(CkPython) Create a CAdES-T Signature

Demonstrates how to create a signature with an external timestamp that certifies the time of signing. This requires an online TSA (Time Stamping Authority) service that is capable of producing RFC 3161 compliant timestamps.

Note: This example requires Chilkat v9.5.0.78 or greater.

Chilkat Python Downloads install with pip pip3 install chilkat or download... Python Module for Windows, MacOS, Linux, Alpine Linux, Solaris

import sys
import chilkat

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

crypt = chilkat.CkCrypt2()

# This example will use a certificate + private key from a .pfx/.p12 file.
# On Windows systems, it is also possible to use certs on smartcards/usb tokens or certs pre-installed in the Windows registry.
cert = chilkat.CkCert()

pfxPath = "qa_data/pfx/myCertAndKey.p12"
pfxPassword = "test123"

success = cert.LoadPfxFile(pfxPath,pfxPassword)
if (success != True):
    print(cert.lastErrorText())
    sys.exit()

success = crypt.SetSigningCert(cert)

# Use SHA-256 rather than the default of SHA-1
crypt.put_HashAlgorithm("sha256")

# Create JSON that tells Chilkat what signing attributes to include:
attrs = chilkat.CkJsonObject()
attrs.UpdateBool("contentType",True)
attrs.UpdateBool("signingTime",True)
attrs.UpdateBool("messageDigest",True)
attrs.UpdateBool("signingCertificateV2",True)

# A CAdES-T signature is one that includes a timestampToken created by an online TSA (time stamping authority).
# We must include the TSA's URL, as well as a few options to indicate what is desired.
# Except for the TSA URL, the options shown here are typically what you would need.
attrs.UpdateBool("timestampToken.enabled",True)
attrs.UpdateString("timestampToken.tsaUrl","https://freetsa.org/tsr")
attrs.UpdateBool("timestampToken.addNonce",False)
attrs.UpdateBool("timestampToken.requestTsaCert",True)
attrs.UpdateString("timestampToken.hashAlg","sha256")

crypt.put_SigningAttributes(attrs.emit())

inFile = "qa_data/json/sample.json"
outFile = "qa_output/sample_cades_t.p7m"

# This creates the CAdES-T signature.  During the signature creation, it
# communicates with the TSA to get a timestampToken.
success = crypt.CreateP7M(inFile,outFile)
if (success != True):
    print(crypt.lastErrorText())
    sys.exit()

print("Success.")