(Visual FoxPro) RFC3161 Timestamp Client - Fetch from Timestamp Authority (TSA) and Verify

Sends an RFC 3161 timestamp request to a TSA (Timestamp Authority) server and validates the timestamp token response.

Note: This example requires Chilkat v9.5.0.75 or greater.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

LOCAL lnSuccess
LOCAL loCrypt
LOCAL lcBase64Hash
LOCAL loHttp
LOCAL loRequestToken
LOCAL lcOptionalPolicyOid
LOCAL lnAddNonce
LOCAL lnRequestTsaCert
LOCAL lcTsaUrl
LOCAL loResp
LOCAL loTimestampReply
LOCAL loTsaCert
LOCAL lnPkiStatus
LOCAL loJson
LOCAL loSigningTime
LOCAL loAuthAttrSigningTimeUtctime
LOCAL lcStrVal
LOCAL lcCertSerialNumber
LOCAL lcCertIssuerCN
LOCAL lcCertDigestAlgOid
LOCAL lcCertDigestAlgName
LOCAL lcContentType
LOCAL lcMessageDigest
LOCAL lcSigningAlgOid
LOCAL lcSigningAlgName
LOCAL lcAuthAttrContentTypeName
LOCAL lcAuthAttrContentTypeOid
LOCAL lcAuthAttrSigningTimeName
LOCAL lcAuthAttrSigningCertificateName
LOCAL lcAuthAttrSigningCertificateDer
LOCAL lcAuthAttrMessageDigestName
LOCAL lcAuthAttrMessageDigestDigest
LOCAL lnTimestampReplyPkiStatusValue
LOCAL lcTimestampReplyPkiStatusMeaning
LOCAL i
LOCAL lnCount_i

* Note: Requires Chilkat v9.5.0.75 or greater.

* This requires the Chilkat API to have been previously unlocked.
* See Global Unlock Sample for sample code.

* First sha-256 hash the data that is to be timestamped.
* In this example, the data is the string "Hello World"

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Crypt2')
loCrypt = CreateObject('Chilkat.Crypt2')
loCrypt.HashAlgorithm = "sha256"
loCrypt.EncodingMode = "base64"
lcBase64Hash = loCrypt.HashStringENC("Hello World")

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Http')
loHttp = CreateObject('Chilkat.Http')

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.BinData')
loRequestToken = CreateObject('Chilkat.BinData')
lcOptionalPolicyOid = ""
lnAddNonce = 0
lnRequestTsaCert = 1

* Create a time-stamp request token
lnSuccess = loHttp.CreateTimestampRequest("sha256",lcBase64Hash,lcOptionalPolicyOid,lnAddNonce,lnRequestTsaCert,loRequestToken)
IF (lnSuccess <> 1) THEN
    ? loHttp.LastErrorText
    RELEASE loCrypt
    RELEASE loHttp
    RELEASE loRequestToken
    CANCEL
ENDIF

* Send the time-stamp request token to the TSA.
* This is the equivalent of the following CURL command:
* curl -H "Content-Type: application/timestamp-query" --data-binary '@file.tsq' https://freetsa.org/tsr > file.tsr
lcTsaUrl = "https://freetsa.org/tsr"
* Another timestamp server you could try is: http://timestamp.digicert.com
lcTsaUrl = "http://timestamp.digicert.com"
loResp = loHttp.PBinaryBd("POST",lcTsaUrl,loRequestToken,"application/timestamp-query",0,0)
IF (loHttp.LastMethodSuccess <> 1) THEN
    ? loHttp.LastErrorText
    RELEASE loCrypt
    RELEASE loHttp
    RELEASE loRequestToken
    CANCEL
ENDIF

* Get the timestamp reply from the HTTP response object.
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.BinData')
loTimestampReply = CreateObject('Chilkat.BinData')
loResp.GetBodyBd(loTimestampReply)
RELEASE loResp

* Show the base64 encoded timestamp reply.
? loTimestampReply.GetEncoded("base64")

* Let's verify the timestamp reply against the TSA's cert, which we've previously downloaded.
* See https://freetsa.org/index_en.php
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Cert')
loTsaCert = CreateObject('Chilkat.Cert')
lnSuccess = loTsaCert.LoadFromFile("qa_data/certs/freetsa.org.cer")
IF (lnSuccess <> 1) THEN
    ? loTsaCert.LastErrorText
    RELEASE loCrypt
    RELEASE loHttp
    RELEASE loRequestToken
    RELEASE loTimestampReply
    RELEASE loTsaCert
    CANCEL
ENDIF

* The VerifyTimestampReply method will return one of the following values:
* -1:  The timestampReply does not contain a valid timestamp reply.
* -2: The  timestampReply is a valid timestamp reply, but failed verification using the public key of the tsaCert.
* 0:  Granted and verified.
* 1: Granted and verified, with mods (see RFC 3161)
* 2: Rejected.
* 3: Waiting.
* 4: Revocation Warning
* 5: Revocation Notification
lnPkiStatus = loHttp.VerifyTimestampReply(loTimestampReply,loTsaCert)
IF (lnPkiStatus < 0) THEN
    ? loHttp.LastErrorText
    RELEASE loCrypt
    RELEASE loHttp
    RELEASE loRequestToken
    RELEASE loTimestampReply
    RELEASE loTsaCert
    CANCEL
ENDIF

? "pkiStatus = " + STR(lnPkiStatus)

loJson = loHttp.LastJsonData()
loJson.EmitCompact = 0
? loJson.Emit()

* The LastJsonData looks like the following.
* Note: The "timestampReply.pkiStatus" portion of the LastJsonData was added in Chilkat v9.5.0.83

* Use this online tool to generate parsing code from sample JSON: 
* Generate Parsing Code from JSON

* {
*   "timestampReply": {
*     "pkiStatus": {
*       "value": 0,
*       "meaning": "granted"
*     }
*   },
*   "pkcs7": {
*     "verify": {
*       "digestAlgorithms": [
*         "sha256"
*       ],
*       "signerInfo": [
*         {
*           "cert": {
*             "serialNumber": "04CD3F8568AE76C61BB0FE7160CCA76D",
*             "issuerCN": "DigiCert SHA2 Assured ID Timestamping CA",
*             "digestAlgOid": "2.16.840.1.101.3.4.2.1",
*             "digestAlgName": "SHA256"
*           },
*           "contentType": "1.2.840.113549.1.9.16.1.4",
*           "signingTime": "200405023019Z",
*           "messageDigest": "f14zOsdnN9vyyV3HjjBiLzNDi1PF28hAFMODxNkNRZs=",
*           "signingAlgOid": "1.2.840.113549.1.1.1",
*           "signingAlgName": "RSA-PKCSV-1_5",
*           "authAttr": {
*             "1.2.840.113549.1.9.3": {
*               "name": "contentType",
*               "oid": "1.2.840.113549.1.9.16.1.4"
*             },
*             "1.2.840.113549.1.9.5": {
*               "name": "signingTime",
*               "utctime": "200405023019Z"
*             },
*             "1.2.840.113549.1.9.16.2.12": {
*               "name": "signingCertificate",
*               "der": "MBowGDAWBBQDJb1QXtqWMC3CL0+gHkwovig0xQ=="
*             },
*             "1.2.840.113549.1.9.4": {
*               "name": "messageDigest",
*               "digest": "f14zOsdnN9vyyV3HjjBiLzNDi1PF28hAFMODxNkNRZs="
*             }
*           }
*         }
*       ]
*     }
*   }
* }

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.DtObj')
loSigningTime = CreateObject('Chilkat.DtObj')
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.DtObj')
loAuthAttrSigningTimeUtctime = CreateObject('Chilkat.DtObj')

lnTimestampReplyPkiStatusValue = loJson.IntOf("timestampReply.pkiStatus.value")
lcTimestampReplyPkiStatusMeaning = loJson.StringOf("timestampReply.pkiStatus.meaning")
i = 0
lnCount_i = loJson.SizeOfArray("pkcs7.verify.digestAlgorithms")
DO WHILE i < lnCount_i
    loJson.I = i
    lcStrVal = loJson.StringOf("pkcs7.verify.digestAlgorithms[i]")
    i = i + 1
ENDDO
i = 0
lnCount_i = loJson.SizeOfArray("pkcs7.verify.signerInfo")
DO WHILE i < lnCount_i
    loJson.I = i
    lcCertSerialNumber = loJson.StringOf("pkcs7.verify.signerInfo[i].cert.serialNumber")
    lcCertIssuerCN = loJson.StringOf("pkcs7.verify.signerInfo[i].cert.issuerCN")
    lcCertDigestAlgOid = loJson.StringOf("pkcs7.verify.signerInfo[i].cert.digestAlgOid")
    lcCertDigestAlgName = loJson.StringOf("pkcs7.verify.signerInfo[i].cert.digestAlgName")
    lcContentType = loJson.StringOf("pkcs7.verify.signerInfo[i].contentType")
    loJson.DtOf("pkcs7.verify.signerInfo[i].signingTime",0,loSigningTime)
    lcMessageDigest = loJson.StringOf("pkcs7.verify.signerInfo[i].messageDigest")
    lcSigningAlgOid = loJson.StringOf("pkcs7.verify.signerInfo[i].signingAlgOid")
    lcSigningAlgName = loJson.StringOf("pkcs7.verify.signerInfo[i].signingAlgName")
    lcAuthAttrContentTypeName = loJson.StringOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.3".name')
    lcAuthAttrContentTypeOid = loJson.StringOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.3".oid')
    lcAuthAttrSigningTimeName = loJson.StringOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.5".name')
    loJson.DtOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.5".utctime',0,loAuthAttrSigningTimeUtctime)
    lcAuthAttrSigningCertificateName = loJson.StringOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.16.2.12".name')
    lcAuthAttrSigningCertificateDer = loJson.StringOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.16.2.12".der')
    lcAuthAttrMessageDigestName = loJson.StringOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.4".name')
    lcAuthAttrMessageDigestDigest = loJson.StringOf('pkcs7.verify.signerInfo[i].authAttr."1.2.840.113549.1.9.4".digest')
    i = i + 1
ENDDO

RELEASE loJson

RELEASE loCrypt
RELEASE loHttp
RELEASE loRequestToken
RELEASE loTimestampReply
RELEASE loTsaCert
RELEASE loSigningTime
RELEASE loAuthAttrSigningTimeUtctime