(Go) Sign JSON (or any Text) to Create a Detached PKCS7 Signature

Demonstrates how to sign JSON or any string using a certificate + private key from a .p12/.pfx to create a detached PKCS7 signature. (A detached signature is one that does not embed the original signed data.)

Chilkat Go Downloads Go Package for Windows, MacOS, Linux, Alpine Linux, Solaris

    // This example assumes the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    crypt := chilkat.NewCrypt2()

    cert := chilkat.NewCert()
    success := cert.LoadPfxFile("qa_data/pfx/cert_test123.pfx","test123")
    if success != true {
        fmt.Println(cert.LastErrorText())
        crypt.DisposeCrypt2()
        cert.DisposeCert()
        return
    }

    // Tell the crypt component to use this cert.
    success = crypt.SetSigningCert(cert)
    if success != true {
        fmt.Println(crypt.LastErrorText())
        crypt.DisposeCrypt2()
        cert.DisposeCert()
        return
    }

    crypt.SetHashAlgorithm("sha256")

    // By default, all the certs in the chain of authentication are included in the signature.
    // If desired, we can choose to only include the signing certificate:
    crypt.SetIncludeCertChain(false)

    // Create the detached signature, which does NOT contain the original data.
    // To create a PKCS7 signature that contains the original data, see CAdES Sign JSON
    crypt.SetCharset("utf-8")

    stringToSign := "{ \"abc\": 123}"
    detachedSig = crypt.SignString(stringToSign)
    if crypt.LastMethodSuccess() == false {
        fmt.Println(crypt.LastErrorText())
        crypt.DisposeCrypt2()
        cert.DisposeCert()
        return
    }

    // Verify the signature against the original data.
    verified := crypt.VerifyString(stringToSign,detachedSig)
    if verified == false {
        fmt.Println(crypt.LastErrorText())
        crypt.DisposeCrypt2()
        cert.DisposeCert()
        return
    }

    fmt.Println("Success!")

    crypt.DisposeCrypt2()
    cert.DisposeCert()