Visual FoxPro

Create CAdES p7m using AWS KMS to Sign in the Cloud

See more Signing in the Cloud Examples

Demonstrates how to create a CAdES p7m, using AWS KMS. The signing of the hash happens in the Cloud on AWS KMS. Everything else regarding the creation of CAdES happens locally within Chilkat.

Note: This example requires Chilkat v9.5.0.96 or greater.

Visual FoxPro

LOCAL lnSuccess
LOCAL loCert
LOCAL loJsonAwsKms
LOCAL loCrypt
LOCAL loSignedAttrs
LOCAL lcInputXmlPath
LOCAL lcOutputP7mPath

lnSuccess = 0

* This example assumes the Chilkat API to have been previously unlocked.
* See Global Unlock Sample for sample code.

* Load the certificate used for signing.  The certificate's private key is stored in AWS KMS
* However, we still need the certificate locally (without private key).
loCert = CreateObject('Chilkat.Cert')
lnSuccess = loCert.LoadFromFile("qa_data/certs/myCert.cer")
IF (lnSuccess = 0) THEN
    ? loCert.LastErrorText
    RELEASE loCert
    CANCEL
ENDIF

* Here's a screenshot showing the key ID of a private key in AWS KMS:
* (image:https://example-code.com/images/aws_kms.jpg/endImage)

* To sign using AWS KMS, 
* add the following lines of code to specify your AWS authentication credentials,
* and the ID of the KMS private key.
loJsonAwsKms = CreateObject('Chilkat.JsonObject')
* Set the "service" equal to "aws_kms" to tell Chilkat to use AWS KMS for signing.
loJsonAwsKms.UpdateString("service","aws_kms")
loJsonAwsKms.UpdateString("access_key","ACCESS_KEY")
loJsonAwsKms.UpdateString("secret_key","SECRET_KEY")
* Make sure to specify the correct region for your case.
loJsonAwsKms.UpdateString("region","us-west-2")
* In the above screenshot, our key ID is "187012e8-008f-4fc7-b100-5efe6146dff2".  You will use your key ID.
loJsonAwsKms.UpdateString("key_id","187012e8-008f-4fc7-b100-5efe6146dff2")

lnSuccess = loCert.SetCloudSigner(loJsonAwsKms)

loCrypt = CreateObject('Chilkat.Crypt2')

lnSuccess = loCrypt.SetSigningCert(loCert)
IF (lnSuccess = 0) THEN
    ? loCrypt.LastErrorText
    RELEASE loCert
    RELEASE loJsonAwsKms
    RELEASE loCrypt
    CANCEL
ENDIF

* The CadesEnabled property applies to all methods that create PKCS7 signatures. 
* To create a CAdES-BES signature, set this property equal to true.
loCrypt.CadesEnabled = 1

loCrypt.HashAlgorithm = "sha256"

loSignedAttrs = CreateObject('Chilkat.JsonObject')
loSignedAttrs.UpdateInt("contentType",1)
loSignedAttrs.UpdateInt("signingTime",1)
loSignedAttrs.UpdateInt("messageDigest",1)
loSignedAttrs.UpdateInt("signingCertificateV2",1)
loCrypt.SigningAttributes = loSignedAttrs.Emit()

* You can sign any type of file..
lcInputXmlPath = "qa_data/e-Invoice.xml"
lcOutputP7mPath = "qa_output/signed.p7m"

* Create the CAdES-BES attached signature, which contains the original data.
* Chilkat will build the .p7m locally, but will (internally) use ARSS
* to do the RSA signing remotely.
lnSuccess = loCrypt.CreateP7M(lcInputXmlPath,lcOutputP7mPath)
IF (lnSuccess = 0) THEN
    ? loCrypt.LastErrorText
    RELEASE loCert
    RELEASE loJsonAwsKms
    RELEASE loCrypt
    RELEASE loSignedAttrs
    CANCEL
ENDIF

? "Success."

RELEASE loCert
RELEASE loJsonAwsKms
RELEASE loCrypt
RELEASE loSignedAttrs