STARTTLS

[mirko12]

How to implement STARTTLS on server side?
I want to switch to TLS when client sends STARTTLS. I tried everything I could think of, no success.
Can you please help me with this?
Thank you.

[wqweto]

I don't have sample code ready but after accepting the client connection and after negotiating STARTTLS in plain text on the accepted cTlsSocket, try calling InitServerTls on this same cTlsSocket instance.

Will try cobbling an SMTP server emulation that supports STARTTLS for test purposes when time permits.

[wqweto]

Try running Project1.vbp in test/Basic directory and check out SMTP with STARTTLS button if it is working with gmail.com

Then check out the code in Command7_Click handler which calls SyncStartTls method after sending STARTTLS command.

[mirko12]

Thank you. I managed to get STARTTLS working, using BareboneTls from test folder. Now I'm facing another problem - it works fine with PkiGenerSelfSignedCertificate, but then I get certificate error (works with ucsTlsIgnoreServerCertificateErrors). Is there a way to use e.eg. Lets' Encrypt certificate? I tried with ImportPemRootCaCertStore and InitServerTls with .pem certificate, it doesn't throw any error, but then TLS handshake fails. On server side I get Unexpected record type (21) and on the client side Unsupported public key OID (1.2.840.113549.1.1.1).

[wqweto]

You need ImportPemRootCaCertStore only for clients to set additional trust anchors to be used when validating server certs.

Of course you can use Let’s Encrypt and any other CA issued certificate. Just make sure to provide both cert and key and also all intermediary certs in one or more PEM files. Or you can bundle certs + key in a PFX file too.

[mirko12]

That makes sense.

.pfx import doesn't work on Windows XP (PFXImportCertStore returns 0 for Let's Encrypt certicate). It works on Windows 8, but then it fails in handshake: NCryptOpenKey returns -2146893802. On Windows 10 everything works.

So I got everything working now. Thank you for sharing this wonderful code.

[wqweto]

This could be because they issue ECDSA signed certs and XP crypto does not support Elliptic Curves at all. Win8 problem is weird, will have to investigate it here.

Btw, you can bundle cert + key + intermediary in a single PEM file or pass pipe-delimited several filenames for CertFile parameter. It also supports PBES encrypted key files in PEM format through Password parameter.

Edit: NCryptOpenKey error is weird (-2146893802 = NTE_BAD_KEYSET) as this is only called when using certificates from system stores i.e. ones imported using certmgr.msc. Could it be that your PFX contains one or more certifcates but misses the key for the leaf-level certificate?