CkPhp Requires Chilkat v11.7.0+

Replace the Authenticode Signature of an Already Signed File

See more Code Signing Examples

Demonstrates how to sign a file that already has an Authenticode signature, for example to sign it with a renewed code signing certificate. Starting in Chilkat v11.7.0, AddSignature removes the existing signature and replaces it with the new one. Before v11.7.0, signing an already signed EXE or DLL added a second signature entry instead. CkPhp

<?php

include("chilkat.php");

$success = false;

//  This example requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  Starting in Chilkat v11.7.0, AddSignature replaces the signature of a file that is already signed.
//  (Before v11.7.0, signing an already signed EXE or DLL added a second signature entry
//  instead of replacing the first.)
//  
//  This applies to every supported file type: EXE, DLL, MSI, PowerShell, and VBScript.

$path = 'C:/someDir/MyApp.exe';

$codeSign = new CkCodeSign();
$sigInfo = new CkJsonObject();
$signerCert = new CkCert();

//  Find out who signed the file.
$valid = $codeSign->VerifySignature($path,$sigInfo);
if ($valid == true) {
    $codeSign->GetSignerCert($signerCert);
    print 'currently signed by: ' . $signerCert->subjectCN() . "\n";
    print 'certificate valid until: ' . $signerCert->validToStr() . "\n";
}
else {
    print 'The file is not signed, or its signature is not valid.' . "\n";
}

//  Load the certificate to sign with.  It must have access to its private key.
$cert = new CkCert();
$success = $cert->LoadPfxFile('C:/someDir/myNewCodeSigningCert.pfx','pfx password');
if ($success == false) {
    print $cert->lastErrorText() . "\n";
    exit;
}

//  Sign with SHA256, and ask a timestamp authority for a timestamp.  A timestamp lets the
//  signature continue to validate after the code signing certificate has expired.
//  
//  {
//    "hashAlg": "sha256",
//    "timestampToken": {
//      "enabled": true,
//      "tsaUrl": "http://timestamp.digicert.com",
//      "requestTsaCert": true,
//      "hashAlg": "sha256"
//    }
//  }
$json = new CkJsonObject();
$json->UpdateString('hashAlg','sha256');
$json->UpdateBool('timestampToken.enabled',true);
$json->UpdateString('timestampToken.tsaUrl','http://timestamp.digicert.com');
$json->UpdateBool('timestampToken.requestTsaCert',true);
$json->UpdateString('timestampToken.hashAlg','sha256');

//  Sign the file.  It is not necessary to call RemoveSignature first:
//  the existing signature is removed and the new signature takes its place.
$success = $codeSign->AddSignature($path,$cert,$json);
if ($success == false) {
    print $codeSign->lastErrorText() . "\n";
    exit;
}

//  The file now has one signature, made with the new certificate.
$valid = $codeSign->VerifySignature($path,$sigInfo);
if ($valid == false) {
    print $codeSign->lastErrorText() . "\n";
    exit;
}

$success = $codeSign->GetSignerCert($signerCert);
if ($success == false) {
    print $codeSign->lastErrorText() . "\n";
    exit;
}

print 'now signed by: ' . $signerCert->subjectCN() . "\n";
print 'certificate valid until: ' . $signerCert->validToStr() . "\n";

?>