(Chilkat2-Python) Authenticode Sign using Smartcard or USB Token

See more Code Signing Examples

Demonstrates how to Authenticode sign an EXE or DLL using a smartcard or USB token, such as a Yubikey.

Note: Chilkat's code signing class was added in v9.5.0.97

Chilkat2 Python Downloads install with pip pip3 install chilkat2 or download... Python Module for Windows, Linux, Alpine Linux, MacOS, Solaris

import sys
import chilkat2

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# First create the following JSON to specify that SHA256 is to be used,
# and provide timestamp server information.

# {
#   "hashAlg": "sha256",
#   "timestampToken": {
#     "enabled": true,
#     "tsaUrl": "http://timestamp.digicert.com",
#     "requestTsaCert": true,
#     "hashAlg": "sha256"
#   }
# }

json = chilkat2.JsonObject()
json.UpdateString("hashAlg","sha256")
json.UpdateBool("timestampToken.enabled",True)
json.UpdateString("timestampToken.tsaUrl","http://timestamp.digicert.com")
json.UpdateBool("timestampToken.requestTsaCert",True)
json.UpdateString("timestampToken.hashAlg","sha256")

# The only difference in signing with a smartcard or USB token
# is that the cert is loaded from a smartcard or USB token, instead of a PFX or from elsewhere
# such as from the Windows certificate store.
cert = chilkat2.Cert()

# Yubico YubiKey OTP+FIDO+CCID 0, default PIN = 123456
cert.SmartCardPin = "123456"

# Assuming you have the Yubikey inserted into the USB on the computer...
# and there is only 1 signing certificate on the Yubikey, then just load from
# the "smartcard".  (assuming you don't have additional smartcards or USB tokens plugged in)
success = cert.LoadFromSmartcard("")
if (success == False):
    print(cert.LastErrorText)
    sys.exit()

# If the smartcard/token has several possible certificates that can be used for signing,
# then see the online documentation for the LoadFromSmartcard method,
# and also see the online documentation and examples for Chilkat Pkcs11 and ScMinidriver.
# There are many possible ways to load a Chilkat certificate object with a cert (and associated private key)
# from a variety of sources.  The only coding difference for any signing function in Chilkat,
# whether it be a PDF, XmlDSig, CMS, etc. is in how the cert is loaded.

# You can sign .exe or .dll files.
exePath = "C:/someOtherDir/HelloWorld.exe"

signer = chilkat2.CodeSign()

# If successful, the following call will apply the signature to the EXE (or DLL).
success = signer.AddSignature(exePath,cert,json)
if (success == False):
    print(signer.LastErrorText)
    sys.exit()

print("Successfully applied the Authenticode signature.")