PureBasic

Create CAdES p7m using AWS KMS to Sign in the Cloud

See more Signing in the Cloud Examples

Demonstrates how to create a CAdES p7m, using AWS KMS. The signing of the hash happens in the Cloud on AWS KMS. Everything else regarding the creation of CAdES happens locally within Chilkat.

Note: This example requires Chilkat v9.5.0.96 or greater.

PureBasic

IncludeFile "CkCert.pb"
IncludeFile "CkJsonObject.pb"
IncludeFile "CkCrypt2.pb"

Procedure ChilkatExample()

    success.i = 0

    ; This example assumes the Chilkat API to have been previously unlocked.
    ; See Global Unlock Sample for sample code.

    ; Load the certificate used for signing.  The certificate's private key is stored in AWS KMS
    ; However, we still need the certificate locally (without private key).
    cert.i = CkCert::ckCreate()
    If cert.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkCert::ckLoadFromFile(cert,"qa_data/certs/myCert.cer")
    If success = 0
        Debug CkCert::ckLastErrorText(cert)
        CkCert::ckDispose(cert)
        ProcedureReturn
    EndIf

    ; Here's a screenshot showing the key ID of a private key in AWS KMS:
    ; (image:https://example-code.com/images/aws_kms.jpg/endImage)

    ; To sign using AWS KMS, 
    ; add the following lines of code to specify your AWS authentication credentials,
    ; and the ID of the KMS private key.
    jsonAwsKms.i = CkJsonObject::ckCreate()
    If jsonAwsKms.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; Set the "service" equal to "aws_kms" to tell Chilkat to use AWS KMS for signing.
    CkJsonObject::ckUpdateString(jsonAwsKms,"service","aws_kms")
    CkJsonObject::ckUpdateString(jsonAwsKms,"access_key","ACCESS_KEY")
    CkJsonObject::ckUpdateString(jsonAwsKms,"secret_key","SECRET_KEY")
    ; Make sure to specify the correct region for your case.
    CkJsonObject::ckUpdateString(jsonAwsKms,"region","us-west-2")
    ; In the above screenshot, our key ID is "187012e8-008f-4fc7-b100-5efe6146dff2".  You will use your key ID.
    CkJsonObject::ckUpdateString(jsonAwsKms,"key_id","187012e8-008f-4fc7-b100-5efe6146dff2")

    success = CkCert::ckSetCloudSigner(cert,jsonAwsKms)

    crypt.i = CkCrypt2::ckCreate()
    If crypt.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkCrypt2::ckSetSigningCert(crypt,cert)
    If success = 0
        Debug CkCrypt2::ckLastErrorText(crypt)
        CkCert::ckDispose(cert)
        CkJsonObject::ckDispose(jsonAwsKms)
        CkCrypt2::ckDispose(crypt)
        ProcedureReturn
    EndIf

    ; The CadesEnabled property applies to all methods that create PKCS7 signatures. 
    ; To create a CAdES-BES signature, set this property equal to true.
    CkCrypt2::setCkCadesEnabled(crypt, 1)

    CkCrypt2::setCkHashAlgorithm(crypt, "sha256")

    signedAttrs.i = CkJsonObject::ckCreate()
    If signedAttrs.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkJsonObject::ckUpdateInt(signedAttrs,"contentType",1)
    CkJsonObject::ckUpdateInt(signedAttrs,"signingTime",1)
    CkJsonObject::ckUpdateInt(signedAttrs,"messageDigest",1)
    CkJsonObject::ckUpdateInt(signedAttrs,"signingCertificateV2",1)
    CkCrypt2::setCkSigningAttributes(crypt, CkJsonObject::ckEmit(signedAttrs))

    ; You can sign any type of file..
    inputXmlPath.s = "qa_data/e-Invoice.xml"
    outputP7mPath.s = "qa_output/signed.p7m"

    ; Create the CAdES-BES attached signature, which contains the original data.
    ; Chilkat will build the .p7m locally, but will (internally) use ARSS
    ; to do the RSA signing remotely.
    success = CkCrypt2::ckCreateP7M(crypt,inputXmlPath,outputP7mPath)
    If success = 0
        Debug CkCrypt2::ckLastErrorText(crypt)
        CkCert::ckDispose(cert)
        CkJsonObject::ckDispose(jsonAwsKms)
        CkCrypt2::ckDispose(crypt)
        CkJsonObject::ckDispose(signedAttrs)
        ProcedureReturn
    EndIf

    Debug "Success."


    CkCert::ckDispose(cert)
    CkJsonObject::ckDispose(jsonAwsKms)
    CkCrypt2::ckDispose(crypt)
    CkJsonObject::ckDispose(signedAttrs)


    ProcedureReturn
EndProcedure