DataFlex

Create a CAdES-T Signature

See more CAdES Examples

Demonstrates how to create a signature with an external timestamp that certifies the time of signing. This requires an online TSA (Time Stamping Authority) service that is capable of producing RFC 3161 compliant timestamps.

Note: This example requires Chilkat v9.5.0.78 or greater.

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoCrypt
    Variant vCert
    Handle hoCert
    String sPfxPath
    String sPfxPassword
    Handle hoAttrs
    String sInFile
    String sOutFile
    String sTemp1

    Move False To iSuccess

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    Get Create (RefClass(cComChilkatCrypt2)) To hoCrypt
    If (Not(IsComObjectCreated(hoCrypt))) Begin
        Send CreateComObject of hoCrypt
    End

    // This example will use a certificate + private key from a .pfx/.p12 file.
    // On Windows systems, it is also possible to use certs on smartcards/usb tokens or certs pre-installed in the Windows registry.
    Get Create (RefClass(cComChilkatCert)) To hoCert
    If (Not(IsComObjectCreated(hoCert))) Begin
        Send CreateComObject of hoCert
    End

    Move "qa_data/pfx/myCertAndKey.p12" To sPfxPath
    Move "test123" To sPfxPassword

    Get ComLoadPfxFile Of hoCert sPfxPath sPfxPassword To iSuccess
    If (iSuccess <> True) Begin
        Get ComLastErrorText Of hoCert To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get pvComObject of hoCert to vCert
    Get ComSetSigningCert Of hoCrypt vCert To iSuccess

    // Use SHA-256 rather than the default of SHA-1
    Set ComHashAlgorithm Of hoCrypt To "sha256"

    // Create JSON that tells Chilkat what signing attributes to include:
    Get Create (RefClass(cComChilkatJsonObject)) To hoAttrs
    If (Not(IsComObjectCreated(hoAttrs))) Begin
        Send CreateComObject of hoAttrs
    End
    Get ComUpdateBool Of hoAttrs "contentType" True To iSuccess
    Get ComUpdateBool Of hoAttrs "signingTime" True To iSuccess
    Get ComUpdateBool Of hoAttrs "messageDigest" True To iSuccess
    Get ComUpdateBool Of hoAttrs "signingCertificateV2" True To iSuccess

    // A CAdES-T signature is one that includes a timestampToken created by an online TSA (time stamping authority).
    // We must include the TSA's URL, as well as a few options to indicate what is desired.
    // Except for the TSA URL, the options shown here are typically what you would need.
    Get ComUpdateBool Of hoAttrs "timestampToken.enabled" True To iSuccess
    Get ComUpdateString Of hoAttrs "timestampToken.tsaUrl" "https://freetsa.org/tsr" To iSuccess
    Get ComUpdateBool Of hoAttrs "timestampToken.addNonce" False To iSuccess
    Get ComUpdateBool Of hoAttrs "timestampToken.requestTsaCert" True To iSuccess
    Get ComUpdateString Of hoAttrs "timestampToken.hashAlg" "sha256" To iSuccess

    Get ComEmit Of hoAttrs To sTemp1
    Set ComSigningAttributes Of hoCrypt To sTemp1

    Move "qa_data/json/sample.json" To sInFile
    Move "qa_output/sample_cades_t.p7m" To sOutFile

    // This creates the CAdES-T signature.  During the signature creation, it
    // communicates with the TSA to get a timestampToken.
    Get ComCreateP7M Of hoCrypt sInFile sOutFile To iSuccess
    If (iSuccess <> True) Begin
        Get ComLastErrorText Of hoCrypt To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "Success."


End_Procedure