(DataFlex) Sign PDF in the Cloud using AWS CloudHSM

See more Signing in the Cloud Examples

Demonstrates how to sign a PDF using AWS CloudHSM. The signing of the hash happens on a hardware token in AWS CloudHSM. Everything else involving the updating the PDF to add the signature happens locally within Chilkat.

Note: This example requires Chilkat v9.5.0.96 or greater.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

Use ChilkatAx-win32.pkg

Procedure Test
    Variant vPkcs11
    Handle hoPkcs11
    String sPin
    Integer iUserType
    Boolean iSuccess
    Variant vCert
    Handle hoCert
    Handle hoPdf
    Variant vJson
    Handle hoJson
    Integer i
    String sTemp1

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

    Get Create (RefClass(cComChilkatPkcs11)) To hoPkcs11
    If (Not(IsComObjectCreated(hoPkcs11))) Begin
        Send CreateComObject of hoPkcs11
    End

    // Provide the path to the AWS CloudHSM PKCS11 driver.
    // This example runs on Windows, so we'll provide the CloudHSM DLL.
    // If your code runs on Linux, the CloudHSM driver might be at /opt/cloudhsm/lib/libcloudhsm_pkcs11.so
    Set ComSharedLibPath Of hoPkcs11 To "C:\Program Files\Amazon\CloudHSM\lib\cloudhsm_pkcs11.dll"

    // Your PIN should be a string containing your crypto user's login and password, with a colon char delimiting.
    // See https://docs.aws.amazon.com/cloudhsm/latest/userguide/pkcs11-pin.html
    Move "user:password" To sPin
    Move 1 To iUserType

    // Establish a PKCS logged-on session using the driver (.so, .dylib, or .dll) as specified in the SharedLibPath above.
    Get ComQuickSession Of hoPkcs11 iUserType sPin To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get Create (RefClass(cComChilkatCert)) To hoCert
    If (Not(IsComObjectCreated(hoCert))) Begin
        Send CreateComObject of hoCert
    End
    Get ComLoadFromFile Of hoCert "qa_data/certs/myCert.cer" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoCert To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Tell the certificate to link with the PKCS11 session.
    // The cert's private key should be installed on the CloudHSM.
    // If there are multiple private keys on the CloudHSM, then Chilkat will automatically
    // locate and use the private key corresponding to the certificate.
    Get pvComObject of hoPkcs11 to vPkcs11
    Get ComLinkPkcs11 Of hoCert vPkcs11 To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoCert To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // --------------------------------------------------------------------------
    // At this point, we have the cert to be used for signing.
    // Our PDF signing code is the same as for a cert obtained from any other source..

    Get Create (RefClass(cComChilkatPdf)) To hoPdf
    If (Not(IsComObjectCreated(hoPdf))) Begin
        Send CreateComObject of hoPdf
    End

    // Load a PDF to be signed.
    Get ComLoadFile Of hoPdf "qa_data/pdf/hello.pdf" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPdf To sTemp1
        Showln sTemp1
        Get ComCloseSession Of hoPkcs11 To iSuccess
        Procedure_Return
    End

    Get Create (RefClass(cComChilkatJsonObject)) To hoJson
    If (Not(IsComObjectCreated(hoJson))) Begin
        Send CreateComObject of hoJson
    End

    Get ComUpdateInt Of hoJson "page" 1 To iSuccess
    Get ComUpdateString Of hoJson "appearance.y" "top" To iSuccess
    Get ComUpdateString Of hoJson "appearance.x" "left" To iSuccess
    Get ComUpdateString Of hoJson "appearance.fontScale" "10.0" To iSuccess
    Get ComUpdateString Of hoJson "signingAlgorithm" "pss" To iSuccess
    Get ComUpdateString Of hoJson "hashAlgorithm" "sha256" To iSuccess

    Move 0 To i
    Set ComI Of hoJson To i
    Get ComUpdateString Of hoJson "appearance.text[i]" "Digitaly signed by: Xyz Widgets, Inc." To iSuccess
    Move (i + 1) To i
    Set ComI Of hoJson To i
    Get ComUpdateString Of hoJson "appearance.text[i]" "current_dt" To iSuccess
    Move (i + 1) To i
    Set ComI Of hoJson To i
    Get ComUpdateString Of hoJson "appearance.text[i]" "blah blah blah" To iSuccess

    // The certificate is internally linked to the Pkcs11 object, which is currently in an authenticated session.
    Get pvComObject of hoCert to vCert
    Get ComSetSigningCert Of hoPdf vCert To iSuccess

    Get pvComObject of hoJson to vJson
    Get ComSignPdf Of hoPdf vJson "qa_output/out.pdf" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPdf To sTemp1
        Showln sTemp1
        Get ComCloseSession Of hoPkcs11 To iSuccess
        Procedure_Return
    End

    // --------------------------------------------------------------------------

    // Revert to an unauthenticated session by calling Logout.
    Get ComLogout Of hoPkcs11 To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Get ComCloseSession Of hoPkcs11 To iSuccess
        Procedure_Return
    End

    // When finished, close the session.
    // It is important to close the session (memory leaks will occur if the session is not properly closed).
    Get ComCloseSession Of hoPkcs11 To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "Success."


End_Procedure