Lua Requires Chilkat v9.5.0.96+

Sign XML (XAdES) using AWS CloudHSM

See more PKCS11 Examples

Demonstrates how to sign XML using AWS CloudHSM. The signing of the hash happens on a hardware token in AWS CloudHSM. Everything else involving the updating the XML to add the signature happens locally within Chilkat. Lua

local chilkat = require("chilkat")

-- This example requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

-- Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

local pkcs11 = chilkat.Pkcs11.new()

-- Provide the path to the AWS CloudHSM PKCS11 driver.
-- This example runs on Windows, so we'll provide the CloudHSM DLL.
-- If your code runs on Linux, the CloudHSM driver might be at /opt/cloudhsm/lib/libcloudhsm_pkcs11.so
pkcs11.shared_lib_path = "C:\\Program Files\\Amazon\\CloudHSM\\lib\\cloudhsm_pkcs11.dll"

-- Your PIN should be a string containing your crypto user's login and password, with a colon char delimiting.
-- See https://docs.aws.amazon.com/cloudhsm/latest/userguide/pkcs11-pin.html
local pin = "user:password"
local userType = 1

local success = pkcs11:quick_session(userType, pin)
if not success then
    print(pkcs11.last_error_text)
    return
end

local cert = chilkat.Cert.new()
success = cert:load_from_file("qa_data/certs/myCert.cer")
if not success then
    print(cert.last_error_text)
    return
end

-- Tell the certificate to link with the PKCS11 session.
-- The cert's private key should be installed on the CloudHSM.
-- If there are multiple private keys on the CloudHSM, then Chilkat will automatically
-- locate and use the private key corresponding to the certificate.
success = cert:link_pkcs11(pkcs11)
if not success then
    print(cert.last_error_text)
    return
end

-- --------------------------------------------------------------------------
-- At this point, we have the cert to be used for signing.
-- Our XML signing code is the same as for a cert obtained from any other source..

-- First generate the following XML to be signed:
-- Use this online tool to generate code from sample XML:
-- Generate Code to Create XML

-- <?xml version="1.0" encoding="UTF-8" standalone="no" ?>
-- <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
--     <SOAP-ENV:Header>
--         <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" SOAP-ENV:mustUnderstand="1"></wsse:Security>
--     </SOAP-ENV:Header>
--     <SOAP-ENV:Body xmlns:SOAP-SEC="http://schemas.xmlsoap.org/soap/security/2000-12" SOAP-SEC:id="Body">
--         <z:FooBar xmlns:z="http://example.com" />
--     </SOAP-ENV:Body>
-- </SOAP-ENV:Envelope>

local xml = chilkat.Xml.new()
xml.tag = "SOAP-ENV:Envelope"
xml:add_attribute("xmlns:SOAP-ENV", "http://schemas.xmlsoap.org/soap/envelope/")
xml:update_attr_at("SOAP-ENV:Header|wsse:Security", true, "xmlns:wsse", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd")
xml:update_attr_at("SOAP-ENV:Header|wsse:Security", true, "SOAP-ENV:mustUnderstand", "1")
xml:update_attr_at("SOAP-ENV:Body", true, "xmlns:SOAP-SEC", "http://schemas.xmlsoap.org/soap/security/2000-12")
xml:update_attr_at("SOAP-ENV:Body", true, "SOAP-SEC:id", "Body")
xml:update_attr_at("SOAP-ENV:Body|z:FooBar", true, "xmlns:z", "http://example.com")

local gen = chilkat.XmlDSigGen.new()

-- Indicate where the Signature will be inserted.
gen.sig_location = "SOAP-ENV:Envelope|SOAP-ENV:Header|wsse:Security"

-- Add a reference to the fragment of the XML to be signed.

-- Note: "Body" refers to the XML element having an "id" equal to "Body", where "id" is case insensitive
-- and where any namespace might qualify the attribute.  In this case, the SOAP-ENV:Body fragment is signed
-- NOT because the tag = "Body", but because it has SOAP-SEC:id="Body"
gen:add_same_doc_ref("Body", "sha1", "EXCL_C14N", "", "")

-- (You can read about the SignedInfoPrefixList in the online reference documentation.  It's optional..)
gen.signed_info_prefix_list = "wsse SOAP-ENV"

-- Provide the private key for signing via the certificate, and indicate that
-- we want the base64 of the certificate embedded in the KeyInfo.
gen.key_info_type = "X509Data"
gen.x509_type = "Certificate"

local bUsePrivateKey = true
success = gen:set_x509_cert(cert, bUsePrivateKey)
if not success then
    print(gen.last_error_text)
    success = pkcs11:close_session()
    return
end

-- Everything's specified.  Now create and insert the Signature
local sbXml = chilkat.StringBuilder.new()
xml.emit_compact = true
xml:get_xml_sb(sbXml)

success = gen:create_xml_dsig_sb(sbXml)
if not success then
    print(gen.last_error_text)
    success = pkcs11:close_session()
    return
end

-- Examine the XML with the digital signature inserted
print(sbXml:get_as_string())

-- --------------------------------------------------------------------------

-- Revert to an unauthenticated session by calling Logout.
success = pkcs11:logout()
if not success then
    print(pkcs11.last_error_text)
    success = pkcs11:close_session()
    return
end

-- When finished, close the session.
-- It is important to close the session (memory leaks will occur if the session is not properly closed).
success = pkcs11:close_session()
if not success then
    print(pkcs11.last_error_text)
    return
end

print("Success.")

-- --------------------------------------------------------------------------------
-- Also see Chilkat's Online WSDL Code Generator
-- to generate code and SOAP Request and Response XML for each operation in a WSDL.
-- --------------------------------------------------------------------------------