(PowerShell) Sign JSON (or any Text) to Create a Detached PKCS7 Signature

Demonstrates how to sign JSON or any string using a certificate + private key from a .p12/.pfx to create a detached PKCS7 signature. (A detached signature is one that does not embed the original signed data.)

Chilkat .NET Downloads Chilkat .NET Assemblies

Add-Type -Path "C:\chilkat\ChilkatDotNet47-9.5.0-x64\ChilkatDotNet47.dll"

# This example assumes the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

$crypt = New-Object Chilkat.Crypt2

$cert = New-Object Chilkat.Cert
$success = $cert.LoadPfxFile("qa_data/pfx/cert_test123.pfx","test123")
if ($success -ne $true) {
    $($cert.LastErrorText)
    exit
}

# Tell the crypt component to use this cert.
$success = $crypt.SetSigningCert($cert)
if ($success -ne $true) {
    $($crypt.LastErrorText)
    exit
}

$crypt.HashAlgorithm = "sha256"

# By default, all the certs in the chain of authentication are included in the signature.
# If desired, we can choose to only include the signing certificate:
$crypt.IncludeCertChain = $false

# Create the detached signature, which does NOT contain the original data.
# To create a PKCS7 signature that contains the original data, see CAdES Sign JSON
$crypt.Charset = "utf-8"

$stringToSign = "{ `"abc`": 123}"
$detachedSig = $crypt.SignString($stringToSign)
if ($crypt.LastMethodSuccess -eq $false) {
    $($crypt.LastErrorText)
    exit
}

# Verify the signature against the original data.
$verified = $crypt.VerifyString($stringToSign,$detachedSig)
if ($verified -eq $false) {
    $($crypt.LastErrorText)
    exit
}

$("Success!")