DataFlex
DataFlex
XAdES using TSA Requiring Client Certificate
See more XML Digital Signatures Examples
Demonstrates how to create an XMLDSig (XAdES) signed document which includes an EncapsulatedTimestamp using a TSA (TimeStamp Authority) server requiring client certificate authentication. One such TSA is https://www3.postsignum.cz/TSS/TSS_crt/Chilkat DataFlex Downloads
Use ChilkatAx-win32.pkg
Procedure Test
Boolean iSuccess
Variant vSbXml
Handle hoSbXml
Handle hoGen
Handle hoObject1
Variant vCert
Handle hoCert
Variant vJsonTsa
Handle hoJsonTsa
Variant vHttp
Handle hoHttp
String sTemp1
Move False To iSuccess
// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.
Move True To iSuccess
// Load the XML to be signed. For example, the XML to be signed might contain something like this:
// <?xml version="1.0" encoding="utf-8"?>
// <TransakcniLogSystemu xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://nsess.public.cz/erms_trans/v_01_01" Id="Signature1">
// <TransLogInfo>
// <Identifikator>XYZ ABC</Identifikator>
// <DatumVzniku>2022-12-20T14:39:02.3625922+01:00</DatumVzniku>
// <DatumCasOd>2022-12-20T14:26:26.88</DatumCasOd>
// <DatumCasDo>2022-12-20T14:39:02.287</DatumCasDo>
// <Software>XYZ</Software>
// <VerzeSoftware>2.0.19.32</VerzeSoftware>
// </TransLogInfo>
// <Udalosti>
// <Udalost>
// <Poradi>1</Poradi>
// ...
// Load the XML to be signed from a file.
// (XML can be loaded from other source, such as a string variable.)
Get Create (RefClass(cComChilkatStringBuilder)) To hoSbXml
If (Not(IsComObjectCreated(hoSbXml))) Begin
Send CreateComObject of hoSbXml
End
Get ComLoadFile Of hoSbXml "xmlToSign.xml" "utf-8" To iSuccess
Get Create (RefClass(cComChilkatXmlDSigGen)) To hoGen
If (Not(IsComObjectCreated(hoGen))) Begin
Send CreateComObject of hoGen
End
Set ComSigLocation Of hoGen To "TransakcniLogSystemu"
Set ComSigLocationMod Of hoGen To 0
Set ComSigId Of hoGen To "SignatureID-Signature1"
Set ComSigNamespacePrefix Of hoGen To "ds"
Set ComSigNamespaceUri Of hoGen To "http://www.w3.org/2000/09/xmldsig#"
Set ComSignedInfoCanonAlg Of hoGen To "C14N"
Set ComSignedInfoDigestMethod Of hoGen To "sha256"
// Set the KeyInfoId before adding references..
Set ComKeyInfoId Of hoGen To "KeyInfoId-Signature-Signature1"
// Create an Object to be added to the Signature.
// Note: Chilkat will automatically fill in the values marked as "TO BE GENERATED BY CHILKAT" at the time of signing.
// The EncapsulatedTimestamp will be automatically generated.
Get Create (RefClass(cComChilkatXml)) To hoObject1
If (Not(IsComObjectCreated(hoObject1))) Begin
Send CreateComObject of hoObject1
End
Set ComTag Of hoObject1 To "xades:QualifyingProperties"
Get ComAddAttribute Of hoObject1 "xmlns:xades" "http://uri.etsi.org/01903/v1.3.2#" To iSuccess
Get ComAddAttribute Of hoObject1 "Target" "#Signature1" To iSuccess
Get ComUpdateAttrAt Of hoObject1 "xades:SignedProperties" True "Id" "SignedProperties-Signature-Signature1" To iSuccess
Send ComUpdateChildContent To hoObject1 "xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningTime" "TO BE GENERATED BY CHILKAT"
Get ComUpdateAttrAt Of hoObject1 "xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificateV2|xades:Cert|xades:CertDigest|ds:DigestMethod" True "Algorithm" "http://www.w3.org/2001/04/xmlenc#sha256" To iSuccess
Send ComUpdateChildContent To hoObject1 "xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificateV2|xades:Cert|xades:CertDigest|ds:DigestValue" "TO BE GENERATED BY CHILKAT"
Send ComUpdateChildContent To hoObject1 "xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificateV2|xades:Cert|xades:IssuerSerialV2" "TO BE GENERATED BY CHILKAT"
// The EncapsulatedTimestamp will be included in the unsigned properties.
Get ComUpdateAttrAt Of hoObject1 "xades:UnsignedProperties|xades:UnsignedSignatureProperties|xades:SignatureTimeStamp" True "Id" "signature-timestamp-5561-8212-3316-5191" To iSuccess
Get ComUpdateAttrAt Of hoObject1 "xades:UnsignedProperties|xades:UnsignedSignatureProperties|xades:SignatureTimeStamp|ds:CanonicalizationMethod" True "Algorithm" "http://www.w3.org/2001/10/xml-exc-c14n#" To iSuccess
Get ComUpdateAttrAt Of hoObject1 "xades:UnsignedProperties|xades:UnsignedSignatureProperties|xades:SignatureTimeStamp|xades:EncapsulatedTimeStamp" True "Encoding" "http://uri.etsi.org/01903/v1.2.2#DER" To iSuccess
Send ComUpdateChildContent To hoObject1 "xades:UnsignedProperties|xades:UnsignedSignatureProperties|xades:SignatureTimeStamp|xades:EncapsulatedTimeStamp" "TO BE GENERATED BY CHILKAT"
Get ComGetXml Of hoObject1 To sTemp1
Get ComAddObject Of hoGen "XadesObjectId-Signature1" sTemp1 "" "" To iSuccess
// -------- Reference 1 --------
Get ComAddObjectRef Of hoGen "SignedProperties-Signature-Signature1" "sha256" "EXCL_C14N" "" "http://uri.etsi.org/01903#SignedProperties" To iSuccess
// -------- Reference 2 --------
Get ComAddSameDocRef Of hoGen "KeyInfoId-Signature-Signature1" "sha256" "EXCL_C14N" "" "" To iSuccess
Get ComSetRefIdAttr Of hoGen "KeyInfoId-Signature-Signature1" "ReferenceKeyInfo" To iSuccess
// -------- Reference 3 --------
Get ComAddSameDocRef Of hoGen "" "sha256" "EXCL_C14N" "" "" To iSuccess
Get ComSetRefIdAttr Of hoGen "" "Reference-Signature1" To iSuccess
// Provide a certificate + private key. (PFX password is test123)
Get Create (RefClass(cComChilkatCert)) To hoCert
If (Not(IsComObjectCreated(hoCert))) Begin
Send CreateComObject of hoCert
End
Get ComLoadPfxFile Of hoCert "qa_data/pfx/cert_test123.pfx" "test123" To iSuccess
If (iSuccess <> True) Begin
Get ComLastErrorText Of hoCert To sTemp1
Showln sTemp1
Procedure_Return
End
Get pvComObject of hoCert to vCert
Get ComSetX509Cert Of hoGen vCert True To iSuccess
Set ComKeyInfoType Of hoGen To "X509Data"
Set ComX509Type Of hoGen To "Certificate"
Set ComBehaviors Of hoGen To "IndentedSignature"
// -------------------------------------------------------------------------------------------
// To have the EncapsulatedTimeStamp automatically added...
// 1) Add the <xades:EncapsulatedTimeStamp Encoding="http://uri.etsi.org/01903/v1.2.2#DER">TO BE GENERATED BY CHILKAT</xades:EncapsulatedTimeStamp>
// to the unsigned properties. (This was accomplished in the above code.)
// 2) Specify the TSA URL (Timestamping Authority URL).
// Here we specify the TSA URL:
// -------------------------------------------------------------------------------------------
Get Create (RefClass(cComChilkatJsonObject)) To hoJsonTsa
If (Not(IsComObjectCreated(hoJsonTsa))) Begin
Send CreateComObject of hoJsonTsa
End
Get ComUpdateString Of hoJsonTsa "timestampToken.tsaUrl" "https://www3.postsignum.cz/TSS/TSS_crt/" To iSuccess
Get ComUpdateBool Of hoJsonTsa "timestampToken.requestTsaCert" True To iSuccess
Get pvComObject of hoJsonTsa to vJsonTsa
Get ComSetTsa Of hoGen vJsonTsa To iSuccess
// -------------------------------------------------------------------------------------------
// In this case, the TSA requires client certificate authentication.
// To provide your client certificate, the application will instantiate a Chilkat HTTP object,
// then set it up with a SSL/TLS client certificate, and then tell the XmlDSigGen object
// to use the HTTP object for connections to the TSA server.
// -------------------------------------------------------------------------------------------
Get Create (RefClass(cComChilkatHttp)) To hoHttp
If (Not(IsComObjectCreated(hoHttp))) Begin
Send CreateComObject of hoHttp
End
Get ComSetSslClientCertPfx Of hoHttp "/home/bob/pfxFiles/myClientSideCertWithPrivateKey.pfx" "pfxPassword" To iSuccess
If (iSuccess <> True) Begin
Get ComLastErrorText Of hoHttp To sTemp1
Showln sTemp1
Procedure_Return
End
// Tell the XmlDSigGen object to use the above HTTP object for TSA communications.
Get pvComObject of hoHttp to vHttp
Send ComSetHttpObj To hoGen vHttp
// Sign the XML...
Get pvComObject of hoSbXml to vSbXml
Get ComCreateXmlDSigSb Of hoGen vSbXml To iSuccess
If (iSuccess <> True) Begin
Get ComLastErrorText Of hoGen To sTemp1
Showln sTemp1
Procedure_Return
End
// -----------------------------------------------
// Save the signed XML to a file.
Get ComWriteFile Of hoSbXml "c:/temp/qa_output/signedXml.xml" "utf-8" False To iSuccess
Get ComGetAsString Of hoSbXml To sTemp1
Showln sTemp1
End_Procedure