Angus Robertson

There is a Linux package that allows me to fix non-Windows build issues since I don't have any Apple hardware so not allowed to build for that. But the low level messaging functions are MacOS specific and simply don't work on Linux, so sockets don't work. There is an ICS V9 in SVN which does work on Linux, but so far only socket samples, no protocols yet, needs a lot of work. Angus

ICS is nor currently supported on Linux, only MacOS. A new V9 version plans Linux support, but it is a long way from release. Some of the ICS functions may work on Linux, in OverbyteIcsUtils.pas please note the comment 'Charset conversion functions optionally may use GNU iconv library (LGPL) by explicitly defining conditional "USE_ICONV". Otherwise ICS attempts to use Windows APIs or just dies. Angus

SVN and the overnight zip add new client and server components for the MQTT protocol based on work at https://github.com/pjde/delphi-mqtt updated heavily for SSL support. I notice the original Github repository has been forked over 70 times, so presumably at least that many people were interested in using MQTT, however I'm not sure a person, so while I can see the sample client and server sending data to each other, the new components really need to be tested in a better environment against other clients and servers. Who can help? Also, I used Geoffrey Smith's fork, after discussion in this forum, but wonder if any of the other 70 forks have useful additions? So if you use MQTT, please try and look at this new version, so any changes and improvements can be done in the new month before it released and becomes harder. I deliberately renamed TMQTTParser to TIcsMQTTParser, TMQTTClient to TIcsMQTTClient and TMQTTServer to TIcsMQTTServer to avoid conflicts if the original units are installed, otherwise the new units should be compatible with the original, but with added SSL/TLS if anyone uses that. Angus

The new websocket client component does not have a public or private Timer property, you will need to be more specific. There is FPeriodicTimer but that is internal use. Angus

Looking at the OverbyteIcsHttpRestTst sample, it seems client certificate was never tested since the private key is not loaded, it needs a one line change. Client certificates were originally tested with an older sample. Even with the fix, it would not have worked unless PemTool can see the private key. I'm improving both samples at the moment with more error handling, will be in SVN within a couple of days. Angus

So your real problem is a private key that OpenSSL does not recognise or is for a different certificate. Without seeing the actual files, no-one can help you. That is why I suggested asking your supplier for a bundle file so the files can not get mixed up. You can email them to me, original files not the bundle you created and I'll check. Angus

The ICS SMTP and MailQueue components will send email using Office365, again provided all the permissions are set in Azure. Look at the OverbyteIcsMailQuTst.dpr sample which allows two different SMTP servers to be specified and will retry both multiple times to send email. In Azure, set Supported account types to All Microsoft account users, then in Graph permissions enable all of these (probably too many...); email, Mail.Read, Mail.ReadWrite, Mail.Send, MailboxSettings.Read, offline_access, openid, POP.AccessAsUser.All, profile, SMTP.Send, User.Read REST, SMTP and POP3 should then work with OAuth2. Angus

Almost certainly your REST email problem is down to the complexity and multitude of Azure permission settings. Hard to be specific without knowing the email account type, that must match the permissions. I've tried to explain it as best I can in the 'Google and Microsoft OAuth2 Email Application Accounts' comments in the OverbyteIcsSslHttpOAuth.pas unit, Angus

I used shared memory 20 years ago, but there is no queuing as such. So my later applications use sockets, specifically the ICS IP Log Streaming Component that handles all the connection and retries if lost (when the service stops) with minimal application code and events, with my own simple ASCII protocol on top for different messages. Being TCP, queuing is automatic, buffer sizes permitting. ICS has a sample that illustrates this. Angus

The ICS download page is http://wiki.overbyte.eu/wiki/index.php/ICS_Download The latest is V8.70 which added more features for Office 365 User Authorities. Angus

ICS will open PKCS7 files as well, but they are usually certificates only, no private key. If you have a P12 file, that is the same as PFX, use it as the bundle. The SslCliCert property of the TSslHttpRest component can be loaded with certificate and private key from separate files, with the LoadFromPEMFile() and PrivateKeyLoadFromPemFile() methods, but this is not done in the sample since a bundle is safer, once you have a bundle. The PEM Tool will also open all these files and save a bundle file, look at the Create Certificates tab. There are dozens of fields and buttons because there are so many options, But you just need to specify Cert File, click Load Certificate and it will be displayed in the yellow box, then Prv Key File, click Load Key and it will be displayed, then Inter Certs Fiie, click Load Inters, and you should now see all three components displayed. At the bottom, specify PEM Certs File and PKCS12 Certs File, tick Save Private Key in Cert File and Save Inter Certs, then click Save PEM Cert and save PKCS12 Cert and you will have two new bundles. You don't need anything else, but this tool will also create new certificates, private keys and certificate requests, and sign requests to issue private certificates for LANs. It will also install certificates into the Windows store and display the various stores and read the contents. Angus

If the private key contains a public key that matches the public key first certificate, the tools will say so. If you built the PEM file by hand, it could be failing because you missed a single character somewhere, done that myself. But without the real certificates, this is all guess work. You really should ask the API supplier to provide a proper bundle file, ideally PFX/PKCS12 format (which Windows also prefers) which is harder to corrupt. Angus

Usually the private key is placed after the certificate in the bundle file, otherwise tools would have to look ahead at all certificates in the file. Angus

Not seen five year code signing certificates before, my Sectigo certificate does not expire for another two years and there is nothing to stop me using ir during that time. Once signed, it is not possible to know how it was done, unless Windows keeps a database of intermediates and dates or something. SignMyCode does appear to offer prices very similar or cheaper than K-Software for Sectigo,, but never heard of them before, hope it is not a scam. I'd avoid the even cheaper Certera code signing certificate unless you find out who actually issues it. Angus

Never heard of Exchange Web Service protocol, but ICS has a TIcsRestEmail component that uses the graph.microsoft.com/v1.0/me/sendMail API, there is a sample in OverbyteIcsHttpRestTst,dpr. Angus

I renewed with K-Software a year ago and don't seem to have noted which URL created the private key, but it probably worked with Firefox which is my standard browser. There are only a couple of sites I need to use Edge to access. Angus

OverbyteIcsPemTool 'View Bundle File' button will list each certificate and key in the bundle file, so one of mine starts: Certificate file C:\certificates\x_magsys_co_uk-bundle.pem ISSUED TO (Subject) Common Name (CN): *.magsys.co.uk Alt Name (DNS): *.magsys.co.uk, *.magsys.uk, magsys.co.uk, magsys.uk xxx ISSUED BY Common Name (CN): R3 Organisation (O): Let's Encrypt xxx !! Private key available for certificate: ECDSA Key Encryption prime256v1 256 bits, 128 security bits !! Intermediate certificates: Total 1 #1 Issued to (CN): R3, (O): Let's Encrypt If it does not say !! Private key available, the file can not be used for SSL/TLS client or server, the intermediate is required for most server applications, but probably not for clients. You may need to specify a password to read the private key. Angus

Thanks, useful, but it should also be a menu item somewhere so people can find it without resorting to documentation. Angus

I built all the ICS FMX packages yesterday with 11.3, no problems. Updating GetIt installed components really needs some work, far too many errors and restarts required. Being able to print a list of what GetIt has installed and where would be really useful since we expected to repeat it all after a minor upgrade like 11.3. Angus

The ICS github repository is unofficial and never updated, it should be removed to avoid confusion with https://svn.overbyte.be/svn/ where you will find the latest ICS. Never tested ICS with jumbo packets, there are no special settings I'm aware of. More likely to be an OS issue, what are you using? Angus

While ReceiveStr may not have MaxLen, other similar functions do, so it's backward compatible. Since it is defaulted, you can ignore it. Angus

You get different errors as you correct each different problem. ICS will raise an authentication window for a 401 error, at that point it has no idea what authentication scheme is needed. You should build the ICS OverbyteIcsPemtool sample and try and open your PEM bundle with the View Bundle File button on the first tab, it should show the certificate details and whether there is a matching private key. Angus

Okay, so the REST server does not want Json but POST with REST Content 'URL, Encoded Body'. Angus

I would fix the Json parameters first, that was the "Missing or invalid grant_type" error you received, then worry about headers, most of which are standard. Angus

Because you have not shown most of the posted parameters, it's impossible to say exactly what is wrong. The postman page says there are nine headers necessary, some may be sent already by ICS, others may need adding using 'Extra Headers', where you have typed ExtraHeaders for some reason. it should be headername:headervalue. Also Json parameters need to be correctly encoded, if you look at the TRestOAuth.GrantAuthToken method in OverbyteIcsSslHttpOAuth.pas, you'll see that when adding the client Id and secret and other parameters they are added with the Raw option so they are not escaped as Json strings, in the GUI you should replace RPTypeStr with RPTypeObj so that the values are not quoted. Angus