Unicode C Requires Chilkat v11.7.0+
Unicode C
Encrypt and Sign a PDF, and Sign an Encrypted PDF
See more PDF Protection Examples
Demonstrates signing together with encryption. A pending encrypt is applied by SignPdf before it signs, so one call produces a PDF that is both encrypted and signed. A PDF that is already encrypted can be signed too, and stays encrypted. When it was opened with only the user password its permissions decide: adding a signature field needs both the modify and the annotate permission. Loading the PDF with its owner password lifts that.Chilkat Unicode C Downloads
#include <C_CkCertW.h>
#include <C_CkPdfW.h>
#include <C_CkJsonObjectW.h>
void ChilkatSample(void)
{
BOOL success;
HCkCertW cert;
HCkPdfW pdf;
HCkJsonObjectW json;
HCkJsonObjectW jsonOut;
HCkJsonObjectW sigOpts;
HCkPdfW check;
HCkJsonObjectW empty;
HCkJsonObjectW info;
HCkJsonObjectW sigInfo;
BOOL verified;
HCkPdfW owner;
HCkPdfW twice;
success = FALSE;
// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.
// The PDF used in this example is available at two_page_memo.pdf
// The signing certificate, with its private key.
cert = CkCertW_Create();
success = CkCertW_LoadPfxFile(cert,L"qa_data/pfx/myPdfSigningCert.pfx",L"secret");
if (success == FALSE) {
wprintf(L"%s\n",CkCertW_lastErrorText(cert));
CkCertW_Dispose(cert);
return;
}
pdf = CkPdfW_Create();
success = CkPdfW_LoadFile(pdf,L"qa_data/pdf/two_page_memo.pdf");
if (success == FALSE) {
wprintf(L"%s\n",CkPdfW_lastErrorText(pdf));
CkCertW_Dispose(cert);
CkPdfW_Dispose(pdf);
return;
}
// Encrypt with AES-256 and do not permit modifying.
CkPdfW_putUserPassword(pdf,L"user-secret");
CkPdfW_putOwnerPassword(pdf,L"owner-secret");
json = CkJsonObjectW_Create();
CkJsonObjectW_UpdateBool(json,L"permissions.modify",FALSE);
jsonOut = CkJsonObjectW_Create();
success = CkPdfW_Protection(pdf,L"encrypt",json,jsonOut);
if (success == FALSE) {
wprintf(L"%s\n",CkPdfW_lastErrorText(pdf));
CkCertW_Dispose(cert);
CkPdfW_Dispose(pdf);
CkJsonObjectW_Dispose(json);
CkJsonObjectW_Dispose(jsonOut);
return;
}
// The encryption is still pending. SignPdf applies it first and signs the encrypted result.
success = CkPdfW_SetSigningCert(pdf,cert);
if (success == FALSE) {
wprintf(L"%s\n",CkPdfW_lastErrorText(pdf));
CkCertW_Dispose(cert);
CkPdfW_Dispose(pdf);
CkJsonObjectW_Dispose(json);
CkJsonObjectW_Dispose(jsonOut);
return;
}
sigOpts = CkJsonObjectW_Create();
CkJsonObjectW_UpdateBool(sigOpts,L"invisibleSignature",TRUE);
CkJsonObjectW_UpdateInt(sigOpts,L"signingCertificateV2",1);
CkJsonObjectW_UpdateInt(sigOpts,L"signingTime",1);
success = CkPdfW_SignPdf(pdf,sigOpts,L"qa_output/memo_encrypted_signed.pdf");
if (success == FALSE) {
wprintf(L"%s\n",CkPdfW_lastErrorText(pdf));
CkCertW_Dispose(cert);
CkPdfW_Dispose(pdf);
CkJsonObjectW_Dispose(json);
CkJsonObjectW_Dispose(jsonOut);
CkJsonObjectW_Dispose(sigOpts);
return;
}
// The result is encrypted and signed.
check = CkPdfW_Create();
CkPdfW_putUserPassword(check,L"user-secret");
success = CkPdfW_LoadFile(check,L"qa_output/memo_encrypted_signed.pdf");
if (success == FALSE) {
wprintf(L"%s\n",CkPdfW_lastErrorText(check));
CkCertW_Dispose(cert);
CkPdfW_Dispose(pdf);
CkJsonObjectW_Dispose(json);
CkJsonObjectW_Dispose(jsonOut);
CkJsonObjectW_Dispose(sigOpts);
CkPdfW_Dispose(check);
return;
}
empty = CkJsonObjectW_Create();
info = CkJsonObjectW_Create();
success = CkPdfW_Protection(check,L"getInfo",empty,info);
if (success == FALSE) {
wprintf(L"%s\n",CkPdfW_lastErrorText(check));
CkCertW_Dispose(cert);
CkPdfW_Dispose(pdf);
CkJsonObjectW_Dispose(json);
CkJsonObjectW_Dispose(jsonOut);
CkJsonObjectW_Dispose(sigOpts);
CkPdfW_Dispose(check);
CkJsonObjectW_Dispose(empty);
CkJsonObjectW_Dispose(info);
return;
}
wprintf(L"algorithm: %s\n",CkJsonObjectW_stringOf(info,L"loaded.algorithm"));
wprintf(L"signatures: %d\n",CkPdfW_getNumSignatures(check));
sigInfo = CkJsonObjectW_Create();
verified = CkPdfW_VerifySignature(check,0,sigInfo);
wprintf(L"signature verifies: %d\n",verified);
// Signing an encrypted PDF. This one was opened with only the user password, and its
// permissions do not allow modifying, so another signature is refused.
success = CkPdfW_SetSigningCert(check,cert);
if (success == FALSE) {
wprintf(L"%s\n",CkPdfW_lastErrorText(check));
CkCertW_Dispose(cert);
CkPdfW_Dispose(pdf);
CkJsonObjectW_Dispose(json);
CkJsonObjectW_Dispose(jsonOut);
CkJsonObjectW_Dispose(sigOpts);
CkPdfW_Dispose(check);
CkJsonObjectW_Dispose(empty);
CkJsonObjectW_Dispose(info);
CkJsonObjectW_Dispose(sigInfo);
return;
}
success = CkPdfW_SignPdf(check,sigOpts,L"qa_output/memo_signed_twice.pdf");
if (success == FALSE) {
wprintf(L"A second signature was refused: the permissions do not allow it.\n");
}
// Loaded with the owner password, the same PDF can be signed. It stays encrypted, and the
// first signature stays valid because the new one is added as an incremental update.
owner = CkPdfW_Create();
CkPdfW_putUserPassword(owner,L"user-secret");
CkPdfW_putOwnerPassword(owner,L"owner-secret");
success = CkPdfW_LoadFile(owner,L"qa_output/memo_encrypted_signed.pdf");
if (success == FALSE) {
wprintf(L"%s\n",CkPdfW_lastErrorText(owner));
CkCertW_Dispose(cert);
CkPdfW_Dispose(pdf);
CkJsonObjectW_Dispose(json);
CkJsonObjectW_Dispose(jsonOut);
CkJsonObjectW_Dispose(sigOpts);
CkPdfW_Dispose(check);
CkJsonObjectW_Dispose(empty);
CkJsonObjectW_Dispose(info);
CkJsonObjectW_Dispose(sigInfo);
CkPdfW_Dispose(owner);
return;
}
success = CkPdfW_SetSigningCert(owner,cert);
if (success == FALSE) {
wprintf(L"%s\n",CkPdfW_lastErrorText(owner));
CkCertW_Dispose(cert);
CkPdfW_Dispose(pdf);
CkJsonObjectW_Dispose(json);
CkJsonObjectW_Dispose(jsonOut);
CkJsonObjectW_Dispose(sigOpts);
CkPdfW_Dispose(check);
CkJsonObjectW_Dispose(empty);
CkJsonObjectW_Dispose(info);
CkJsonObjectW_Dispose(sigInfo);
CkPdfW_Dispose(owner);
return;
}
success = CkPdfW_SignPdf(owner,sigOpts,L"qa_output/memo_signed_twice.pdf");
if (success == FALSE) {
wprintf(L"%s\n",CkPdfW_lastErrorText(owner));
CkCertW_Dispose(cert);
CkPdfW_Dispose(pdf);
CkJsonObjectW_Dispose(json);
CkJsonObjectW_Dispose(jsonOut);
CkJsonObjectW_Dispose(sigOpts);
CkPdfW_Dispose(check);
CkJsonObjectW_Dispose(empty);
CkJsonObjectW_Dispose(info);
CkJsonObjectW_Dispose(sigInfo);
CkPdfW_Dispose(owner);
return;
}
twice = CkPdfW_Create();
CkPdfW_putUserPassword(twice,L"user-secret");
success = CkPdfW_LoadFile(twice,L"qa_output/memo_signed_twice.pdf");
if (success == FALSE) {
wprintf(L"%s\n",CkPdfW_lastErrorText(twice));
CkCertW_Dispose(cert);
CkPdfW_Dispose(pdf);
CkJsonObjectW_Dispose(json);
CkJsonObjectW_Dispose(jsonOut);
CkJsonObjectW_Dispose(sigOpts);
CkPdfW_Dispose(check);
CkJsonObjectW_Dispose(empty);
CkJsonObjectW_Dispose(info);
CkJsonObjectW_Dispose(sigInfo);
CkPdfW_Dispose(owner);
CkPdfW_Dispose(twice);
return;
}
wprintf(L"signatures after signing with owner rights: %d\n",CkPdfW_getNumSignatures(twice));
verified = CkPdfW_VerifySignature(twice,0,sigInfo);
wprintf(L"first signature still verifies: %d\n",verified);
verified = CkPdfW_VerifySignature(twice,1,sigInfo);
wprintf(L"second signature verifies: %d\n",verified);
// Sample output:
// algorithm: aes-256
// signatures: 1
// signature verifies: True
// A second signature was refused: the permissions do not allow it.
// signatures after signing with owner rights: 2
// first signature still verifies: True
// second signature verifies: True
CkCertW_Dispose(cert);
CkPdfW_Dispose(pdf);
CkJsonObjectW_Dispose(json);
CkJsonObjectW_Dispose(jsonOut);
CkJsonObjectW_Dispose(sigOpts);
CkPdfW_Dispose(check);
CkJsonObjectW_Dispose(empty);
CkJsonObjectW_Dispose(info);
CkJsonObjectW_Dispose(sigInfo);
CkPdfW_Dispose(owner);
CkPdfW_Dispose(twice);
}