Java Requires Chilkat v11.0.0+

Azure Key Vault Sign with a Certificate's Private Key

See more Azure Key Vault Examples

Signs a hash using the private key of a certificate previously imported to an Azure Key Vault. Chilkat2 Java

import com.chilkatsoft.chilkat2.Cert;
import com.chilkatsoft.chilkat2.ChilkatException;
import com.chilkatsoft.chilkat2.Http;
import com.chilkatsoft.chilkat2.HttpResponse;
import com.chilkatsoft.chilkat2.JsonObject;
import com.chilkatsoft.chilkat2.Rsa;
import com.chilkatsoft.chilkat2.StringBuilder;

public class ChilkatExample {

    public static void main(String[] args) {
        // This requires the Chilkat API to have been previously unlocked.
        // See Global Unlock Sample for sample code.

        // See Azure Key Vault Get Certificates for a more detailed explanation
        // for how Chilkat is automatically getting the OAuth2 access token for your application.

        // Provide information needed for Chilkat to automatically get an OAuth2 access token as needed.
        JsonObject json = new JsonObject();
        json.updateString("client_id", "APP_ID");
        json.updateString("client_secret", "APP_PASSWORD");
        json.updateString("resource", "https://vault.azure.net");
        json.updateString("token_endpoint", "https://login.microsoftonline.com/TENANT_ID/oauth2/token");

        // In this example, we'll sign the SHA256 hash of the string "This is a test"
        StringBuilder sb = new StringBuilder();
        String signedString = "This is a test";
        sb.append(signedString);
        String hash_base64url = sb.getHash("sha256", "base64url", "utf-8");

        // We're going to send a POST to the following URL:
        // POST {vaultBaseUrl}/keys/{key-or-cert-name}/{key-or-cert-version}/sign?api-version=7.4

        // For example:

        // POST https://VAULT_NAME.vault.azure.net/keys/CERT_NAME/CERT_VERSION/sign?api-version=7.4
        //
        // {
        //   "alg": "RS512",
        //   "value": "RUE3Nzg4NTQ4QjQ5RjFFN0U2NzAyQzhDNEMwMkJDOTA1MTYyOTUzNjI5NDhBNzZDQTlFOTM1NDA2M0ZGMjk2Mg"
        // }

        // The alg can be one of the following
        // ES256  ECDSA using P-256 and SHA-256
        // ES256K ECDSA using P-256K and SHA-256
        // ES384  ECDSA using P-384 and SHA-384
        // ES512  ECDSA using P-521 and SHA-512
        // PS256  RSASSA-PSS using SHA-256 and MGF1 with SHA-256
        // PS384  RSASSA-PSS using SHA-384 and MGF1 with SHA-384
        // PS512  RSASSA-PSS using SHA-512 and MGF1 with SHA-512
        // RS256  RSASSA-PKCS1-v1_5 using SHA-256
        // RS384  RSASSA-PKCS1-v1_5 using SHA-384
        // RS512  RSASSA-PKCS1-v1_5 using SHA-512

        // The sample POST above uses SHA512.  We'll instead sign a SHA256 hash..

        JsonObject jsonBody = new JsonObject();
        jsonBody.updateString("alg", "RS256");
        jsonBody.updateString("value", hash_base64url);

        Http http = new Http();

        // Instead of providing an actual access token, we give Chilkat the information that allows it to
        // automatically fetch the access token using the OAuth2 client credentials flow.
        http.setAuthToken(json.emit());

        http.setUrlVar("certName", "importCert01");
        http.setUrlVar("certVersion", "7140c8755ed14839b5d86a9f7e7f0497");
        // Note: Replace "VAULT_NAME" with the name of your Azure key vault.
        String url = "https://VAULT_NAME.vault.azure.net/keys/{$certName}/{$certVersion}/sign?api-version=7.4";
        HttpResponse resp = new HttpResponse();
        try {
            http.httpJson("POST", url, jsonBody, "application/json", resp);
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        int statusCode = resp.getStatusCode();

        JsonObject jsonResp = new JsonObject();
        resp.getBodyJson(jsonResp);

        jsonResp.setEmitCompact(false);
        System.out.println(jsonResp.emit());

        if (statusCode != 200) {
            System.out.println("Failed.");
            return;
        }

        // A successful response body contains JSON like this:
        // Note: Azure's documentation is not very clear, but base64url is the encoding, not "base64".
        // {
        //   "kid": "https://kvchilkat.vault.azure.net/keys/importCert01/7140c8755ed14839b5d86a9f7e7f0497",
        //   "value": "JzWd2YF21gjtW ... Em37hKOQ"
        // }

        // Let's validate the signature using the cert's public key.
        // This example will load the corresponding certificate from a local file and will verify the signature against the original data.
        //
        Cert cert = new Cert();
        try {
            cert.loadFromFile("qa_data/certs/chilkat_code_signing_2024.cer");
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        Rsa rsa = new Rsa();
        // Tell the RSA object to use the cert's public key.
        try {
            rsa.setX509Cert(cert, false);
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        // Verify the signature using the cert's public key against the original string.
        rsa.setEncodingMode("base64url");
        boolean valid;
        try {
            rsa.verifyStringENC(signedString, "sha-256", jsonResp.stringOf("value"));
            valid = true;
        } catch (ChilkatException e) {
            valid = false;
        }
        System.out.println("signature valid = " + valid);
    }
}