// CkPfxW.h: interface for the CkPfxW class.
//
//////////////////////////////////////////////////////////////////////

// This header is generated for Chilkat 11.3.0

#ifndef _CkPfxW_H
#define _CkPfxW_H
	
#include "chilkatDefs.h"
#include "CkString.h"
#include "CkWideCharBase.h"

class CkCertW;
class CkPrivateKeyW;
class CkCertChainW;
class CkJsonObjectW;
class CkBinDataW;
class CkByteData;
class CkJavaKeyStoreW;
class CkXmlCertVaultW;



#if !defined(__sun__) && !defined(__sun)
#pragma pack (push, 8)
#endif
 

// CLASS: CkPfxW
class CK_VISIBLE_PUBLIC CkPfxW  : public CkWideCharBase
{
	

	private:
	
	// Don't allow assignment or copying these objects.
	CkPfxW(const CkPfxW &);
	CkPfxW &operator=(const CkPfxW &);

    public:
	CkPfxW(void);
	virtual ~CkPfxW(void);

	

	static CkPfxW *createNew(void);
	

	
	void CK_VISIBLE_PRIVATE inject(void *impl);

	// May be called when finished with the object to free/dispose of any
	// internal resources held by the object. 
	void dispose(void);

	

	// BEGIN PUBLIC INTERFACE

	// ----------------------
	// Properties
	// ----------------------
	// The encryption algorithm to be used when writing a PFX. After loading a PFX,
	// this property is set to the encryption algorithm used by the loaded PFX. (This
	// is the algorithm used for the shrouded key bag , which is internal to the PFX.)
	// 
	// The default value (for backward compatibility) is
	// pbeWithSHAAnd3_KeyTripleDES_CBC . Can be set to pbes2 , in which case the
	// Pbes2CryptAlg and Pbes2HmacAlg properies will be set to the algorithms to be
	// used when writing, or the algorithms used by the loaded PFX.
	// 
	void get_AlgorithmId(CkString &str);
	// The encryption algorithm to be used when writing a PFX. After loading a PFX,
	// this property is set to the encryption algorithm used by the loaded PFX. (This
	// is the algorithm used for the shrouded key bag , which is internal to the PFX.)
	// 
	// The default value (for backward compatibility) is
	// pbeWithSHAAnd3_KeyTripleDES_CBC . Can be set to pbes2 , in which case the
	// Pbes2CryptAlg and Pbes2HmacAlg properies will be set to the algorithms to be
	// used when writing, or the algorithms used by the loaded PFX.
	// 
	const wchar_t *algorithmId(void);
	// The encryption algorithm to be used when writing a PFX. After loading a PFX,
	// this property is set to the encryption algorithm used by the loaded PFX. (This
	// is the algorithm used for the shrouded key bag , which is internal to the PFX.)
	// 
	// The default value (for backward compatibility) is
	// pbeWithSHAAnd3_KeyTripleDES_CBC . Can be set to pbes2 , in which case the
	// Pbes2CryptAlg and Pbes2HmacAlg properies will be set to the algorithms to be
	// used when writing, or the algorithms used by the loaded PFX.
	// 
	void put_AlgorithmId(const wchar_t *newVal);

	// The number of certificates contained in the PFX.
	int get_NumCerts(void);

	// The number of private keys contained in the PFX.
	int get_NumPrivateKeys(void);

	// If the AlgorithmId property equals pbes2 , then this is the encryption algorithm
	// to be used when writing the PFX, or used by the PFX that was loaded. If the
	// AlgorithmId is not equal to pbes2 , then the value of this property is
	// meaningless.
	// 
	// Possible values are:
	//     * aes256-cbc
	//     * aes192-cbc
	//     * aes128-cbc
	//     * 3des-cbc
	// 
	// The default value (for writing) is aes256-cbc . Note: The algorithm specified by
	// this property is only used when the Algorithmid = pbes2 .
	// 
	void get_Pbes2CryptAlg(CkString &str);
	// If the AlgorithmId property equals pbes2 , then this is the encryption algorithm
	// to be used when writing the PFX, or used by the PFX that was loaded. If the
	// AlgorithmId is not equal to pbes2 , then the value of this property is
	// meaningless.
	// 
	// Possible values are:
	//     * aes256-cbc
	//     * aes192-cbc
	//     * aes128-cbc
	//     * 3des-cbc
	// 
	// The default value (for writing) is aes256-cbc . Note: The algorithm specified by
	// this property is only used when the Algorithmid = pbes2 .
	// 
	const wchar_t *pbes2CryptAlg(void);
	// If the AlgorithmId property equals pbes2 , then this is the encryption algorithm
	// to be used when writing the PFX, or used by the PFX that was loaded. If the
	// AlgorithmId is not equal to pbes2 , then the value of this property is
	// meaningless.
	// 
	// Possible values are:
	//     * aes256-cbc
	//     * aes192-cbc
	//     * aes128-cbc
	//     * 3des-cbc
	// 
	// The default value (for writing) is aes256-cbc . Note: The algorithm specified by
	// this property is only used when the Algorithmid = pbes2 .
	// 
	void put_Pbes2CryptAlg(const wchar_t *newVal);

	// If the AlgorithmId property equals pbes2 , then this is the HMAC hash algorithm
	// to be used when writing the PFX, or used by the PFX that was loaded. If the
	// AlgorithmId is not equal to pbes2 , then the value of this property is
	// meaningless.
	// 
	// Possible values are:
	//     * hmacWithSha256
	//     * hmacWithSha384
	//     * hmacWithSha512
	//     * hmacWithSha1
	// 
	// The default value (for writing) is hmacWithSha256 . Note: The algorithm
	// specified by this property is only used when the Algorithmid = pbes2 .
	// 
	void get_Pbes2HmacAlg(CkString &str);
	// If the AlgorithmId property equals pbes2 , then this is the HMAC hash algorithm
	// to be used when writing the PFX, or used by the PFX that was loaded. If the
	// AlgorithmId is not equal to pbes2 , then the value of this property is
	// meaningless.
	// 
	// Possible values are:
	//     * hmacWithSha256
	//     * hmacWithSha384
	//     * hmacWithSha512
	//     * hmacWithSha1
	// 
	// The default value (for writing) is hmacWithSha256 . Note: The algorithm
	// specified by this property is only used when the Algorithmid = pbes2 .
	// 
	const wchar_t *pbes2HmacAlg(void);
	// If the AlgorithmId property equals pbes2 , then this is the HMAC hash algorithm
	// to be used when writing the PFX, or used by the PFX that was loaded. If the
	// AlgorithmId is not equal to pbes2 , then the value of this property is
	// meaningless.
	// 
	// Possible values are:
	//     * hmacWithSha256
	//     * hmacWithSha384
	//     * hmacWithSha512
	//     * hmacWithSha1
	// 
	// The default value (for writing) is hmacWithSha256 . Note: The algorithm
	// specified by this property is only used when the Algorithmid = pbes2 .
	// 
	void put_Pbes2HmacAlg(const wchar_t *newVal);

	// This is a catch-all property to be used for uncommon needs. This property
	// defaults to the empty string and should typically remain empty.
	// 
	// Can be set to a list of the following comma separated keywords:
	//     * LegacyOrder - Introduced in v9.5.0.83. Write the internal ContentInfos in
	//     the order Chilkat traditionally used in previous versions.
	//     * NoTruncatePfxPassword64 - Introduced in v9.5.0.87. Microsoft systems/tools
	//     such as certmgr.msc would typically truncate extremely long passwords to 64
	//     bytes/chars. Other systems did not. Chilkat will by default truncate passwords
	//     to 64 chars. Add this keyword to prevent truncation.
	// 
	void get_UncommonOptions(CkString &str);
	// This is a catch-all property to be used for uncommon needs. This property
	// defaults to the empty string and should typically remain empty.
	// 
	// Can be set to a list of the following comma separated keywords:
	//     * LegacyOrder - Introduced in v9.5.0.83. Write the internal ContentInfos in
	//     the order Chilkat traditionally used in previous versions.
	//     * NoTruncatePfxPassword64 - Introduced in v9.5.0.87. Microsoft systems/tools
	//     such as certmgr.msc would typically truncate extremely long passwords to 64
	//     bytes/chars. Other systems did not. Chilkat will by default truncate passwords
	//     to 64 chars. Add this keyword to prevent truncation.
	// 
	const wchar_t *uncommonOptions(void);
	// This is a catch-all property to be used for uncommon needs. This property
	// defaults to the empty string and should typically remain empty.
	// 
	// Can be set to a list of the following comma separated keywords:
	//     * LegacyOrder - Introduced in v9.5.0.83. Write the internal ContentInfos in
	//     the order Chilkat traditionally used in previous versions.
	//     * NoTruncatePfxPassword64 - Introduced in v9.5.0.87. Microsoft systems/tools
	//     such as certmgr.msc would typically truncate extremely long passwords to 64
	//     bytes/chars. Other systems did not. Chilkat will by default truncate passwords
	//     to 64 chars. Add this keyword to prevent truncation.
	// 
	void put_UncommonOptions(const wchar_t *newVal);



	// ----------------------
	// Methods
	// ----------------------
	// Adds a certificate, its private key (if it exists), and potentially its
	// certificate chain to the PFX. If includeChain is true, then the certificate must have
	// a private key. The certificate's private key is automatically obtained
	// (internally) via the cert's ExportPrivateKey method. If the certificate's chain
	// of authentication is to be added, it is automatically constructed and added
	// using whatever resources are at hand (such as certs provided via the
	// UseCertVault method, the trusted roots from Chilkat's TrustedRoots class, etc.
	// If a certificate chain is to be added, which is the typical case, then the chain
	// must be completed to the root to succeed.
	bool AddCert(CkCertW &cert, bool includeChain);

	// Adds a private key and certificate chain to the PFX. The private key should be
	// such that it is associated with the 1st certificate in the chain. In other
	// words, the 1st certificate in the chain has a public key (embedded within the
	// X.509 structure of the cert itself) that is the counterpart to the private key.
	bool AddPrivateKey(CkPrivateKeyW &privKey, CkCertChainW &certChain);

	// Returns in cert the Nth certificate in the PFX. The 1st certificate is at index
	// 0.
	bool CertAt(int index, CkCertW &cert);

	// Finds and returns the certificate to cert that has a cert bag localKeyId attribute
	// with the specified value. The localKeyId is specified using the encoding such as decimal ,
	// base64 , hex .
	bool CertByLocalKeyId(const wchar_t *localKeyId, const wchar_t *encoding, CkCertW &cert);

	// This method is deprecated. Applications should instead call CertByLocalKeyId .
	// 
	// Finds and returns the certificate (in the PFX) that has a cert bag localKeyId
	// attribute with the specified value. The localKeyId is specifid using the encoding
	// (such as decimal , base64 , hex ) specified by encoding.
	// 
	// The caller is responsible for deleting the object returned by this method.
	CkCertW *FindCertByLocalKeyId(const wchar_t *localKeyId, const wchar_t *encoding);

	// This method is deprecated. Applications should instead call CertAt .
	// 
	// Returns the Nth certificate in the PFX. (The 1st certificate is at index 0.)
	// 
	// The caller is responsible for deleting the object returned by this method.
	CkCertW *GetCert(int index);

	// Provides information about what happened in the last method called.
	void GetLastJsonData(CkJsonObjectW &json);

	// This method is deprecated. Applications should instead call PrivateKeyAt .
	// 
	// Returns the Nth private key in the PFX. (The 1st private key is at index 0.)
	// 
	// The caller is responsible for deleting the object returned by this method.
	CkPrivateKeyW *GetPrivateKey(int index);

	// Can be called to get one of the following safebag attributes for the Nth private
	// key or certificate in the PFX. forPrivateKey should be true for a private key, and
	// false for a certificate. The index is the index of the certificate or key in
	// the PFX. The attrName can be one of the following:
	// 
	//     * localKeyId : Returns the decimal representation of the local key ID. The
	//     local key ID is used to associate the certificate contained in the PFX with this
	//     private key. (The certificate will include a localKeyId attribute in its
	//     cert bag of attributes within the PFX.)
	//     * keyContainerName : Returns the key container name (or key name) of the
	//     private key. For more information about the directories where the Windows OS
	//     stores private keys, see
	//     https://docs.microsoft.com/en-us/windows/win32/seccng/key-storage-and-retrieval
	//     * storageProvider : Returns the name of the Cryptographic Storage Provider
	//     to be used for the key.
	// 
	// Note: It is not required that any of the above attributes are present in the
	// PFX.
	// 
	// 
	// References:
	// 1: https://docs.microsoft.com/en-us/windows/win32/seccng/key-storage-and-retrieval
	bool GetSafeBagAttr(bool forPrivateKey, int index, const wchar_t *attrName, CkString &outStr);
	// Can be called to get one of the following safebag attributes for the Nth private
	// key or certificate in the PFX. forPrivateKey should be true for a private key, and
	// false for a certificate. The index is the index of the certificate or key in
	// the PFX. The attrName can be one of the following:
	// 
	//     * localKeyId : Returns the decimal representation of the local key ID. The
	//     local key ID is used to associate the certificate contained in the PFX with this
	//     private key. (The certificate will include a localKeyId attribute in its
	//     cert bag of attributes within the PFX.)
	//     * keyContainerName : Returns the key container name (or key name) of the
	//     private key. For more information about the directories where the Windows OS
	//     stores private keys, see
	//     https://docs.microsoft.com/en-us/windows/win32/seccng/key-storage-and-retrieval
	//     * storageProvider : Returns the name of the Cryptographic Storage Provider
	//     to be used for the key.
	// 
	// Note: It is not required that any of the above attributes are present in the
	// PFX.
	// 
	// 
	// References:
	// 1: https://docs.microsoft.com/en-us/windows/win32/seccng/key-storage-and-retrieval
	const wchar_t *getSafeBagAttr(bool forPrivateKey, int index, const wchar_t *attrName);
	// Can be called to get one of the following safebag attributes for the Nth private
	// key or certificate in the PFX. forPrivateKey should be true for a private key, and
	// false for a certificate. The index is the index of the certificate or key in
	// the PFX. The attrName can be one of the following:
	// 
	//     * localKeyId : Returns the decimal representation of the local key ID. The
	//     local key ID is used to associate the certificate contained in the PFX with this
	//     private key. (The certificate will include a localKeyId attribute in its
	//     cert bag of attributes within the PFX.)
	//     * keyContainerName : Returns the key container name (or key name) of the
	//     private key. For more information about the directories where the Windows OS
	//     stores private keys, see
	//     https://docs.microsoft.com/en-us/windows/win32/seccng/key-storage-and-retrieval
	//     * storageProvider : Returns the name of the Cryptographic Storage Provider
	//     to be used for the key.
	// 
	// Note: It is not required that any of the above attributes are present in the
	// PFX.
	// 
	// 
	// References:
	// 1: https://docs.microsoft.com/en-us/windows/win32/seccng/key-storage-and-retrieval
	const wchar_t *safeBagAttr(bool forPrivateKey, int index, const wchar_t *attrName);

	// Imports the certificates and private keys contained in the PFX to the MacOS/iOS
	// keychain.
	bool ImportToKeychain(CkJsonObjectW &opts);

	// Imports the certificates and private keys contained in the PFX to Windows
	// certificate store(s).
	// 
	// If exportable is true, imported keys are marked as exportable.
	// 
	// If userProtected is true, the user is to be notified through a dialog box or other
	// method when certain attempts to use this key are made. The precise behavior is
	// specified by the cryptographic service provider (CSP) being used.
	// 
	// If machineKeyset is true, the private keys are stored under the local computer and not
	// under the current user.
	// 
	// If allowOverwriteKey is true, allow overwrite of the existing key. Specify this flag when
	// you encounter a scenario in which you must import a PFX file that contains a key
	// name that already exists. For example, when you import a PFX file, it is
	// possible that a container of the same name is already present because there is
	// no unique namespace for key containers. If you have created a TestKey on your
	// computer, and then you import a PFX file that also has TestKey as the key
	// container, this flag allows the key to be overwritten.
	// 
	// if allowExport is true, then the key is marked as exportable, which allows for it to
	// be re-exported to a PFX.
	// 
	// The leafStore, intermediateStore, and rootStore are the Windows certificate store names indicating
	// where to import certificates of each given type. A leafStore is a certificate that is
	// not the issuer of any other certificate in the PFX. An intermediateStore is any certificate
	// that is not a root (or self-signed) but is also the issuer of some other
	// certificate in the PFX. A rootStore is a self-signed or root certificate.
	// 
	// The possible store names for leafStore, intermediateStore, and rootStore are as follows:
	//     * None : Do not import certificates of the given type into any Windows
	//     certicate store.
	//     * AddressBook : Certificate store for other users.
	//     * AuthRoot : Certificate store for third-party certification authorities
	//     (CAs).
	//     * CertificationAuthority : Certificate store for intermediate certification
	//     authorities (CAs).
	//     * My : Certificate store for personal certificates. (Leaf certificates are
	//     typically imported into this store.)
	//     * Root : Certificate store for trusted root certification authorities (CAs).
	//     * TrustedPeople : Certificate store for directly trusted people and
	//     resources.
	//     * TrustedPublisher : Certificate store for directly trusted publishers.
	// 
	// The rootStore is reserved for any future options that may be needed. At this time,
	// pass an empty string.
	// 
	bool ImportToWindows(bool exportable, bool userProtected, bool machineKeyset, bool allowOverwriteKey, bool allowExport, const wchar_t *leafStore, const wchar_t *intermediateStore, const wchar_t *rootStore, const wchar_t *extraOptions);

	// This method is deprecated. Call GetLastJsonData instead.
	// 
	// Provides information about what happened in the last method called.
	// 
	// The caller is responsible for deleting the object returned by this method.
	CkJsonObjectW *LastJsonData(void);

	// Loads a PFX from a PEM formatted string. The PEM can contain the private key,
	// the certificate, and certificates in the chain of authentication up to the CA
	// root. For example: -----BEGIN RSA PRIVATE KEY-----
	// ...
	// ... the private key associated with the main certificate.
	// ...
	// -----END RSA PRIVATE KEY-----
	// -----BEGIN CERTIFICATE-----
	// ...
	// ... the main certificate
	// ...
	// -----END CERTIFICATE-----
	// -----BEGIN CERTIFICATE-----
	// ...
	// ... an intermediate CA certificate (if present)
	// ...
	// -----END CERTIFICATE-----
	// -----BEGIN CERTIFICATE-----
	// ...
	// ... the root CA certificate
	// ...
	// -----END CERTIFICATE----- 
	bool LoadPem(const wchar_t *pemStr, const wchar_t *password);

	// Loads a PFX from the contents of bd.
	// 
	// If the .pfx/.p12 uses different passwords for integrity and private keys, then
	// the password argument may contain JSON to specify the passwords. See the LoadPfxFile
	// method (below) for details.
	// 
	bool LoadPfxBd(CkBinDataW &bd, const wchar_t *password);

	// Loads a PFX from in-memory bytes.
	// 
	// If the .pfx/.p12 uses different passwords for integrity and private keys, then
	// the password argument may contain JSON to specify the passwords. See the LoadPfxFile
	// method (below) for details.
	// 
	bool LoadPfxBytes(CkByteData &pfxData, const wchar_t *password);

	// Loads a PFX from encoded byte data. The encoding can by any encoding, such as Base64
	// , modBase64 , Base32 , UU , QP (for quoted-printable), URL (for url-encoding),
	// Hex , Q , B , url_oath , url_rfc1738 , url_rfc2396 , and url_rfc3986 .
	// 
	// If the .pfx/.p12 uses different passwords for integrity and private keys, then
	// the encoding argument may contain JSON to specify the passwords. See the LoadPfxFile
	// method (below) for details.
	// 
	bool LoadPfxEncoded(const wchar_t *encodedData, const wchar_t *encoding, const wchar_t *password);

	// Loads a PFX from a file.
	// 
	// Starting in v9.5.0.75, a .pfx/.p12 file with different passwords for integrity
	// and private keys can be loaded by passing the following JSON for the password.    {
	//       "integrity": "password1",
	//       "privKeys": "password2",
	//      }
	// If it is desired to open the .pfx/.p12 without access to the private keys, then
	// add skipPrivateKeys like this:    {
	//       "integrity": "password1",
	//       "privKeys": "not used",
	//        "skipPrivateKeys": true
	//      }
	// 
	bool LoadPfxFile(const wchar_t *path, const wchar_t *password);

	// Returns the Nth private key in privKey. (The 1st private key is at index 0.)
	bool PrivateKeyAt(int index, CkPrivateKeyW &privKey);

	// Sets a safe bag attribute for the Nth private key or certificate in the PFX.
	// Safe bag attributes can be added by calling this method once for each attribute
	// to be added to each certificate or key. forPrivateKey should be true for a private key,
	// and false for a certificate. The index is the index of the certificate or key
	// in the PFX. (The 1st item is at index 0.) See the example below for more
	// information. The encoding indicates a binary encoding such as base64 , hex , decimal
	// , fingerprint , etc if the value contains binary (non-text) data.
	// 
	// A safe bag attribute can be removed by passing an empty string for the value.
	// 
	bool SetSafeBagAttr(bool forPrivateKey, int index, const wchar_t *name, const wchar_t *value, const wchar_t *encoding);

	// Write the PFX to bd.
	bool ToBd(const wchar_t *password, CkBinDataW &bd);

	// Write the PFX to in-memory bytes.
	bool ToBinary(const wchar_t *password, CkByteData &outBytes);

	// Write the PFX to an encoded string. The encoding can be any encoding such as base64
	// or hex .
	bool ToEncodedString(const wchar_t *password, const wchar_t *encoding, CkString &outStr);
	// Write the PFX to an encoded string. The encoding can be any encoding such as base64
	// or hex .
	const wchar_t *toEncodedString(const wchar_t *password, const wchar_t *encoding);

	// Write the PFX to a file. PFX and PKCS12 are essentially the same. Standard
	// filename extensions are .pfx or .p12 .
	bool ToFile(const wchar_t *password, const wchar_t *path);

	// Applications should instead call ToJksObj .
	// 
	// Converts the PFX (PKCS12) to a JavaKeyStore object. One JKS entry per private
	// key found in the PKCS12 is added. The certs found within the PCKS12 are used to
	// build the certificate chains for each private key. (A typical PFX file contains
	// a single private key along with its associated certificate, and the certificates
	// in the chain of authentication to the root CA cert.)
	// 
	// The specified alias is applied to the 1st private key found. If the alias is
	// empty, then the alias is obtained from the cert/PFX in the following order of
	// preference:
	//     1. Certificate's subject common name
	//     2. Certificate's subject email address
	//     3. Certificate's friendly name found in the PKCS9 attributes of the PKCS12
	//     4. Certificate's serial number
	// 
	// If multiple private keys are found in the PKCS12, then all but the first will
	// automaticallly be assigned aliases using the preference just described.
	// 
	// The caller is responsible for deleting the object returned by this method.
	CkJavaKeyStoreW *ToJavaKeyStore(const wchar_t *alias, const wchar_t *password);

	// Converts this object to a Java KeyStore (JKS) object in jksObj, creating one JKS
	// entry for each private key found in the PFX. Certificates within the PFX are
	// used to construct certificate chains for each private key. Typically, a PFX file
	// contains a single private key along with its associated certificate and the
	// certificates in its chain up to the root CA. The specified alias is assigned to
	// the first private key. If no alias is provided, it is derived from the
	// certificate/PFX using the following preferences, in order:
	//     1. Certificate's subject common name
	//     2. Certificate's subject email address
	//     3. Certificate's friendly name found in the PKCS9 attributes
	//     4. Certificate's serial number
	// 
	// If the PFX contains multiple private keys, aliases for all keys except the first
	// are automatically assigned using the same preference order.
	// 
	bool ToJksObj(const wchar_t *alias, const wchar_t *password, CkJavaKeyStoreW &jksObj);

	// Write the PFX to a PEM formatted string. The resultant PEM will contain the
	// private key, as well as the certs in the chain of authentication (or whatever
	// certs are available in the PFX). For example: -----BEGIN RSA PRIVATE KEY-----
	// ...
	// ... the private key associated with the main certificate.
	// ...
	// -----END RSA PRIVATE KEY-----
	// -----BEGIN CERTIFICATE-----
	// ...
	// ... the main certificate
	// ...
	// -----END CERTIFICATE-----
	// -----BEGIN CERTIFICATE-----
	// ...
	// ... an intermediate CA certificate (if present)
	// ...
	// -----END CERTIFICATE-----
	// -----BEGIN CERTIFICATE-----
	// ...
	// ... the root CA certificate
	// ...
	// -----END CERTIFICATE----- 
	bool ToPem(CkString &outStr);
	// Write the PFX to a PEM formatted string. The resultant PEM will contain the
	// private key, as well as the certs in the chain of authentication (or whatever
	// certs are available in the PFX). For example: -----BEGIN RSA PRIVATE KEY-----
	// ...
	// ... the private key associated with the main certificate.
	// ...
	// -----END RSA PRIVATE KEY-----
	// -----BEGIN CERTIFICATE-----
	// ...
	// ... the main certificate
	// ...
	// -----END CERTIFICATE-----
	// -----BEGIN CERTIFICATE-----
	// ...
	// ... an intermediate CA certificate (if present)
	// ...
	// -----END CERTIFICATE-----
	// -----BEGIN CERTIFICATE-----
	// ...
	// ... the root CA certificate
	// ...
	// -----END CERTIFICATE----- 
	const wchar_t *toPem(void);

	// Write the PFX to a PEM formatted string. If extendedAttrs is true, then extended
	// properties (Bag Attributes and Key Attributes) are output. If noKeys is true,
	// then no private keys are output. If noCerts is true, then no certificates are
	// output. If noCaCerts is true, then no CA certs or intermediate CA certs are output.
	// If encryptAlg is not empty, it indicates the encryption algorithm to be used for
	// encrypting the private keys (otherwise the private keys are output unencrypted).
	// The possible choices for the encryptAlg are des3 , aes128 , aes192 , and aes256 . (All
	// encryption algorithm choices use CBC mode.) If the private keys are to be
	// encrypted, then password is the password to be used. Otherwise, password may be left
	// empty. For example:Bag Attributes
	//     Microsoft Local Key set: localKeyID: 01 00 00 00 
	//     friendlyName: le-2b09a3d2-9037-4a05-95cc-4d44518e8607
	//     Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider
	// Key Attributes
	//     X509v3 Key Usage: 10 
	//  -----BEGIN RSA PRIVATE KEY-----
	// ...
	// ... the private key associated with the main certificate.
	// ...
	// -----END RSA PRIVATE KEY-----
	// Bag Attributes
	//     localKeyID: 01 00 00 00 
	//     1.3.6.1.4.1.311.17.3.92: 00 08 00 00 
	//     1.3.6.1.4.1.311.17.3.20: C2 53 54 F3 ...
	//     1.3.6.1.4.1.311.17.3.71: 49 00 43 00 ...
	//     1.3.6.1.4.1.311.17.3.75: 31 00 42 00 ...
	// subject=/OU=Domain Control Validated/OU=PositiveSSL/CN=something.com
	// issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
	// -----BEGIN CERTIFICATE-----
	// ...
	// ... the main certificate
	// ...
	// -----END CERTIFICATE-----
	// ...
	// -----BEGIN CERTIFICATE-----
	// ...
	// ... an intermediate CA certificate (if present)
	// ...
	// -----END CERTIFICATE-----
	// ...
	// -----BEGIN CERTIFICATE-----
	// ...
	// ... the root CA certificate
	// ...
	// -----END CERTIFICATE----- 
	bool ToPemEx(bool extendedAttrs, bool noKeys, bool noCerts, bool noCaCerts, const wchar_t *encryptAlg, const wchar_t *password, CkString &outStr);
	// Write the PFX to a PEM formatted string. If extendedAttrs is true, then extended
	// properties (Bag Attributes and Key Attributes) are output. If noKeys is true,
	// then no private keys are output. If noCerts is true, then no certificates are
	// output. If noCaCerts is true, then no CA certs or intermediate CA certs are output.
	// If encryptAlg is not empty, it indicates the encryption algorithm to be used for
	// encrypting the private keys (otherwise the private keys are output unencrypted).
	// The possible choices for the encryptAlg are des3 , aes128 , aes192 , and aes256 . (All
	// encryption algorithm choices use CBC mode.) If the private keys are to be
	// encrypted, then password is the password to be used. Otherwise, password may be left
	// empty. For example:Bag Attributes
	//     Microsoft Local Key set: localKeyID: 01 00 00 00 
	//     friendlyName: le-2b09a3d2-9037-4a05-95cc-4d44518e8607
	//     Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider
	// Key Attributes
	//     X509v3 Key Usage: 10 
	//  -----BEGIN RSA PRIVATE KEY-----
	// ...
	// ... the private key associated with the main certificate.
	// ...
	// -----END RSA PRIVATE KEY-----
	// Bag Attributes
	//     localKeyID: 01 00 00 00 
	//     1.3.6.1.4.1.311.17.3.92: 00 08 00 00 
	//     1.3.6.1.4.1.311.17.3.20: C2 53 54 F3 ...
	//     1.3.6.1.4.1.311.17.3.71: 49 00 43 00 ...
	//     1.3.6.1.4.1.311.17.3.75: 31 00 42 00 ...
	// subject=/OU=Domain Control Validated/OU=PositiveSSL/CN=something.com
	// issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
	// -----BEGIN CERTIFICATE-----
	// ...
	// ... the main certificate
	// ...
	// -----END CERTIFICATE-----
	// ...
	// -----BEGIN CERTIFICATE-----
	// ...
	// ... an intermediate CA certificate (if present)
	// ...
	// -----END CERTIFICATE-----
	// ...
	// -----BEGIN CERTIFICATE-----
	// ...
	// ... the root CA certificate
	// ...
	// -----END CERTIFICATE----- 
	const wchar_t *toPemEx(bool extendedAttrs, bool noKeys, bool noCerts, bool noCaCerts, const wchar_t *encryptAlg, const wchar_t *password);

	// Adds an XML certificate vault to the object's internal list of sources to be
	// searched for certificates for help in building certificate chains to a root
	// certificate.
	bool UseCertVault(CkXmlCertVaultW &vault);





	// END PUBLIC INTERFACE


};
#if !defined(__sun__) && !defined(__sun)
#pragma pack (pop)
#endif
	
#endif