AutoIt

PKCS11 Sign PDF using Certificate and Private Key on Smart Card / USB Token

See more PKCS11 Examples

Sample code showing how to use PKCS11 to sign a PDF with a certificate and private key stored on a smart card or USB token.

Note: This example requires Chilkat v9.5.0.96 or later.

AutoIt

Local $bSuccess = False

; This example requires the Chilkat API to have been previously unlocked.
; See Global Unlock Sample for sample code.

; Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

$oPkcs11 = ObjCreate("Chilkat.Pkcs11")

$oPkcs11.SharedLibPath = "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll"
Local $sPin = "0000"
Local $iUserType = 1

; Establish a PKCS11 logged-on session using the driver (.so, .dylib, or .dll) as specified in the SharedLibPath above.
$bSuccess = $oPkcs11.QuickSession($iUserType,$sPin)
If ($bSuccess = False) Then
    ConsoleWrite($oPkcs11.LastErrorText & @CRLF)
    Exit
EndIf

; Get the certificate (on the smart card) that has a private key.
; There are other ways to locate a certificate on the HSM.
; This example assumes there is a single certificate w/ private key.
$oCert = ObjCreate("Chilkat.Cert")
$bSuccess = $oPkcs11.FindCert("privateKey","",$oCert)
If ($bSuccess = True) Then
    ConsoleWrite("Cert with private key: " & $oCert.SubjectCN & @CRLF)
Else
    ConsoleWrite("No certificates having a private key were found." & @CRLF)
    $bSuccess = $oPkcs11.CloseSession()
    Exit
EndIf

; --------------------------------------------------------------------------
; At this point, we have the cert to be used for signing.
; Our PDF signing code is the same as for a cert obtained from any other source..

$oPdf = ObjCreate("Chilkat.Pdf")

; Load a PDF to be signed.
$bSuccess = $oPdf.LoadFile("qa_data/pdf/hello.pdf")
If ($bSuccess = False) Then
    ConsoleWrite($oPdf.LastErrorText & @CRLF)
    $bSuccess = $oPkcs11.CloseSession()
    Exit
EndIf

$oJson = ObjCreate("Chilkat.JsonObject")

$oJson.UpdateInt("page",1)
$oJson.UpdateString("appearance.y","top")
$oJson.UpdateString("appearance.x","left")
$oJson.UpdateString("appearance.fontScale","10.0")
$oJson.UpdateString("signingAlgorithm","pss")
$oJson.UpdateString("hashAlgorithm","sha256")

Local $i = 0
$oJson.I = $i
$oJson.UpdateString("appearance.text[i]","Digitaly signed by: Xyz Widgets, Inc.")
$i = $i + 1
$oJson.I = $i
$oJson.UpdateString("appearance.text[i]","current_dt")
$i = $i + 1
$oJson.I = $i
$oJson.UpdateString("appearance.text[i]","blah blah blah")

; The certificate is internally linked to the Pkcs11 object, which is currently in an authenticated session.
$bSuccess = $oPdf.SetSigningCert($oCert)

$bSuccess = $oPdf.SignPdf($oJson,"qa_output/out.pdf")
If ($bSuccess = False) Then
    ConsoleWrite($oPdf.LastErrorText & @CRLF)
    $bSuccess = $oPkcs11.CloseSession()
    Exit
EndIf

; --------------------------------------------------------------------------

; Revert to an unauthenticated session by calling Logout.
$bSuccess = $oPkcs11.Logout()
If ($bSuccess = False) Then
    ConsoleWrite($oPkcs11.LastErrorText & @CRLF)
    $bSuccess = $oPkcs11.CloseSession()
    Exit
EndIf

; When finished, close the session.
; It is important to close the session (memory leaks will occur if the session is not properly closed).
$bSuccess = $oPkcs11.CloseSession()
If ($bSuccess = False) Then
    ConsoleWrite($oPkcs11.LastErrorText & @CRLF)
    Exit
EndIf

ConsoleWrite("Success." & @CRLF)