Chilkat HOME .NET Core C# Android™ AutoIt C C# C++ Chilkat2-Python CkPython Classic ASP DataFlex Delphi ActiveX Delphi DLL Go Java Lianja Mono C# Node.js Objective-C PHP ActiveX PHP Extension Perl PowerBuilder PowerShell PureBasic Ruby SQL Server Swift 2 Swift 3,4,5... Tcl Unicode C Unicode C++ VB.NET VBScript Visual Basic 6.0 Visual FoxPro Xojo Plugin
(PHP Extension) XAdES using TSA Requiring Client CertificateSee more XML Digital Signatures ExamplesDemonstrates how to create an XMLDSig (XAdES) signed document which includes an EncapsulatedTimestamp using a TSA (TimeStamp Authority) server requiring client certificate authentication. One such TSA is https://www3.postsignum.cz/TSS/TSS_crt/
<?php // The version number (9_5_0) should match version of the Chilkat extension used, omitting the micro-version number. // For example, if using Chilkat v9.5.0.48, then include as shown here: include("chilkat_9_5_0.php"); // This example requires the Chilkat API to have been previously unlocked. // See Global Unlock Sample for sample code. $success = true; // Load the XML to be signed. For example, the XML to be signed might contain something like this: // <?xml version="1.0" encoding="utf-8"?> // <TransakcniLogSystemu xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://nsess.public.cz/erms_trans/v_01_01" Id="Signature1"> // <TransLogInfo> // <Identifikator>XYZ ABC</Identifikator> // <DatumVzniku>2022-12-20T14:39:02.3625922+01:00</DatumVzniku> // <DatumCasOd>2022-12-20T14:26:26.88</DatumCasOd> // <DatumCasDo>2022-12-20T14:39:02.287</DatumCasDo> // <Software>XYZ</Software> // <VerzeSoftware>2.0.19.32</VerzeSoftware> // </TransLogInfo> // <Udalosti> // <Udalost> // <Poradi>1</Poradi> // ... // Load the XML to be signed from a file. // (XML can be loaded from other source, such as a string variable.) $sbXml = new CkStringBuilder(); $success = $sbXml->LoadFile('xmlToSign.xml','utf-8'); $gen = new CkXmlDSigGen(); $gen->put_SigLocation('TransakcniLogSystemu'); $gen->put_SigLocationMod(0); $gen->put_SigId('SignatureID-Signature1'); $gen->put_SigNamespacePrefix('ds'); $gen->put_SigNamespaceUri('http://www.w3.org/2000/09/xmldsig#'); $gen->put_SignedInfoCanonAlg('C14N'); $gen->put_SignedInfoDigestMethod('sha256'); // Set the KeyInfoId before adding references.. $gen->put_KeyInfoId('KeyInfoId-Signature-Signature1'); // Create an Object to be added to the Signature. // Note: Chilkat will automatically fill in the values marked as "TO BE GENERATED BY CHILKAT" at the time of signing. // The EncapsulatedTimestamp will be automatically generated. $object1 = new CkXml(); $object1->put_Tag('xades:QualifyingProperties'); $object1->AddAttribute('Target','#Signature1'); $object1->UpdateAttrAt('xades:SignedProperties',true,'Id','SignedProperties-Signature-Signature1'); $object1->UpdateChildContent('xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningTime','TO BE GENERATED BY CHILKAT'); $object1->UpdateAttrAt('xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificate|xades:Cert|xades:CertDigest|ds:DigestMethod',true,'Algorithm','http://www.w3.org/2001/04/xmlenc#sha256'); $object1->UpdateChildContent('xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificate|xades:Cert|xades:CertDigest|ds:DigestValue','TO BE GENERATED BY CHILKAT'); $object1->UpdateChildContent('xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificate|xades:Cert|xades:IssuerSerial|ds:X509IssuerName','TO BE GENERATED BY CHILKAT'); $object1->UpdateChildContent('xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificate|xades:Cert|xades:IssuerSerial|ds:X509SerialNumber','TO BE GENERATED BY CHILKAT'); // The EncapsulatedTimestamp will be included in the unsigned properties. $object1->UpdateAttrAt('xades:UnsignedProperties|xades:UnsignedSignatureProperties|xades:SignatureTimeStamp',true,'Id','signature-timestamp-5561-8212-3316-5191'); $object1->UpdateAttrAt('xades:UnsignedProperties|xades:UnsignedSignatureProperties|xades:SignatureTimeStamp|ds:CanonicalizationMethod',true,'Algorithm','http://www.w3.org/2001/10/xml-exc-c14n#'); $object1->UpdateAttrAt('xades:UnsignedProperties|xades:UnsignedSignatureProperties|xades:SignatureTimeStamp|xades:EncapsulatedTimeStamp',true,'Encoding','http://uri.etsi.org/01903/v1.2.2#DER'); $object1->UpdateChildContent('xades:UnsignedProperties|xades:UnsignedSignatureProperties|xades:SignatureTimeStamp|xades:EncapsulatedTimeStamp','TO BE GENERATED BY CHILKAT'); $gen->AddObject('XadesObjectId-Signature1',$object1->getXml(),'',''); // -------- Reference 1 -------- $gen->AddObjectRef('SignedProperties-Signature-Signature1','sha256','EXCL_C14N','','http://uri.etsi.org/01903#SignedProperties'); // -------- Reference 2 -------- $gen->AddSameDocRef('KeyInfoId-Signature-Signature1','sha256','EXCL_C14N','',''); $gen->SetRefIdAttr('KeyInfoId-Signature-Signature1','ReferenceKeyInfo'); // -------- Reference 3 -------- $gen->AddSameDocRef('','sha256','EXCL_C14N','',''); $gen->SetRefIdAttr('','Reference-Signature1'); // Provide a certificate + private key. (PFX password is test123) $cert = new CkCert(); $success = $cert->LoadPfxFile('qa_data/pfx/cert_test123.pfx','test123'); if ($success != true) { print $cert->lastErrorText() . "\n"; exit; } $gen->SetX509Cert($cert,true); $gen->put_KeyInfoType('X509Data'); $gen->put_X509Type('Certificate'); $gen->put_Behaviors('IndentedSignature'); // ------------------------------------------------------------------------------------------- // To have the EncapsulatedTimeStamp automatically added... // 1) Add the <xades:EncapsulatedTimeStamp Encoding="http://uri.etsi.org/01903/v1.2.2#DER">TO BE GENERATED BY CHILKAT</xades:EncapsulatedTimeStamp> // to the unsigned properties. (This was accomplished in the above code.) // 2) Specify the TSA URL (Timestamping Authority URL). // Here we specify the TSA URL: // ------------------------------------------------------------------------------------------- $jsonTsa = new CkJsonObject(); $jsonTsa->UpdateString('timestampToken.tsaUrl','https://www3.postsignum.cz/TSS/TSS_crt/'); $jsonTsa->UpdateBool('timestampToken.requestTsaCert',true); $gen->SetTsa($jsonTsa); // ------------------------------------------------------------------------------------------- // In this case, the TSA requires client certificate authentication. // To provide your client certificate, the application will instantiate a Chilkat HTTP object, // then set it up with a SSL/TLS client certificate, and then tell the XmlDSigGen object // to use the HTTP object for connections to the TSA server. // ------------------------------------------------------------------------------------------- $http = new CkHttp(); $success = $http->SetSslClientCertPfx('/home/bob/pfxFiles/myClientSideCertWithPrivateKey.pfx','pfxPassword'); if ($success != true) { print $http->lastErrorText() . "\n"; exit; } // Tell the XmlDSigGen object to use the above HTTP object for TSA communications. $gen->SetHttpObj($http); // Sign the XML... $success = $gen->CreateXmlDSigSb($sbXml); if ($success != true) { print $gen->lastErrorText() . "\n"; exit; } // ----------------------------------------------- // Save the signed XML to a file. $success = $sbXml->WriteFile('c:/temp/qa_output/signedXml.xml','utf-8',false); print $sbXml->getAsString() . "\n"; ?> |
© 2000-2024 Chilkat Software, Inc. All Rights Reserved.