Perl

Verify Opaque Signature and Retrieve Signing Certificates

See more Digital Signatures Examples

Demonstrates how to verify a PCKS7 opaque digital signature (signed data), extract the original file/data, and then extract the certificate(s) that were used to sign. Perl

use chilkat();

$success = 0;

# This example assumes the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

$crypt = chilkat::CkCrypt2->new();

# Verify a PKCS7 signed-data (opaque signature) file and extract the original content to a file.
$success = $crypt->VerifyP7M("qa_data/p7m/opaqueSig.p7","qa_output/originalData.dat");
if ($success == 0) {
    print $crypt->lastErrorText() . "\r\n";
    exit;
}

# Alternatively, we can do it in memory...
$binData = chilkat::CkBinData->new();
$success = $binData->LoadFile("qa_data/p7m/opaqueSig.p7");
# Your app should check for success, but we'll skip the check for brevity..

# If verified, the signature is unwrapped and binData is replaced with the original data that was signed.
$success = $crypt->OpaqueVerifyBd($binData);
if ($success == 0) {
    print $crypt->lastErrorText() . "\r\n";
    exit;
}

# For our testing, we signed some text, so we can get it from the binData..
print "Original Data:" . "\r\n";
print $binData->getString("utf-8") . "\r\n";

# After any method call that verifies a signature, the crypt object will contain the certificate(s)
# that were used for signing (assuming the X.509 certs were available in the signature, which is typically the case).

# Get each signing certificate, and build the certificate chain for each.
$cert = chilkat::CkCert->new();
$certChain = chilkat::CkCertChain->new();
$numCerts = $crypt->get_NumSignerCerts();
$i = 0;
while ($i < $numCerts) {
    $crypt->LastSignerCert($i,$cert);
    print $cert->subjectDN() . "\r\n";

    $success = $cert->BuildCertChain($certChain);
    if ($success == 0) {
        print $cert->lastErrorText() . "\r\n";
        exit;
    }

    $i = $i + 1;
}