Tcl Requires Chilkat v11.7.0+

Encrypt a PDF for a Certificate Instead of a Password

See more PDF Protection Examples

Demonstrates certificate security, where a PDF is encrypted for one or more recipients and each opens it with their own certificate and private key. No password is involved. Only the public certificate of a recipient is needed to encrypt. Each recipient has its own permissions, and the changeSecurity permission gives a recipient owner rights. PreLoadCheck tells an application that a file is certificate-encrypted and which certificates can open it. A PDF that cannot be opened, because no matching certificate and private key were provided, fails to load. Tcl

load ./chilkat.dll

set success 0

#  This example requires the Chilkat API to have been previously unlocked.
#  See Global Unlock Sample for sample code.

#  The PDF used in this example is available at two_page_memo.pdf

#  The recipient's certificate.  Only the public certificate is needed to encrypt.
set recipient [new_CkCert]

set success [CkCert_LoadFromFile $recipient "qa_data/certs/recipient.cer"]
if {$success == 0} then {
    puts [CkCert_lastErrorText $recipient]
    delete_CkCert $recipient
    exit
}

set pdf [new_CkPdf]

set success [CkPdf_LoadFile $pdf "qa_data/pdf/two_page_memo.pdf"]
if {$success == 0} then {
    puts [CkPdf_lastErrorText $pdf]
    delete_CkCert $recipient
    delete_CkPdf $pdf
    exit
}

#  Call AddEncryptCert once for each recipient.
set success [CkPdf_AddEncryptCert $pdf $recipient]
if {$success == 0} then {
    puts [CkPdf_lastErrorText $pdf]
    delete_CkCert $recipient
    delete_CkPdf $pdf
    exit
}

#  recipientPermissions[0] belongs to the first certificate added.  changeSecurity gives that
#  recipient owner rights, so the file can be managed later.
set json [new_CkJsonObject]

CkJsonObject_UpdateString $json "method" "certificate"
CkJsonObject_UpdateBool $json "recipientPermissions[0].changeSecurity" 1

set jsonOut [new_CkJsonObject]

set success [CkPdf_Protection $pdf "encrypt" $json $jsonOut]
if {$success == 0} then {
    puts [CkPdf_lastErrorText $pdf]
    delete_CkCert $recipient
    delete_CkPdf $pdf
    delete_CkJsonObject $json
    delete_CkJsonObject $jsonOut
    exit
}

puts "method: [CkJsonObject_stringOf $jsonOut pending.method]"
puts "algorithm: [CkJsonObject_stringOf $jsonOut pending.algorithm]"
puts "recipients: [CkJsonObject_SizeOfArray $jsonOut pending.recipients]"

set success [CkPdf_WriteFile $pdf "qa_output/memo_for_recipient.pdf"]
if {$success == 0} then {
    puts [CkPdf_lastErrorText $pdf]
    delete_CkCert $recipient
    delete_CkPdf $pdf
    delete_CkJsonObject $json
    delete_CkJsonObject $jsonOut
    exit
}

#  PreLoadCheck says how the file is protected, without loading it.
set reader [new_CkPdf]

set info [new_CkJsonObject]

set success [CkPdf_PreLoadCheck $reader "qa_output/memo_for_recipient.pdf" $info]
if {$success == 0} then {
    puts [CkPdf_lastErrorText $reader]
    delete_CkCert $recipient
    delete_CkPdf $pdf
    delete_CkJsonObject $json
    delete_CkJsonObject $jsonOut
    delete_CkPdf $reader
    delete_CkJsonObject $info
    exit
}

puts "saved file, method: [CkJsonObject_stringOf $info method]"
puts "saved file, recipients: [CkJsonObject_SizeOfArray $info recipients]"

#  The recipient opens it with the certificate and its private key, here from a .pfx file.
#  (On Windows, a certificate that is installed in the Windows certificate store with its private
#  key is found automatically when the PDF is loaded, and SetDecryptCert is not needed for it.)
set myCert [new_CkCert]

set success [CkCert_LoadPfxFile $myCert "qa_data/pfx/recipient.pfx" "pfx-password"]
if {$success == 0} then {
    puts [CkCert_lastErrorText $myCert]
    delete_CkCert $recipient
    delete_CkPdf $pdf
    delete_CkJsonObject $json
    delete_CkJsonObject $jsonOut
    delete_CkPdf $reader
    delete_CkJsonObject $info
    delete_CkCert $myCert
    exit
}

set success [CkPdf_SetDecryptCert $reader $myCert]
if {$success == 0} then {
    puts [CkPdf_lastErrorText $reader]
    delete_CkCert $recipient
    delete_CkPdf $pdf
    delete_CkJsonObject $json
    delete_CkJsonObject $jsonOut
    delete_CkPdf $reader
    delete_CkJsonObject $info
    delete_CkCert $myCert
    exit
}

set success [CkPdf_LoadFile $reader "qa_output/memo_for_recipient.pdf"]
if {$success == 0} then {
    puts [CkPdf_lastErrorText $reader]
    delete_CkCert $recipient
    delete_CkPdf $pdf
    delete_CkJsonObject $json
    delete_CkJsonObject $jsonOut
    delete_CkPdf $reader
    delete_CkJsonObject $info
    delete_CkCert $myCert
    exit
}

set empty [new_CkJsonObject]

set loadedInfo [new_CkJsonObject]

set success [CkPdf_Protection $reader "getInfo" $empty $loadedInfo]
if {$success == 0} then {
    puts [CkPdf_lastErrorText $reader]
    delete_CkCert $recipient
    delete_CkPdf $pdf
    delete_CkJsonObject $json
    delete_CkJsonObject $jsonOut
    delete_CkPdf $reader
    delete_CkJsonObject $info
    delete_CkCert $myCert
    delete_CkJsonObject $empty
    delete_CkJsonObject $loadedInfo
    exit
}

puts "opened with: [CkJsonObject_stringOf $loadedInfo loaded.openedWith]"
puts "pages: [CkPdf_get_NumPages $reader]"

#  Sample output:

#  method: certificate
#  algorithm: aes-256
#  recipients: 1
#  saved file, method: certificate
#  saved file, recipients: 1
#  opened with: certificate
#  pages: 2

delete_CkCert $recipient
delete_CkPdf $pdf
delete_CkJsonObject $json
delete_CkJsonObject $jsonOut
delete_CkPdf $reader
delete_CkJsonObject $info
delete_CkCert $myCert
delete_CkJsonObject $empty
delete_CkJsonObject $loadedInfo