(PureBasic) Create CAdES-T Signature using Aruba TSA Server (servizi.arubapec.it)

Demonstrates how to create a signature with an external timestamp (using the Aruba TSA Server) that certifies the time of signing.

Note: This example requires Chilkat v9.5.0.79 or greater.

Chilkat PureBasic Module Download Chilkat PureBasic Module

IncludeFile "CkCert.pb"
IncludeFile "CkJsonObject.pb"
IncludeFile "CkCrypt2.pb"

Procedure ChilkatExample()

    ; This example requires the Chilkat API to have been previously unlocked.
    ; See Global Unlock Sample for sample code.

    crypt.i = CkCrypt2::ckCreate()
    If crypt.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; This example will use a certificate + private key from a .pfx/.p12 file.
    ; On Windows systems, it is also possible to use certs on smartcards/usb tokens or certs pre-installed in the Windows registry.
    cert.i = CkCert::ckCreate()
    If cert.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    pfxPath.s = "qa_data/pfx/myCertAndKey.p12"
    pfxPassword.s = "test123"

    success.i = CkCert::ckLoadPfxFile(cert,pfxPath,pfxPassword)
    If success <> 1
        Debug CkCert::ckLastErrorText(cert)
        CkCrypt2::ckDispose(crypt)
        CkCert::ckDispose(cert)
        ProcedureReturn
    EndIf

    success = CkCrypt2::ckSetSigningCert(crypt,cert)

    ; Use SHA-256 rather than the default of SHA-1
    CkCrypt2::setCkHashAlgorithm(crypt, "sha256")

    ; Create JSON that tells Chilkat what signing attributes to include:
    attrs.i = CkJsonObject::ckCreate()
    If attrs.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkJsonObject::ckUpdateBool(attrs,"contentType",1)
    CkJsonObject::ckUpdateBool(attrs,"signingTime",1)
    CkJsonObject::ckUpdateBool(attrs,"messageDigest",1)
    CkJsonObject::ckUpdateBool(attrs,"signingCertificateV2",1)

    ; A CAdES-T signature is one that includes a timestampToken created by an online TSA (time stamping authority).
    ; We must include the TSA's URL, as well as a few options to indicate what is desired.
    ; This example uses the Aruba TSA server, which requires a login/password for the HTTPS request.
    CkJsonObject::ckUpdateBool(attrs,"timestampToken.enabled",1)
    CkJsonObject::ckUpdateString(attrs,"timestampToken.tsaUrl","https://servizi.arubapec.it/tsa/ngrequest.php")

    ; The tsaUsername/tsaPassword feature was added in Chilkat v9.5.0.79.
    ; Make sure you are using a version of Chilkat that is no older than v9.5.0.79
    CkJsonObject::ckUpdateString(attrs,"timestampToken.tsaUsername","arubaTsaUsername")
    CkJsonObject::ckUpdateString(attrs,"timestampToken.tsaPassword","arubaTsaPassword")

    CkJsonObject::ckUpdateBool(attrs,"timestampToken.addNonce",0)
    CkJsonObject::ckUpdateBool(attrs,"timestampToken.requestTsaCert",1)
    CkJsonObject::ckUpdateString(attrs,"timestampToken.hashAlg","sha256")

    CkCrypt2::setCkSigningAttributes(crypt, CkJsonObject::ckEmit(attrs))

    inFile.s = "qa_data/json/sample.json"
    outFile.s = "qa_output/sample_cades_t.p7m"

    ; This creates the CAdES-T signature.  During the signature creation, it
    ; communicates with the TSA to get a timestampToken.
    success = CkCrypt2::ckCreateP7M(crypt,inFile,outFile)
    If success <> 1
        Debug CkCrypt2::ckLastErrorText(crypt)
        CkCrypt2::ckDispose(crypt)
        CkCert::ckDispose(cert)
        CkJsonObject::ckDispose(attrs)
        ProcedureReturn
    EndIf

    Debug "Success."


    CkCrypt2::ckDispose(crypt)
    CkCert::ckDispose(cert)
    CkJsonObject::ckDispose(attrs)


    ProcedureReturn
EndProcedure