---
product: Chilkat
product_version: 11.7.0
language: xojo
language_label: Xojo
class: TrustedRoots
license: free
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/xojoTrustedRootsRef.html
---
# Chilkat TrustedRoots — Xojo — v11.7.0

> Chilkat 11.7.0 · language=xojo · class=TrustedRoots
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/TrustedRoots.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/xojo/guide.md`.

## Purpose

**Configure the trusted root certificates used by Chilkat certificate validation.**

`Chilkat.TrustedRoots` manages a collection of trusted CA and self-signed root certificates used Chilkat-wide for PKCS7/CMS signature validation and SSL/TLS server certificate validation. It can add individual certificates, import trusted certificates from a Java keystore, load PEM CA bundles, activate or deactivate the trusted-root set, and control whether system CA roots and self-signed server certificates are trusted.

**Custom trusted roots**

Add root or CA certificates that should be trusted by Chilkat validation operations.

**PEM CA bundles**

Load one or more trusted CA certificates from PEM bundle files used by many TLS and certificate-validation workflows.

**Java keystore import**

Import trusted certificates from a `JavaKeyStore` when trust anchors are maintained in JKS-style storage.

**System CA root control**

Choose whether Chilkat should also trust the operating system's CA root certificates.

**Self-signed certificate policy**

Control whether self-signed server certificates are rejected or accepted during certificate validation.

**Activate Chilkat-wide trust**

Activate the configured trusted-root set so it is used by Chilkat classes that perform TLS or signature certificate validation.

**Common pattern:** Create a `TrustedRoots` object, add trusted certificates or load a PEM CA bundle, configure whether system roots and self-signed certificates should be trusted, then call `Activate`. Treat trusted roots as Chilkat-wide validation configuration, not as private state for a single object.

For an extended overview, see [TrustedRoots Class Overview](https://www.chilkatsoft.com/trustedroots_class_overview.asp).

## Object creation, unlocking and error handling

**Object Creation**

```xojo
Dim trustedRoots As New Chilkat.TrustedRoots
```

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Xojo.

How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `DebugLogFilePath As String` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `LastErrorHtml As String (read-only)` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `LastErrorText As String (read-only)` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `LastErrorXml As String (read-only)` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `LastMethodSuccess As Boolean` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. |
| `VerboseLogging` | `VerboseLogging As Boolean` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `Version As String (read-only)` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `NumCerts` | property, read-only | `NumCerts As Int32 (read-only)` |
| `RejectSelfSignedCerts` | property, read/write | `RejectSelfSignedCerts As Boolean` |
| `TrustSystemCaRoots` | property, read/write | `TrustSystemCaRoots As Boolean` |
| `Activate` | method | `Function Activate() As Boolean` |
| `AddCert` | method | `Function AddCert(cert As Chilkat.Cert) As Boolean` |
| `AddJavaKeyStore` | method | `Function AddJavaKeyStore(keystore As Chilkat.JavaKeyStore) As Boolean` |
| `CertAt` | method | `Function CertAt(index As Int32, cert As Chilkat.Cert) As Boolean` |
| `Deactivate` | method | `Function Deactivate() As Boolean` |
| `LoadCaCertsPem` | method | `Function LoadCaCertsPem(path As String) As Boolean` |
| `LoadTaskCaller` | method | `Function LoadTaskCaller(task As Chilkat.Task) As Boolean` |

Deprecated members are listed at the end of this file with their replacements; do not use them in new code.

## Properties

### TrustedRoots.NumCerts

`Chilkat 11.7.0 · xojo · TrustedRoots · NumCerts · property · read-only · since 9.5.0.38`

```xojo
NumCerts As Int32 (read-only)
```

The number of certificates explicitly contained in this object. The count includes certificates added by `AddCert`, `AddJavaKeyStore`, and `LoadCaCertsPem`.

Use indexes from `0` through `NumCerts - 1` with `CertAt`.

**Scope of the count:** This property does not include operating-system CA roots made available by `TrustSystemCaRoots`. It reports only the certificates stored in this object.

### TrustedRoots.RejectSelfSignedCerts

`Chilkat 11.7.0 · xojo · TrustedRoots · RejectSelfSignedCerts · property · read/write · since 9.5.0.80`

```xojo
RejectSelfSignedCerts As Boolean
```

Controls the special case in which an SSL/TLS server presents a certificate chain containing exactly one certificate and that certificate is self-signed. The default value is `False`.

| Value | Behavior |
| :--- | :--- |
| `False` | Do not reject a one-certificate TLS chain solely because the certificate is self-signed. |
| `True` | Reject TLS server chains consisting of one self-signed certificate. |

This property applies to the TLS server-certificate case described above. It does not reject a self-signed CA certificate merely because that certificate appears as the trust anchor above a longer chain.

**Security guidance:** A self-signed certificate has no external issuer establishing trust. Accept it only when the certificate or its public-key fingerprint has been authenticated through a separate trusted channel.

### TrustedRoots.TrustSystemCaRoots

`Chilkat 11.7.0 · xojo · TrustedRoots · TrustSystemCaRoots · property · read/write · since 9.5.0.41`

```xojo
TrustSystemCaRoots As Boolean
```

Controls whether operating-system CA roots are included when this object's trust configuration is activated. The default value is `True`.

| Value | Behavior |
| :--- | :--- |
| `True` | Trust explicitly added certificates and the system-provided CA roots available to Chilkat. |
| `False` | Do not automatically trust system-provided CA roots; use the explicitly configured collection and the selected self-signed-certificate policy. |

On Windows, system roots come from registry-based certificate stores. On Linux, Chilkat may use a system CA bundle such as `/etc/ssl/certs/ca-certificates.crt` when available.

System roots are not added to this object's explicit collection and therefore are not included in `NumCerts` or returned by `CertAt`.

## Methods

### TrustedRoots.Activate

`Chilkat 11.7.0 · xojo · TrustedRoots · Activate · method · since 9.5.0.38`

```xojo
Function Activate() As Boolean
```

Activates this object's trust configuration for Chilkat-wide certificate validation. The active configuration includes:

- Certificates explicitly added to this object by `AddCert`, `AddJavaKeyStore`, or `LoadCaCertsPem`.
- Operating-system CA roots when `TrustSystemCaRoots` is `True`.
- The self-signed TLS certificate policy selected by `RejectSelfSignedCerts`.

After activation, Chilkat classes that validate PKCS7/CMS signatures or SSL/TLS server certificate chains use this trust configuration. Returns `True` if the configuration was activated successfully; otherwise returns `False`.

**Trust-anchor note:** Activating a certificate as trusted supplies a starting point for certificate-path validation. It does not, by itself, prove that every certificate issued beneath that anchor is valid for every purpose; the applicable validation operation may also evaluate signatures, validity periods, identity, key usage, constraints, and other policy requirements.

Returns True for success, False for failure.

### TrustedRoots.AddCert

`Chilkat 11.7.0 · xojo · TrustedRoots · AddCert · method · since 9.5.0.41`

```xojo
Function AddCert(cert As Chilkat.Cert) As Boolean
```

Adds the certificate in `cert` to this object's explicit trusted-certificate collection. The certificate is subsequently treated as a trust anchor when this configuration is activated.

Returns `True` if the certificate was added successfully; otherwise returns `False`.

**Security-sensitive operation:** Calling this method is an explicit trust decision. It does not first determine whether the certificate is self-signed, belongs to a public CA, is currently valid, or is appropriate for the intended application. Add only certificates obtained and verified through a trustworthy process.

Returns True for success, False for failure.

### TrustedRoots.AddJavaKeyStore

`Chilkat 11.7.0 · xojo · TrustedRoots · AddJavaKeyStore · method · since 9.5.0.44`

```xojo
Function AddJavaKeyStore(keystore As Chilkat.JavaKeyStore) As Boolean
```

Adds the certificates designated as trusted entries in the `keystore` `JavaKeyStore` to this object's explicit trusted-certificate collection.

Private keys and secret keys are not imported. Returns `True` if the trusted certificates were added successfully; otherwise returns `False`.

**Java keystore terminology:** A trusted-certificate entry represents a certificate that the keystore owner has chosen to trust. Importing it preserves that trust decision; it does not independently validate the certificate or build a certification path for it.

Returns True for success, False for failure.

Async variant: `AddJavaKeyStoreAsync` — same arguments, returns a `Task` (see Async variants below).

### TrustedRoots.CertAt

`Chilkat 11.7.0 · xojo · TrustedRoots · CertAt · method · since 11.0.0`

```xojo
Function CertAt(index As Int32, cert As Chilkat.Cert) As Boolean
```

Copies the certificate at zero-based `index` into the caller-supplied `Cert` object in `cert`.

Valid indexes are from `0` through `NumCerts - 1`. Returns `True` if the certificate was retrieved successfully; otherwise returns `False`, such as when the index is outside the valid range.

This method enumerates only certificates explicitly contained in this `TrustedRoots` object. Operating-system roots enabled through `TrustSystemCaRoots` are not included.

Returns True for success, False for failure.

### TrustedRoots.Deactivate

`Chilkat 11.7.0 · xojo · TrustedRoots · Deactivate · method · since 9.5.0.40`

```xojo
Function Deactivate() As Boolean
```

Deactivates the previously activated Chilkat-wide trusted-root configuration. After deactivation, roots and single-certificate self-signed certificates are implicitly trusted.

Returns `True` if the active configuration was deactivated successfully; otherwise returns `False`.

**Security warning:** This is a permissive mode. It does not merely restore a conventional “trust the operating-system CA store” policy. Use `Deactivate` only when implicitly trusting arbitrary roots and self-signed certificates is intentional and acceptable for the application.

Returns True for success, False for failure.

### TrustedRoots.LoadCaCertsPem

`Chilkat 11.7.0 · xojo · TrustedRoots · LoadCaCertsPem · method · since 9.5.0.38`

```xojo
Function LoadCaCertsPem(path As String) As Boolean
```

Loads one or more PEM-encoded certificates from the file at `path` and adds them to this object's explicit trusted-certificate collection. A CA bundle normally contains consecutive `-----BEGIN CERTIFICATE-----` / `-----END CERTIFICATE-----` blocks.

This method can load a curated application bundle, a Mozilla-derived CA bundle, or a platform bundle such as `/etc/ssl/certs/ca-certificates.crt` when that file exists. Returns `True` if the bundle was loaded successfully; otherwise returns `False`.

**Trust implication:** Certificates loaded by this method are treated as trusted anchors after activation. The file is not merely a source of intermediate certificates. Review and protect the bundle as security-sensitive configuration.

Returns True for success, False for failure.

Async variant: `LoadCaCertsPemAsync` — same arguments, returns a `Task` (see Async variants below).

### TrustedRoots.LoadTaskCaller

`Chilkat 11.7.0 · xojo · TrustedRoots · LoadTaskCaller · method · since 9.5.0.80`

```xojo
Function LoadTaskCaller(task As Chilkat.Task) As Boolean
```

Associates `task` with the object that initiated the task's asynchronous method call. This supports Chilkat's asynchronous task infrastructure and is not normally called directly by application code.

Returns `True` if the task caller was loaded successfully; otherwise returns `False`.

Returns True for success, False for failure.

## Events and callbacks

In Xojo, Chilkat events are handled by subclassing. Add a new class to your project that inherits from Chilkat.TrustedRoots, then override the event methods you want to respond to. Any method you don't override keeps its default do-nothing behavior, so you only need to write the ones you actually care about.

From that point on, create and use an instance of your subclass wherever you would have used a Chilkat.TrustedRoots. The events fire on your instance automatically as the object does its work.

**For example:**

```vb
class MyTrustedRoots
    Inherits Chilkat.TrustedRoots

    Function AbortCheck() As Boolean
    Function PercentDone(pctDone As Int32) As Boolean
    Sub ProgressInfo(name As String, value As String)
    Sub TaskCompleted(task As Chilkat.Task)

End Class
```

### TrustedRoots.AbortCheck (event)

`Chilkat 11.7.0 · xojo · TrustedRoots · AbortCheck · event`

```xojo
Function AbortCheck() As Boolean
```

Enables a method call to be aborted by triggering the AbortCheck event at intervals defined by the `HeartbeatMs` property. If HeartbeatMs is set to its default value of 0, no events will occur. For instance, set HeartbeatMs to 200 to trigger 5 AbortCheck events per second.

### TrustedRoots.PercentDone (event)

`Chilkat 11.7.0 · xojo · TrustedRoots · PercentDone · event`

```xojo
Function PercentDone(pctDone As Int32) As Boolean
```

This provides the percentage completion for any method involving network communications or time-consuming processing, assuming the progress can be measured as a percentage. This event is triggered only when it's possible and logical to express the operation's progress as a percentage. The `pctDone` argument will range from 1 to 100. For methods that finish quickly, the number of PercentDone callbacks may vary, but the final callback will have `pctDone` equal to 100. For longer operations, callbacks will not exceed one per percentage point (e.g., 1, 2, 3, ..., 98, 99, 100).

The PercentDone callback also acts as an `AbortCheck` event. For fast methods where PercentDone fires, an AbortCheck event may not trigger since the PercentDone callback already provides an opportunity to abort. For longer operations, where time between PercentDone callbacks is extended, AbortCheck callbacks enable more responsive operation termination.

To abort the operation, set the `abort` output argument to `True`. This will cause the method to terminate and return a failure status or corresponding failure value.

### TrustedRoots.ProgressInfo (event)

`Chilkat 11.7.0 · xojo · TrustedRoots · ProgressInfo · event`

```xojo
Sub ProgressInfo(name As String, value As String)
```

This event callback provides `tag name`/value pairs that detail what occurs during a method call. To discover existing tag names, create code to handle the event, emit the pairs, and review them. Most tag names are self-explanatory.

Note: Some Chilkat methods don't fire any ProgressInfo events.

### TrustedRoots.TaskCompleted (event)

`Chilkat 11.7.0 · xojo · TrustedRoots · TaskCompleted · event`

```xojo
Sub TaskCompleted(task As Chilkat.Task)
```

Called from the background thread when an asynchronous task completes.

## Async variants

Each returns a `Task` instead of the result and takes the same arguments as the synchronous method; run the task, wait for `Finished`, then read the result from the task. No new Async methods are added from 11.7.0 on.

```xojo
Function AddJavaKeyStoreAsync(keystore As Chilkat.JavaKeyStore) As Chilkat.Task
Function LoadCaCertsPemAsync(path As String) As Chilkat.Task
```

## Deprecated members — do not use in new code

| Member | Kind | Deprecated in | Use instead |
|---|---|---|---|
| `GetCert` | method | before 11.6.1 | `CertAt` |

## Related classes

[`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/xojo/classes/Cert.md), [`JavaKeyStore`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/xojo/classes/JavaKeyStore.md), [`Task`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/xojo/classes/Task.md)