Perl

FatturaPA XML Invoice Sign+Encrypt to P7M

See more Digital Signatures Examples

Demonstrates how to create a CAdES BES signed + encrypted invoice.xml.p7m for the Italian FatturaPA exchange system. Perl

use chilkat();

$success = 0;

# This requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

$crypt = chilkat::CkCrypt2->new();

# Use a digital certificate and private key from a PFX file (.pfx or .p12).
$pfxPath = "qa_data/pfx/cert_test123.pfx";
$pfxPassword = "test123";

$cert = chilkat::CkCert->new();
$success = $cert->LoadPfxFile($pfxPath,$pfxPassword);
if ($success == 0) {
    print $cert->lastErrorText() . "\r\n";
    exit;
}

# Provide the signing cert (with associated private key).
$success = $crypt->SetSigningCert($cert);
if ($success == 0) {
    print $crypt->lastErrorText() . "\r\n";
    exit;
}

# Indicate that SHA-256 should be used.
$crypt->put_HashAlgorithm("sha256");

# Specify the signed attributes to be included.
# (This is what makes it CAdES-BES compliant.)
$jsonSignedAttrs = chilkat::CkJsonObject->new();
$jsonSignedAttrs->UpdateInt("contentType",1);
$jsonSignedAttrs->UpdateInt("signingTime",1);
$jsonSignedAttrs->UpdateInt("messageDigest",1);
$jsonSignedAttrs->UpdateInt("signingCertificateV2",1);
$crypt->put_SigningAttributes($jsonSignedAttrs->emit());

$inFile = "qa_data/xml/IT01234567890_11002.xml";
$sigFile = "qa_data/fatturapa/signed.p7m";

# Create the CAdES-BES signature, which contains the original data.
$success = $crypt->CreateP7M($inFile,$sigFile);
if ($success == 0) {
    print $crypt->lastErrorText() . "\r\n";
    exit;
}

# Now we'll encrypt what was signed using FatturaPA's certificate (from a PEM file)
$encryptCert = chilkat::CkCert->new();
$success = $encryptCert->LoadFromFile("qa_data/certs/fatturapa_cert.pem");
if ($success == 0) {
    print $encryptCert->lastErrorText() . "\r\n";
    exit;
}

$crypt->put_CryptAlgorithm("pki");

$success = $crypt->SetEncryptCert($encryptCert);
if ($success == 0) {
    print $crypt->lastErrorText() . "\r\n";
    exit;
}

# Indicate the underlying bulk encryption algorithm to be used:
$crypt->put_Pkcs7CryptAlg("aes");
$crypt->put_KeyLength(128);

# There's one last option that could be set.  If is the RSA encryption encryption/padding scheme. 
# By default, RSAES_PKCS1-V1_5 is used.  If desired, the OaepPadding property could be set to 1 to
# use RSAES_OAEP.  (We'll leave it set at the default value of 0)
$crypt->put_OaepPadding(0);

# Everything is specified.  Encrypt the .p7m to create a new .p7m (which adds a layer of encryption around the opaque signature).
# The output is PKCS7 in binary DER format.
$success = $crypt->CkEncryptFile($sigFile,"qa_output/signed_and_encrypted.p7m");
if ($success == 0) {
    print $crypt->lastErrorText() . "\r\n";
    exit;
}

print "Success." . "\r\n";