(Delphi DLL) Create XAdES using Smart Card or USB Token

Demonstrates how to create an XAdES signed XML document using a certificate located on a smartcard or USB token.

Note: This example requires Chilkat v9.5.0.75 or greater. Also, at the time of this writing this example is restricted to the Windows operating system.

Chilkat for Delphi Downloads Chilkat non-ActiveX DLL for Delphi Chilkat ActiveX DLL for Delphi * The examples here use the non-ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, StringBuilder, XmlDSigGen, Xml, XmlDSig, Cert;

...

procedure TForm1.Button1Click(Sender: TObject);
var
xmlToSign: HCkXml;
success: Boolean;
gen: HCkXmlDSigGen;
object1: HCkXml;
cert: HCkCert;
sbXml: HCkStringBuilder;
verifier: HCkXmlDSig;
verified: Boolean;

begin
// ----------------------------------------------------------------------
// IMPORTANT: This generated example requires Chilkat v9.5.0.75 or later.
// Contact support@chilkatsoft.com for a pre-release.
// ----------------------------------------------------------------------

// Load the XML to be signed.
xmlToSign := CkXml_Create();
success := CkXml_LoadXmlFile(xmlToSign,'qa_data/fattura_electronica/docToSign.xml');
if (success <> True) then
  begin
    Memo1.Lines.Add(CkXml__lastErrorText(xmlToSign));
    Exit;
  end;

gen := CkXmlDSigGen_Create();

CkXmlDSigGen_putSigLocation(gen,'p:FatturaElettronica');
CkXmlDSigGen_putSigId(gen,'xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504');
CkXmlDSigGen_putSigNamespacePrefix(gen,'ds');
CkXmlDSigGen_putSigNamespaceUri(gen,'http://www.w3.org/2000/09/xmldsig#');
CkXmlDSigGen_putSigValueId(gen,'xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504-sigvalue');
CkXmlDSigGen_putSignedInfoCanonAlg(gen,'C14N');
CkXmlDSigGen_putSignedInfoDigestMethod(gen,'sha256');

// Create an Object to be added to the Signature.
// Note: Chilkat will automatically populate the strings indicated by "TO BE GENERATED BY CHILKAT" with actual/correct values
// when the XML is signed.
object1 := CkXml_Create();
CkXml_putTag(object1,'xades:QualifyingProperties');
CkXml_AddAttribute(object1,'xmlns:xades','http://uri.etsi.org/01903/v1.3.2#');
CkXml_AddAttribute(object1,'xmlns:xades141','http://uri.etsi.org/01903/v1.4.1#');
CkXml_AddAttribute(object1,'Target','#xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504');
CkXml_UpdateAttrAt(object1,'xades:SignedProperties',True,'Id','xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504-signedprops');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningTime','TO BE GENERATED BY CHILKAT');
CkXml_UpdateAttrAt(object1,'xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificate|xades:Cert|xades:CertDigest|ds:DigestMethod',True,'Algorithm','http://www.w3.org/2001/04/xmlenc#sha256');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificate|xades:Cert|xades:CertDigest|ds:DigestValue','TO BE GENERATED BY CHILKAT');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificate|xades:Cert|xades:IssuerSerial|ds:X509IssuerName','TO BE GENERATED BY CHILKAT');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificate|xades:Cert|xades:IssuerSerial|ds:X509SerialNumber','TO BE GENERATED BY CHILKAT');

CkXmlDSigGen_AddObject(gen,'',CkXml__getXml(object1),'','');

// -------- Reference 1 --------
CkXmlDSigGen_putKeyInfoId(gen,'xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504-keyinfo');
CkXmlDSigGen_AddSameDocRef(gen,'xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504-keyinfo','sha256','','','');

// -------- Reference 2 --------
CkXmlDSigGen_AddSameDocRef(gen,'','sha256','','','');
CkXmlDSigGen_SetRefIdAttr(gen,'','xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504-ref0');

// -------- Reference 3 --------
CkXmlDSigGen_AddObjectRef(gen,'xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504-signedprops','sha256','','','http://uri.etsi.org/01903#SignedProperties');

// ----------------------------------------------------------------
//  Load a certificate that has been pre-installed on the Windows system
//  This includes certificates on smartcards and USB tokens
cert := CkCert_Create();

//  You may provide the PIN here..
CkCert_putSmartCardPin(cert,'000000');

// Load the certificate on the smartcard currently in the reader (or on the USB token).
// Pass an empty string to allow Chilkat to automatically choose the CSP (Cryptographi Service Provider).
// See Load Certificate on Smartcard for information about explicitly selecting a particular CSP.
success := CkCert_LoadFromSmartcard(cert,'');
if (success <> True) then
  begin
    Memo1.Lines.Add(CkCert__lastErrorText(cert));
    Exit;
  end;

CkXmlDSigGen_SetX509Cert(gen,cert,True);
CkXmlDSigGen_putKeyInfoType(gen,'X509Data');
CkXmlDSigGen_putX509Type(gen,'Certificate');

// Load XML to be signed...
sbXml := CkStringBuilder_Create();
CkXml_GetXmlSb(xmlToSign,sbXml);

CkXmlDSigGen_putBehaviors(gen,'IndentedSignature,ForceAddEnvelopedSignatureTransform');

// Sign the XML...
success := CkXmlDSigGen_CreateXmlDSigSb(gen,sbXml);
if (success <> True) then
  begin
    Memo1.Lines.Add(CkXmlDSigGen__lastErrorText(gen));
    Exit;
  end;

// Save the signed XMl to a file.
success := CkStringBuilder_WriteFile(sbXml,'qa_output/signedXml.xml','utf-8',False);

Memo1.Lines.Add(CkStringBuilder__getAsString(sbXml));

// ----------------------------------------
// Verify the signature we just produced...
verifier := CkXmlDSig_Create();
success := CkXmlDSig_LoadSignatureSb(verifier,sbXml);
if (success <> True) then
  begin
    Memo1.Lines.Add(CkXmlDSig__lastErrorText(verifier));
    Exit;
  end;

verified := CkXmlDSig_VerifySignature(verifier,True);
if (verified <> True) then
  begin
    Memo1.Lines.Add(CkXmlDSig__lastErrorText(verifier));
    Exit;
  end;
Memo1.Lines.Add('This signature was successfully verified.');

CkXml_Dispose(xmlToSign);
CkXmlDSigGen_Dispose(gen);
CkXml_Dispose(object1);
CkCert_Dispose(cert);
CkStringBuilder_Dispose(sbXml);
CkXmlDSig_Dispose(verifier);

end;