(DataFlex) PKCS11 Import a Private Key onto the HSM

See more PKCS11 Examples

Demonstrates how to import an existing RSA private key onto the smartcard/token. The imported key is a token object, meaning it stays on the HSM and exists beyond the end of the PKCS11 session.

Note: This example requires Chilkat v9.5.0.96 or later.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

Use ChilkatAx-win32.pkg

Procedure Test
    Handle hoPkcs11
    String sPin
    Integer iUserType
    Boolean iSuccess
    Handle hoCert
    Variant vPrivKey
    Handle hoPrivKey
    Variant vJsonTemplate
    Handle hoJsonTemplate
    UInteger iKeyHandle
    String sTemp1
    Boolean bTemp1

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

    Get Create (RefClass(cComChilkatPkcs11)) To hoPkcs11
    If (Not(IsComObjectCreated(hoPkcs11))) Begin
        Send CreateComObject of hoPkcs11
    End

    // Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
    // (The format of the path will change with the operating system.  Obviously, "C:/" is not used on non-Windows systems.
    Set ComSharedLibPath Of hoPkcs11 To "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll"

    // Establish a logged-on session.
    Move "0000" To sPin
    Move 1 To iUserType
    Get ComQuickSession Of hoPkcs11 iUserType sPin To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Let's import a certificate's private key onto the HSM.
    // First, we'll load the certificate from a .pfx (also known as .p12), which is a file format
    // that also includes the certificate's private key.
    Get Create (RefClass(cComChilkatCert)) To hoCert
    If (Not(IsComObjectCreated(hoCert))) Begin
        Send CreateComObject of hoCert
    End
    Get ComLoadPfxFile Of hoCert "qa_data/pfx/ehealth.fgov.be_testing.p12" "p12_password" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoCert To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Let's get the certificate's private key.
    Get ComExportPrivateKey Of hoCert To vPrivKey
    If (IsComObject(vPrivKey)) Begin
        Get Create (RefClass(cComChilkatPrivateKey)) To hoPrivKey
        Set pvComObject Of hoPrivKey To vPrivKey
    End
    Get ComLastMethodSuccess Of hoCert To bTemp1
    If (bTemp1 = False) Begin
        Get ComLastErrorText Of hoCert To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Build a PKCS11 template to provide additional information about the key to be imported.
    Get Create (RefClass(cComChilkatJsonObject)) To hoJsonTemplate
    If (Not(IsComObjectCreated(hoJsonTemplate))) Begin
        Send CreateComObject of hoJsonTemplate
    End

    // Indicate that the key is to be stored on the token.  It is NOT a session object.
    Get ComUpdateBool Of hoJsonTemplate "token" True To iSuccess

    // Indicate that the key can be used for signing.
    Get ComUpdateBool Of hoJsonTemplate "sign" True To iSuccess

    // Provide an arbitrary ID and label (anything you want).
    // The information in the ID and/or label provides one means for finding the key in future PKCS11 sessions.
    Get ComUpdateString Of hoJsonTemplate "id_hex" "010203040A0B0C0D0E0F" To iSuccess
    Get ComUpdateString Of hoJsonTemplate "label" "ehealth private key" To iSuccess

    // Import the key.  The private key handle is returned on success.  Otherwise 0 is returned.
    // If our only task for now is to simply import the key, we can ignore the returned handle, 
    // other than to check for success/failure.  Otherwise, the handle can be used in other PKCS11 operations.
    // This example just creates the key and does not use the returned handle.
    Get pvComObject of hoJsonTemplate to vJsonTemplate
    Get ComImportPrivateKey Of hoPkcs11 vPrivKey vJsonTemplate To iKeyHandle
    If (iKeyHandle = 0) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
    End
    Else Begin
        Showln "key handle = " iKeyHandle
        Showln "Successfully imported a private key onto the HSM."
    End

    Send Destroy of hoPrivKey

    Get ComLogout Of hoPkcs11 To iSuccess
    Get ComCloseSession Of hoPkcs11 To iSuccess


End_Procedure