.

System roots are not added to this object's explicit collection and therefore are not included in `NumCerts` or returned by `CertAt`.

## Methods

### TrustedRoots.Activate

`Chilkat 11.7.0 · python · TrustedRoots · Activate · method · since 9.5.0.38`

```python
bool Activate()
```

Activates this object's trust configuration for Chilkat-wide certificate validation. The active configuration includes:

- Certificates explicitly added to this object by `AddCert`, `AddJavaKeyStore`, or `LoadCaCertsPem`.
- Operating-system CA roots when `TrustSystemCaRoots` is `True`.
- The self-signed TLS certificate policy selected by `RejectSelfSignedCerts`.

After activation, Chilkat classes that validate PKCS7/CMS signatures or SSL/TLS server certificate chains use this trust configuration. Returns `True` if the configuration was activated successfully; otherwise returns `False`.

**Trust-anchor note:** Activating a certificate as trusted supplies a starting point for certificate-path validation. It does not, by itself, prove that every certificate issued beneath that anchor is valid for every purpose; the applicable validation operation may also evaluate signatures, validity periods, identity, key usage, constraints, and other policy requirements.

Returns True for success, False for failure.

### TrustedRoots.AddCert

`Chilkat 11.7.0 · python · TrustedRoots · AddCert · method · since 9.5.0.41`

```python
bool AddCert(Cert cert)
```

Adds the certificate in `cert` to this object's explicit trusted-certificate collection. The certificate is subsequently treated as a trust anchor when this configuration is activated.

Returns `True` if the certificate was added successfully; otherwise returns `False`.

**Security-sensitive operation:** Calling this method is an explicit trust decision. It does not first determine whether the certificate is self-signed, belongs to a public CA, is currently valid, or is appropriate for the intended application. Add only certificates obtained and verified through a trustworthy process.

Returns True for success, False for failure.

### TrustedRoots.AddJavaKeyStore

`Chilkat 11.7.0 · python · TrustedRoots · AddJavaKeyStore · method · since 9.5.0.44`

```python
bool AddJavaKeyStore(JavaKeyStore keystore)
```

Adds the certificates designated as trusted entries in the `keystore` `JavaKeyStore` to this object's explicit trusted-certificate collection.

Private keys and secret keys are not imported. Returns `True` if the trusted certificates were added successfully; otherwise returns `False`.

**Java keystore terminology:** A trusted-certificate entry represents a certificate that the keystore owner has chosen to trust. Importing it preserves that trust decision; it does not independently validate the certificate or build a certification path for it.

Returns True for success, False for failure.

Async variant: `AddJavaKeyStoreAsync` — same arguments, returns a `Task` (see Async variants below).

### TrustedRoots.CertAt

`Chilkat 11.7.0 · python · TrustedRoots · CertAt · method · since 11.0.0`

```python
bool CertAt(int index, Cert cert)
```

Copies the certificate at zero-based `index` into the caller-supplied `Cert` object in `cert`.

Valid indexes are from `0` through `NumCerts - 1`. Returns `True` if the certificate was retrieved successfully; otherwise returns `False`, such as when the index is outside the valid range.

This method enumerates only certificates explicitly contained in this `TrustedRoots` object. Operating-system roots enabled through `TrustSystemCaRoots` are not included.

Returns True for success, False for failure.

### TrustedRoots.Deactivate

`Chilkat 11.7.0 · python · TrustedRoots · Deactivate · method · since 9.5.0.40`

```python
bool Deactivate()
```

Deactivates the previously activated Chilkat-wide trusted-root configuration. After deactivation, roots and single-certificate self-signed certificates are implicitly trusted.

Returns `True` if the active configuration was deactivated successfully; otherwise returns `False`.

**Security warning:** This is a permissive mode. It does not merely restore a conventional “trust the operating-system CA store” policy. Use `Deactivate` only when implicitly trusting arbitrary roots and self-signed certificates is intentional and acceptable for the application.

Returns True for success, False for failure.

### TrustedRoots.LoadCaCertsPem

`Chilkat 11.7.0 · python · TrustedRoots · LoadCaCertsPem · method · since 9.5.0.38`

```python
bool LoadCaCertsPem(string path)
```

Loads one or more PEM-encoded certificates from the file at `path` and adds them to this object's explicit trusted-certificate collection. A CA bundle normally contains consecutive `-----BEGIN CERTIFICATE-----` / `-----END CERTIFICATE-----` blocks.

This method can load a curated application bundle, a Mozilla-derived CA bundle, or a platform bundle such as `/etc/ssl/certs/ca-certificates.crt` when that file exists. Returns `True` if the bundle was loaded successfully; otherwise returns `False`.

**Trust implication:** Certificates loaded by this method are treated as trusted anchors after activation. The file is not merely a source of intermediate certificates. Review and protect the bundle as security-sensitive configuration.

Returns True for success, False for failure.

Async variant: `LoadCaCertsPemAsync` — same arguments, returns a `Task` (see Async variants below).

### TrustedRoots.LoadTaskCaller

`Chilkat 11.7.0 · python · TrustedRoots · LoadTaskCaller · method · since 9.5.0.80`

```python
bool LoadTaskCaller(Task task)
```

Associates `task` with the object that initiated the task's asynchronous method call. This supports Chilkat's asynchronous task infrastructure and is not normally called directly by application code.

Returns `True` if the task caller was loaded successfully; otherwise returns `False`.

Returns True for success, False for failure.

## Events and callbacks

This binding has no event callbacks. For progress, percent-done or cancellation use the `*Async` variant of a method and poll the returned `Task` (`PercentDone`, `Finished`, `Cancel`).

## Async variants

Each returns a `Task` instead of the result and takes the same arguments as the synchronous method; run the task, wait for `Finished`, then read the result from the task. No new Async methods are added from 11.7.0 on.

```python
Task AddJavaKeyStoreAsync(JavaKeyStore keystore)
Task LoadCaCertsPemAsync(string path)
```

## Deprecated members — do not use in new code

| Member | Kind | Deprecated in | Use instead |
|---|---|---|---|
| `GetCert` | method | before 11.6.1 | `CertAt` |

## Related classes

[`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/python/classes/Cert.md), [`JavaKeyStore`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/python/classes/JavaKeyStore.md), [`Task`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/python/classes/Task.md)