(CkPython) PKCS11 Sign PDF with Smart Card with 2 PINs

See more PKCS11 Examples

Shows how to sign a PDF using a smart card that has one pin for USER, and a 2nd PIN for signing.

Note: This example requires Chilkat v9.5.0.96 or later.

Chilkat Python Downloads install with pip pip3 install chilkat or download... Python Module for Windows, MacOS, Linux, Alpine Linux, Solaris

import sys
import chilkat

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

pkcs11 = chilkat.CkPkcs11()

pkcs11.put_SharedLibPath("C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll")

# --------------------------
# Provide the user PIN here.
# --------------------------
user_pin = "0000"
userType = 1

# Establish a PKCS11 logged-on session using the driver (.so, .dylib, or .dll) as specified in the SharedLibPath above.
success = pkcs11.QuickSession(userType,user_pin)
if (success == False):
    print(pkcs11.lastErrorText())
    sys.exit()

# -----------------------------------------------------------
# Also indicate the context-specific PIN required for signing.
# This is a new feature added in Chilkat v9.5.0.97
# -----------------------------------------------------------
pkcs11.put_SigContextPin("1234")

# Get the certificate (on the smart card) that has a private key.
# There are other ways to locate a certificate on the HSM.
# This example assumes there is a single certificate w/ private key.
cert = chilkat.CkCert()
success = pkcs11.FindCert("privateKey","",cert)
if (success == True):
    print("Cert with private key: " + cert.subjectCN())
else:
    print("No certificates having a private key were found.")
    success = pkcs11.CloseSession()
    sys.exit()

# --------------------------------------------------------------------------
# At this point, we have the cert to be used for signing.
# Our PDF signing code is the same as for a cert obtained from any other source..

pdf = chilkat.CkPdf()

# Load a PDF to be signed.
success = pdf.LoadFile("qa_data/pdf/hello.pdf")
if (success == False):
    print(pdf.lastErrorText())
    success = pkcs11.CloseSession()
    sys.exit()

json = chilkat.CkJsonObject()

json.UpdateInt("page",1)
json.UpdateString("appearance.y","top")
json.UpdateString("appearance.x","left")
json.UpdateString("appearance.fontScale","10.0")
json.UpdateString("signingAlgorithm","pss")
json.UpdateString("hashAlgorithm","sha256")

i = 0
json.put_I(i)
json.UpdateString("appearance.text[i]","Digitaly signed by: Xyz Widgets, Inc.")
i = i + 1
json.put_I(i)
json.UpdateString("appearance.text[i]","current_dt")
i = i + 1
json.put_I(i)
json.UpdateString("appearance.text[i]","blah blah blah")

# The certificate is internally linked to the Pkcs11 object, which is currently in an authenticated session.
success = pdf.SetSigningCert(cert)

success = pdf.SignPdf(json,"qa_output/out.pdf")
if (success == False):
    print(pdf.lastErrorText())
    success = pkcs11.CloseSession()
    sys.exit()

# --------------------------------------------------------------------------

# Revert to an unauthenticated session by calling Logout.
success = pkcs11.Logout()
if (success == False):
    print(pkcs11.lastErrorText())
    success = pkcs11.CloseSession()
    sys.exit()

# When finished, close the session.
# It is important to close the session (memory leaks will occur if the session is not properly closed).
success = pkcs11.CloseSession()
if (success == False):
    print(pkcs11.lastErrorText())
    sys.exit()

print("Success.")