---
product: Chilkat
product_version: 11.7.0
language: wcpp
language_label: Unicode C++
class: TrustedRoots
class_name: CkTrustedRootsW
license: free
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/wcppCkTrustedRootsWRef.html
---
# Chilkat TrustedRoots — Unicode C++ — v11.7.0

> Chilkat 11.7.0 · language=wcpp · class=TrustedRoots (CkTrustedRootsW)
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/TrustedRoots.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/wcpp/guide.md`.

## Purpose

**Configure the trusted root certificates used by Chilkat certificate validation.**

`Chilkat.TrustedRoots` manages a collection of trusted CA and self-signed root certificates used Chilkat-wide for PKCS7/CMS signature validation and SSL/TLS server certificate validation. It can add individual certificates, import trusted certificates from a Java keystore, load PEM CA bundles, activate or deactivate the trusted-root set, and control whether system CA roots and self-signed server certificates are trusted.

**Custom trusted roots**

Add root or CA certificates that should be trusted by Chilkat validation operations.

**PEM CA bundles**

Load one or more trusted CA certificates from PEM bundle files used by many TLS and certificate-validation workflows.

**Java keystore import**

Import trusted certificates from a `JavaKeyStore` when trust anchors are maintained in JKS-style storage.

**System CA root control**

Choose whether Chilkat should also trust the operating system's CA root certificates.

**Self-signed certificate policy**

Control whether self-signed server certificates are rejected or accepted during certificate validation.

**Activate Chilkat-wide trust**

Activate the configured trusted-root set so it is used by Chilkat classes that perform TLS or signature certificate validation.

**Common pattern:** Create a `TrustedRoots` object, add trusted certificates or load a PEM CA bundle, configure whether system roots and self-signed certificates should be trusted, then call `Activate`. Treat trusted roots as Chilkat-wide validation configuration, not as private state for a single object.

For an extended overview, see [TrustedRoots Class Overview](https://www.chilkatsoft.com/trustedroots_class_overview.asp).

## Object creation, unlocking and error handling

**Object Creation**

```cpp
// Local variable on the stack
CkTrustedRootsW obj;

// Dynamically allocate/delete
CkTrustedRootsW *pObj = new CkTrustedRootsW();
// ...
delete pObj;
```

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Unicode C++.

How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `void get_DebugLogFilePath(CkString &str); const wchar_t *debugLogFilePath(void); void put_DebugLogFilePath(const wchar_t *str);` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `void get_LastErrorHtml(CkString &str); const wchar_t *lastErrorHtml(void);` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `void get_LastErrorText(CkString &str); const wchar_t *lastErrorText(void);` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `void get_LastErrorXml(CkString &str); const wchar_t *lastErrorXml(void);` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `bool get_LastMethodSuccess(void); void put_LastMethodSuccess(bool newVal);` | read/write | Indicates the success or failure of the most recent method call: `true` means success, `false` means failure. |
| `VerboseLogging` | `bool get_VerboseLogging(void); void put_VerboseLogging(bool newVal);` | read/write | If set to `true`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `void get_Version(CkString &str); const wchar_t *version(void);` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `NumCerts` | property, read-only | `int get_NumCerts(void);` |
| `RejectSelfSignedCerts` | property, read/write | `bool get_RejectSelfSignedCerts(void); void put_RejectSelfSignedCerts(bool newVal);` |
| `TrustSystemCaRoots` | property, read/write | `bool get_TrustSystemCaRoots(void); void put_TrustSystemCaRoots(bool newVal);` |
| `Activate` | method | `bool Activate(void);` |
| `AddCert` | method | `bool AddCert(CkCertW &cert);` |
| `AddJavaKeyStore` | method | `bool AddJavaKeyStore(CkJavaKeyStoreW &keystore);` |
| `CertAt` | method | `bool CertAt(int index, CkCertW &cert);` |
| `Deactivate` | method | `bool Deactivate(void);` |
| `LoadCaCertsPem` | method | `bool LoadCaCertsPem(const wchar_t *path);` |
| `LoadTaskCaller` | method | `bool LoadTaskCaller(CkTaskW &task);` |

Deprecated members are listed at the end of this file with their replacements; do not use them in new code.

## Properties

### TrustedRoots.NumCerts

`Chilkat 11.7.0 · wcpp · TrustedRoots · NumCerts · property · read-only · since 9.5.0.38`

```cpp
int get_NumCerts(void);
```

The number of certificates explicitly contained in this object. The count includes certificates added by `AddCert`, `AddJavaKeyStore`, and `LoadCaCertsPem`.

Use indexes from `0` through `NumCerts - 1` with `CertAt`.

**Scope of the count:** This property does not include operating-system CA roots made available by `TrustSystemCaRoots`. It reports only the certificates stored in this object.

### TrustedRoots.RejectSelfSignedCerts

`Chilkat 11.7.0 · wcpp · TrustedRoots · RejectSelfSignedCerts · property · read/write · since 9.5.0.80`

```cpp
bool get_RejectSelfSignedCerts(void);

void put_RejectSelfSignedCerts(bool newVal);
```

Controls the special case in which an SSL/TLS server presents a certificate chain containing exactly one certificate and that certificate is self-signed. The default value is `false`.

| Value | Behavior |
| :--- | :--- |
| `false` | Do not reject a one-certificate TLS chain solely because the certificate is self-signed. |
| `true` | Reject TLS server chains consisting of one self-signed certificate. |

This property applies to the TLS server-certificate case described above. It does not reject a self-signed CA certificate merely because that certificate appears as the trust anchor above a longer chain.

**Security guidance:** A self-signed certificate has no external issuer establishing trust. Accept it only when the certificate or its public-key fingerprint has been authenticated through a separate trusted channel.

### TrustedRoots.TrustSystemCaRoots

`Chilkat 11.7.0 · wcpp · TrustedRoots · TrustSystemCaRoots · property · read/write · since 9.5.0.41`

```cpp
bool get_TrustSystemCaRoots(void);

void put_TrustSystemCaRoots(bool newVal);
```

Controls whether operating-system CA roots are included when this object's trust configuration is activated. The default value is `true`.

| Value | Behavior |
| :--- | :--- |
| `true` | Trust explicitly added certificates and the system-provided CA roots available to Chilkat. |
| `false` | Do not automatically trust system-provided CA roots; use the explicitly configured collection and the selected self-signed-certificate policy. |

On Windows, system roots come from registry-based certificate stores. On Linux, Chilkat may use a system CA bundle such as `/etc/ssl/certs/ca-certificates.crt` when available.

System roots are not added to this object's explicit collection and therefore are not included in `NumCerts` or returned by `CertAt`.

## Methods

### TrustedRoots.Activate

`Chilkat 11.7.0 · wcpp · TrustedRoots · Activate · method · since 9.5.0.38`

```cpp
bool Activate(void);
```

Activates this object's trust configuration for Chilkat-wide certificate validation. The active configuration includes:

- Certificates explicitly added to this object by `AddCert`, `AddJavaKeyStore`, or `LoadCaCertsPem`.
- Operating-system CA roots when `TrustSystemCaRoots` is `true`.
- The self-signed TLS certificate policy selected by `RejectSelfSignedCerts`.

After activation, Chilkat classes that validate PKCS7/CMS signatures or SSL/TLS server certificate chains use this trust configuration. Returns `true` if the configuration was activated successfully; otherwise returns `false`.

**Trust-anchor note:** Activating a certificate as trusted supplies a starting point for certificate-path validation. It does not, by itself, prove that every certificate issued beneath that anchor is valid for every purpose; the applicable validation operation may also evaluate signatures, validity periods, identity, key usage, constraints, and other policy requirements.

Returns true for success, false for failure.

### TrustedRoots.AddCert

`Chilkat 11.7.0 · wcpp · TrustedRoots · AddCert · method · since 9.5.0.41`

```cpp
bool AddCert(CkCertW &cert);
```

Adds the certificate in `cert` to this object's explicit trusted-certificate collection. The certificate is subsequently treated as a trust anchor when this configuration is activated.

Returns `true` if the certificate was added successfully; otherwise returns `false`.

**Security-sensitive operation:** Calling this method is an explicit trust decision. It does not first determine whether the certificate is self-signed, belongs to a public CA, is currently valid, or is appropriate for the intended application. Add only certificates obtained and verified through a trustworthy process.

Returns true for success, false for failure.

### TrustedRoots.AddJavaKeyStore

`Chilkat 11.7.0 · wcpp · TrustedRoots · AddJavaKeyStore · method · since 9.5.0.44`

```cpp
bool AddJavaKeyStore(CkJavaKeyStoreW &keystore);
```

Adds the certificates designated as trusted entries in the `keystore` `JavaKeyStore` to this object's explicit trusted-certificate collection.

Private keys and secret keys are not imported. Returns `true` if the trusted certificates were added successfully; otherwise returns `false`.

**Java keystore terminology:** A trusted-certificate entry represents a certificate that the keystore owner has chosen to trust. Importing it preserves that trust decision; it does not independently validate the certificate or build a certification path for it.

Returns true for success, false for failure.

Async variant: `AddJavaKeyStoreAsync` — same arguments, returns a `Task` (see Async variants below).

### TrustedRoots.CertAt

`Chilkat 11.7.0 · wcpp · TrustedRoots · CertAt · method · since 11.0.0`

```cpp
bool CertAt(int index, CkCertW &cert);
```

Copies the certificate at zero-based `index` into the caller-supplied `Cert` object in `cert`.

Valid indexes are from `0` through `NumCerts - 1`. Returns `true` if the certificate was retrieved successfully; otherwise returns `false`, such as when the index is outside the valid range.

This method enumerates only certificates explicitly contained in this `TrustedRoots` object. Operating-system roots enabled through `TrustSystemCaRoots` are not included.

Returns true for success, false for failure.

### TrustedRoots.Deactivate

`Chilkat 11.7.0 · wcpp · TrustedRoots · Deactivate · method · since 9.5.0.40`

```cpp
bool Deactivate(void);
```

Deactivates the previously activated Chilkat-wide trusted-root configuration. After deactivation, roots and single-certificate self-signed certificates are implicitly trusted.

Returns `true` if the active configuration was deactivated successfully; otherwise returns `false`.

**Security warning:** This is a permissive mode. It does not merely restore a conventional “trust the operating-system CA store” policy. Use `Deactivate` only when implicitly trusting arbitrary roots and self-signed certificates is intentional and acceptable for the application.

Returns true for success, false for failure.

### TrustedRoots.LoadCaCertsPem

`Chilkat 11.7.0 · wcpp · TrustedRoots · LoadCaCertsPem · method · since 9.5.0.38`

```cpp
bool LoadCaCertsPem(const wchar_t *path);
```

Loads one or more PEM-encoded certificates from the file at `path` and adds them to this object's explicit trusted-certificate collection. A CA bundle normally contains consecutive `-----BEGIN CERTIFICATE-----` / `-----END CERTIFICATE-----` blocks.

This method can load a curated application bundle, a Mozilla-derived CA bundle, or a platform bundle such as `/etc/ssl/certs/ca-certificates.crt` when that file exists. Returns `true` if the bundle was loaded successfully; otherwise returns `false`.

**Trust implication:** Certificates loaded by this method are treated as trusted anchors after activation. The file is not merely a source of intermediate certificates. Review and protect the bundle as security-sensitive configuration.

Returns true for success, false for failure.

Async variant: `LoadCaCertsPemAsync` — same arguments, returns a `Task` (see Async variants below).

### TrustedRoots.LoadTaskCaller

`Chilkat 11.7.0 · wcpp · TrustedRoots · LoadTaskCaller · method · since 9.5.0.80`

```cpp
bool LoadTaskCaller(CkTaskW &task);
```

Associates `task` with the object that initiated the task's asynchronous method call. This supports Chilkat's asynchronous task infrastructure and is not normally called directly by application code.

Returns `true` if the task caller was loaded successfully; otherwise returns `false`.

Returns true for success, false for failure.

## Events and callbacks

To receive events, define your own class that inherits from CkBaseProgressW and override just the methods you want to handle. The base class provides an empty implementation of every method, so anything you don't override is simply ignored.

Then create an instance of your class and pass its address to the object's put_EventCallbackObject method. From that point on, the object calls your methods as the work proceeds. Be sure the callback object stays in scope for as long as it is in use.

**For example:**

```cpp
  CkTrustedRootsW trustedroots;

  MyTrustedRootsProgressW callbackObj;

  trustedroots.put_EventCallbackObject(&callbackObj);
```

**MyTrustedRootsProgressW example:**

```cpp
#include "CkBaseProgressW.h"

class MyTrustedRootsProgressW : public CkBaseProgressW {

  public:
    MyTrustedRootsProgressW();
    virtual ~MyTrustedRootsProgressW();

    void AbortCheck(bool  *abort);
    void PercentDone(int pctDone, bool  *abort);
    void ProgressInfo(const wchar_t *name, const wchar_t *value);
    void TaskCompleted(CkTaskW &task);
};
```

### TrustedRoots.AbortCheck (event)

`Chilkat 11.7.0 · wcpp · TrustedRoots · AbortCheck · event`

```cpp
void AbortCheck(bool  *abort);
```

Enables a method call to be aborted by triggering the AbortCheck event at intervals defined by the `HeartbeatMs` property. If HeartbeatMs is set to its default value of 0, no events will occur. For instance, set HeartbeatMs to 200 to trigger 5 AbortCheck events per second.

### TrustedRoots.PercentDone (event)

`Chilkat 11.7.0 · wcpp · TrustedRoots · PercentDone · event`

```cpp
void PercentDone(int pctDone, bool  *abort);
```

This provides the percentage completion for any method involving network communications or time-consuming processing, assuming the progress can be measured as a percentage. This event is triggered only when it's possible and logical to express the operation's progress as a percentage. The `pctDone` argument will range from 1 to 100. For methods that finish quickly, the number of PercentDone callbacks may vary, but the final callback will have `pctDone` equal to 100. For longer operations, callbacks will not exceed one per percentage point (e.g., 1, 2, 3, ..., 98, 99, 100).

The PercentDone callback also acts as an `AbortCheck` event. For fast methods where PercentDone fires, an AbortCheck event may not trigger since the PercentDone callback already provides an opportunity to abort. For longer operations, where time between PercentDone callbacks is extended, AbortCheck callbacks enable more responsive operation termination.

To abort the operation, set the `abort` output argument to `true`. This will cause the method to terminate and return a failure status or corresponding failure value.

### TrustedRoots.ProgressInfo (event)

`Chilkat 11.7.0 · wcpp · TrustedRoots · ProgressInfo · event`

```cpp
void ProgressInfo(const wchar_t *name, const wchar_t *value);
```

This event callback provides `tag name`/value pairs that detail what occurs during a method call. To discover existing tag names, create code to handle the event, emit the pairs, and review them. Most tag names are self-explanatory.

Note: Some Chilkat methods don't fire any ProgressInfo events.

### TrustedRoots.TaskCompleted (event)

`Chilkat 11.7.0 · wcpp · TrustedRoots · TaskCompleted · event`

```cpp
void TaskCompleted(CkTaskW &task);
```

Called from the background thread when an asynchronous task completes.

## Async variants

Each returns a `Task` instead of the result and takes the same arguments as the synchronous method; run the task, wait for `Finished`, then read the result from the task. No new Async methods are added from 11.7.0 on.

```cpp
CkTaskW *AddJavaKeyStoreAsync(CkJavaKeyStoreW &keystore);
CkTaskW *LoadCaCertsPemAsync(const wchar_t *path);
```

## Deprecated members — do not use in new code

| Member | Kind | Deprecated in | Use instead |
|---|---|---|---|
| `GetCert` | method | before 11.6.1 | `CertAt` |

## Related classes

[`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/wcpp/classes/Cert.md), [`JavaKeyStore`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/wcpp/classes/JavaKeyStore.md), [`Task`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/wcpp/classes/Task.md)