(PHP ActiveX) Create XAdES using Smart Card or USB Token

Demonstrates how to create an XAdES signed XML document using a certificate located on a smartcard or USB token.

Note: This example requires Chilkat v9.5.0.75 or greater. Also, at the time of this writing this example is restricted to the Windows operating system.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows Note: The php_com_dotnet.dll may need to be enabled inside of php.ini.

<?php

// ----------------------------------------------------------------------
// IMPORTANT: This generated example requires Chilkat v9.5.0.75 or later.
// Contact support@chilkatsoft.com for a pre-release.
// ----------------------------------------------------------------------

// Load the XML to be signed.
// For versions of Chilkat < 10.0.0, use new COM('Chilkat_9_5_0.Chilkat.Xml')
$xmlToSign = new COM("Chilkat.Xml");
$success = $xmlToSign->LoadXmlFile('qa_data/fattura_electronica/docToSign.xml');
if ($success != 1) {
    print $xmlToSign->LastErrorText . "\n";
    exit;
}

// For versions of Chilkat < 10.0.0, use new COM('Chilkat_9_5_0.Chilkat.XmlDSigGen')
$gen = new COM("Chilkat.XmlDSigGen");

$gen->SigLocation = 'p:FatturaElettronica';
$gen->SigId = 'xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504';
$gen->SigNamespacePrefix = 'ds';
$gen->SigNamespaceUri = 'http://www.w3.org/2000/09/xmldsig#';
$gen->SigValueId = 'xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504-sigvalue';
$gen->SignedInfoCanonAlg = 'C14N';
$gen->SignedInfoDigestMethod = 'sha256';

// Create an Object to be added to the Signature.
// Note: Chilkat will automatically populate the strings indicated by "TO BE GENERATED BY CHILKAT" with actual/correct values
// when the XML is signed.
// For versions of Chilkat < 10.0.0, use new COM('Chilkat_9_5_0.Chilkat.Xml')
$object1 = new COM("Chilkat.Xml");
$object1->Tag = 'xades:QualifyingProperties';
$object1->AddAttribute('xmlns:xades','http://uri.etsi.org/01903/v1.3.2#');
$object1->AddAttribute('xmlns:xades141','http://uri.etsi.org/01903/v1.4.1#');
$object1->AddAttribute('Target','#xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504');
$object1->UpdateAttrAt('xades:SignedProperties',1,'Id','xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504-signedprops');
$object1->UpdateChildContent('xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningTime','TO BE GENERATED BY CHILKAT');
$object1->UpdateAttrAt('xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificate|xades:Cert|xades:CertDigest|ds:DigestMethod',1,'Algorithm','http://www.w3.org/2001/04/xmlenc#sha256');
$object1->UpdateChildContent('xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificate|xades:Cert|xades:CertDigest|ds:DigestValue','TO BE GENERATED BY CHILKAT');
$object1->UpdateChildContent('xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificate|xades:Cert|xades:IssuerSerial|ds:X509IssuerName','TO BE GENERATED BY CHILKAT');
$object1->UpdateChildContent('xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificate|xades:Cert|xades:IssuerSerial|ds:X509SerialNumber','TO BE GENERATED BY CHILKAT');

$gen->AddObject('',$object1->getXml(),'','');

// -------- Reference 1 --------
$gen->KeyInfoId = 'xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504-keyinfo';
$gen->AddSameDocRef('xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504-keyinfo','sha256','','','');

// -------- Reference 2 --------
$gen->AddSameDocRef('','sha256','','','');
$gen->SetRefIdAttr('','xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504-ref0');

// -------- Reference 3 --------
$gen->AddObjectRef('xmldsig-6f4b994a-7191-4bb1-ab3c-17549515b504-signedprops','sha256','','','http://uri.etsi.org/01903#SignedProperties');

// ----------------------------------------------------------------
//  Load a certificate that has been pre-installed on the Windows system
//  This includes certificates on smartcards and USB tokens
// For versions of Chilkat < 10.0.0, use new COM('Chilkat_9_5_0.Chilkat.Cert')
$cert = new COM("Chilkat.Cert");

//  You may provide the PIN here..
$cert->SmartCardPin = '000000';

// Load the certificate on the smartcard currently in the reader (or on the USB token).
// Pass an empty string to allow Chilkat to automatically choose the CSP (Cryptographi Service Provider).
// See Load Certificate on Smartcard for information about explicitly selecting a particular CSP.
$success = $cert->LoadFromSmartcard('');
if ($success != 1) {
    print $cert->LastErrorText . "\n";
    exit;
}

$gen->SetX509Cert($cert,1);
$gen->KeyInfoType = 'X509Data';
$gen->X509Type = 'Certificate';

// Load XML to be signed...
// For versions of Chilkat < 10.0.0, use new COM('Chilkat_9_5_0.Chilkat.StringBuilder')
$sbXml = new COM("Chilkat.StringBuilder");
$xmlToSign->GetXmlSb($sbXml);

$gen->Behaviors = 'IndentedSignature,ForceAddEnvelopedSignatureTransform';

// Sign the XML...
$success = $gen->CreateXmlDSigSb($sbXml);
if ($success != 1) {
    print $gen->LastErrorText . "\n";
    exit;
}

// Save the signed XMl to a file.
$success = $sbXml->WriteFile('qa_output/signedXml.xml','utf-8',0);

print $sbXml->getAsString() . "\n";

// ----------------------------------------
// Verify the signature we just produced...
// For versions of Chilkat < 10.0.0, use new COM('Chilkat_9_5_0.Chilkat.XmlDSig')
$verifier = new COM("Chilkat.XmlDSig");
$success = $verifier->LoadSignatureSb($sbXml);
if ($success != 1) {
    print $verifier->LastErrorText . "\n";
    exit;
}

$verified = $verifier->VerifySignature(1);
if ($verified != 1) {
    print $verifier->LastErrorText . "\n";
    exit;
}

print 'This signature was successfully verified.' . "\n";

?>