Delphi ActiveX Requires Chilkat v11.7.0+

Replace the Authenticode Signature of an Already Signed File

See more Code Signing Examples

Demonstrates how to sign a file that already has an Authenticode signature, for example to sign it with a renewed code signing certificate. Starting in Chilkat v11.7.0, AddSignature removes the existing signature and replaces it with the new one. Before v11.7.0, signing an already signed EXE or DLL added a second signature entry instead. Delphi ActiveX

var
success: Integer;
path: WideString;
codeSign: TChilkatCodeSign;
sigInfo: TChilkatJsonObject;
signerCert: TChilkatCert;
valid: Integer;
cert: TChilkatCert;
json: TChilkatJsonObject;

begin
success := 0;

//  This example requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  Starting in Chilkat v11.7.0, AddSignature replaces the signature of a file that is already signed.
//  (Before v11.7.0, signing an already signed EXE or DLL added a second signature entry
//  instead of replacing the first.)
//  
//  This applies to every supported file type: EXE, DLL, MSI, PowerShell, and VBScript.

path := 'C:/someDir/MyApp.exe';

codeSign := TChilkatCodeSign.Create(Self);
sigInfo := TChilkatJsonObject.Create(Self);
signerCert := TChilkatCert.Create(Self);

//  Find out who signed the file.
valid := codeSign.VerifySignature(path,sigInfo.ControlInterface);
if (valid = 1) then
  begin
    codeSign.GetSignerCert(signerCert.ControlInterface);
    Memo1.Lines.Add('currently signed by: ' + signerCert.SubjectCN);
    Memo1.Lines.Add('certificate valid until: ' + signerCert.ValidToStr);
  end
else
  begin
    Memo1.Lines.Add('The file is not signed, or its signature is not valid.');
  end;

//  Load the certificate to sign with.  It must have access to its private key.
cert := TChilkatCert.Create(Self);
success := cert.LoadPfxFile('C:/someDir/myNewCodeSigningCert.pfx','pfx password');
if (success = 0) then
  begin
    Memo1.Lines.Add(cert.LastErrorText);
    Exit;
  end;

//  Sign with SHA256, and ask a timestamp authority for a timestamp.  A timestamp lets the
//  signature continue to validate after the code signing certificate has expired.
//  
//  {
//    "hashAlg": "sha256",
//    "timestampToken": {
//      "enabled": true,
//      "tsaUrl": "http://timestamp.digicert.com",
//      "requestTsaCert": true,
//      "hashAlg": "sha256"
//    }
//  }
json := TChilkatJsonObject.Create(Self);
json.UpdateString('hashAlg','sha256');
json.UpdateBool('timestampToken.enabled',1);
json.UpdateString('timestampToken.tsaUrl','http://timestamp.digicert.com');
json.UpdateBool('timestampToken.requestTsaCert',1);
json.UpdateString('timestampToken.hashAlg','sha256');

//  Sign the file.  It is not necessary to call RemoveSignature first:
//  the existing signature is removed and the new signature takes its place.
success := codeSign.AddSignature(path,cert.ControlInterface,json.ControlInterface);
if (success = 0) then
  begin
    Memo1.Lines.Add(codeSign.LastErrorText);
    Exit;
  end;

//  The file now has one signature, made with the new certificate.
valid := codeSign.VerifySignature(path,sigInfo.ControlInterface);
if (valid = 0) then
  begin
    Memo1.Lines.Add(codeSign.LastErrorText);
    Exit;
  end;

success := codeSign.GetSignerCert(signerCert.ControlInterface);
if (success = 0) then
  begin
    Memo1.Lines.Add(codeSign.LastErrorText);
    Exit;
  end;

Memo1.Lines.Add('now signed by: ' + signerCert.SubjectCN);
Memo1.Lines.Add('certificate valid until: ' + signerCert.ValidToStr);