(Node.js) PKCS11 Sign PDF with Smart Card with 2 PINs

See more PKCS11 Examples

Shows how to sign a PDF using a smart card that has one pin for USER, and a 2nd PIN for signing.

Note: This example requires Chilkat v9.5.0.96 or later.

Install Chilkat for Node.js and Electron using npm at Chilkat npm packages for Node.js Chilkat npm packages for Electron on Windows, Linux, MacOSX, and ARM

var os = require('os');
if (os.platform() == 'win32') {  
    if (os.arch() == 'ia32') {
        var chilkat = require('@chilkat/ck-node21-win-ia32');
    } else {
        var chilkat = require('@chilkat/ck-node21-win64'); 
    }
} else if (os.platform() == 'linux') {
    if (os.arch() == 'arm') {
        var chilkat = require('@chilkat/ck-node21-arm');
    } else if (os.arch() == 'x86') {
        var chilkat = require('@chilkat/ck-node21-linux32');
    } else {
        var chilkat = require('@chilkat/ck-node21-linux64');
    }
} else if (os.platform() == 'darwin') {
    if (os.arch() == 'arm64') {
        var chilkat = require('@chilkat/ck-node21-mac-m1');
    } else {
        var chilkat = require('@chilkat/ck-node21-macosx');
    }
}

function chilkatExample() {

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

    var pkcs11 = new chilkat.Pkcs11();

    pkcs11.SharedLibPath = "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll";

    // --------------------------
    // Provide the user PIN here.
    // --------------------------
    var user_pin = "0000";
    var userType = 1;

    // Establish a PKCS11 logged-on session using the driver (.so, .dylib, or .dll) as specified in the SharedLibPath above.
    var success = pkcs11.QuickSession(userType,user_pin);
    if (success == false) {
        console.log(pkcs11.LastErrorText);
        return;
    }

    // -----------------------------------------------------------
    // Also indicate the context-specific PIN required for signing.
    // This is a new feature added in Chilkat v9.5.0.97
    // -----------------------------------------------------------
    pkcs11.SigContextPin = "1234";

    // Get the certificate (on the smart card) that has a private key.
    // There are other ways to locate a certificate on the HSM.
    // This example assumes there is a single certificate w/ private key.
    var cert = new chilkat.Cert();
    success = pkcs11.FindCert("privateKey","",cert);
    if (success == true) {
        console.log("Cert with private key: " + cert.SubjectCN);
    }
    else {
        console.log("No certificates having a private key were found.");
        success = pkcs11.CloseSession();
        return;
    }

    // --------------------------------------------------------------------------
    // At this point, we have the cert to be used for signing.
    // Our PDF signing code is the same as for a cert obtained from any other source..

    var pdf = new chilkat.Pdf();

    // Load a PDF to be signed.
    success = pdf.LoadFile("qa_data/pdf/hello.pdf");
    if (success == false) {
        console.log(pdf.LastErrorText);
        success = pkcs11.CloseSession();
        return;
    }

    var json = new chilkat.JsonObject();

    json.UpdateInt("page",1);
    json.UpdateString("appearance.y","top");
    json.UpdateString("appearance.x","left");
    json.UpdateString("appearance.fontScale","10.0");
    json.UpdateString("signingAlgorithm","pss");
    json.UpdateString("hashAlgorithm","sha256");

    var i = 0;
    json.I = i;
    json.UpdateString("appearance.text[i]","Digitaly signed by: Xyz Widgets, Inc.");
    i = i+1;
    json.I = i;
    json.UpdateString("appearance.text[i]","current_dt");
    i = i+1;
    json.I = i;
    json.UpdateString("appearance.text[i]","blah blah blah");

    // The certificate is internally linked to the Pkcs11 object, which is currently in an authenticated session.
    success = pdf.SetSigningCert(cert);

    success = pdf.SignPdf(json,"qa_output/out.pdf");
    if (success == false) {
        console.log(pdf.LastErrorText);
        success = pkcs11.CloseSession();
        return;
    }

    // --------------------------------------------------------------------------

    // Revert to an unauthenticated session by calling Logout.
    success = pkcs11.Logout();
    if (success == false) {
        console.log(pkcs11.LastErrorText);
        success = pkcs11.CloseSession();
        return;
    }

    // When finished, close the session.
    // It is important to close the session (memory leaks will occur if the session is not properly closed).
    success = pkcs11.CloseSession();
    if (success == false) {
        console.log(pkcs11.LastErrorText);
        return;
    }

    console.log("Success.");

}

chilkatExample();