(CkPython) FatturaPA XML Invoice Sign+Encrypt to P7M

Demonstrates how to create a CAdES BES signed + encrypted invoice.xml.p7m for the Italian FatturaPA exchange system.

Note: This example requires Chilkat v9.5.0.75 or greater.

Chilkat Python Downloads install with pip pip3 install chilkat or download... Python Module for Windows, MacOS, Linux, Alpine Linux, Solaris

import sys
import chilkat

# Note: Requires Chilkat v9.5.0.75 or greater.

# This requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

crypt = chilkat.CkCrypt2()

# Use a digital certificate and private key from a PFX file (.pfx or .p12).
pfxPath = "qa_data/pfx/cert_test123.pfx"
pfxPassword = "test123"

cert = chilkat.CkCert()
success = cert.LoadPfxFile(pfxPath,pfxPassword)
if (success != True):
    print(cert.lastErrorText())
    sys.exit()

# Provide the signing cert (with associated private key).
success = crypt.SetSigningCert(cert)
if (success != True):
    print(crypt.lastErrorText())
    sys.exit()

# Indicate that SHA-256 should be used.
crypt.put_HashAlgorithm("sha256")

# Specify the signed attributes to be included.
# (This is what makes it CAdES-BES compliant.)
jsonSignedAttrs = chilkat.CkJsonObject()
jsonSignedAttrs.UpdateInt("contentType",1)
jsonSignedAttrs.UpdateInt("signingTime",1)
jsonSignedAttrs.UpdateInt("messageDigest",1)
jsonSignedAttrs.UpdateInt("signingCertificateV2",1)
crypt.put_SigningAttributes(jsonSignedAttrs.emit())

inFile = "qa_data/xml/IT01234567890_11002.xml"
sigFile = "qa_data/fatturapa/signed.p7m"

# Create the CAdES-BES signature, which contains the original data.
success = crypt.CreateP7M(inFile,sigFile)
if (success == False):
    print(crypt.lastErrorText())
    sys.exit()

# Now we'll encrypt what was signed using FatturaPA's certificate (from a PEM file)
encryptCert = chilkat.CkCert()
success = encryptCert.LoadFromFile("qa_data/certs/fatturapa_cert.pem")
if (success != True):
    print(encryptCert.lastErrorText())
    sys.exit()

crypt.put_CryptAlgorithm("pki")

success = crypt.SetEncryptCert(encryptCert)
if (success != True):
    print(crypt.lastErrorText())
    sys.exit()

# Indicate the underlying bulk encryption algorithm to be used:
crypt.put_Pkcs7CryptAlg("aes")
crypt.put_KeyLength(128)

# There's one last option that could be set.  If is the RSA encryption encryption/padding scheme. 
# By default, RSAES_PKCS1-V1_5 is used.  If desired, the OaepPadding property could be set to True to
# use RSAES_OAEP.  (We'll leave it set at the default value of False)
crypt.put_OaepPadding(False)

# Everything is specified.  Encrypt the .p7m to create a new .p7m (which adds a layer of encryption around the opaque signature).
# The output is PKCS7 in binary DER format.
success = crypt.CkEncryptFile(sigFile,"qa_output/signed_and_encrypted.p7m")
if (success != True):
    print(crypt.lastErrorText())
    sys.exit()

print("Success.")