(CkPython) CMS Sign Hash

Demonstrates how to use the SignHashENC method to sign a pre-computed hash. This method creates a CMS signature (PKCS7 detached signature).

This example requires Chilkat v9.5.0.90 or later.

Chilkat Python Downloads install with pip pip3 install chilkat or download... Python Module for Windows, MacOS, Linux, Alpine Linux, Solaris

import sys
import chilkat

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

crypt = chilkat.CkCrypt2()

# Create the hash to be signed...
crypt.put_HashAlgorithm("sha256")
crypt.put_EncodingMode("base64")
crypt.put_Charset("utf-8")
# Create the SHA256 hash of a string using the utf-8 byte representation.
# Return the hash as base64.
base64Hash = crypt.hashStringENC("This is the string to be hashed")

# Load a certificate for signing.
cert = chilkat.CkCert()
success = cert.LoadPfxFile("qa_data/pfx/cert_test123.pfx","test123")
if (success == False):
    print(cert.lastErrorText())
    sys.exit()

crypt.SetSigningCert(cert)

# Sign the hash to create a base64 CMS signature (which does not contain the original data).
# We can get the signature in a single line of base64 by specifying "base64", or 
# we can get multi-line base64 by specifying "base64_mime".
crypt.put_EncodingMode("base64_mime")
base64CmsSig = crypt.signHashENC(base64Hash,"sha256","base64")
if (crypt.get_LastMethodSuccess() == False):
    print(crypt.lastErrorText())
    sys.exit()

# Note: In the above call to SignHashENC, the encoding of the returned CMS signature is specified by the EncodingMode property.
# However, the encoding of the passed-in hash is indicated by the 3rd argument.

print("CMS Signature: " + base64CmsSig)