(CkPython) PKCS11 Sign PDF using Certificate and Private Key on Smart Card / USB Token

See more PKCS11 Examples

Sample code showing how to use PKCS11 to sign a PDF with a certificate and private key stored on a smart card or USB token.

Note: This example requires Chilkat v9.5.0.96 or later.

Chilkat Python Downloads install with pip pip3 install chilkat or download... Python Module for Windows, MacOS, Linux, Alpine Linux, Solaris

import sys
import chilkat

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

pkcs11 = chilkat.CkPkcs11()

pkcs11.put_SharedLibPath("C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll")
pin = "0000"
userType = 1

# Establish a PKCS11 logged-on session using the driver (.so, .dylib, or .dll) as specified in the SharedLibPath above.
success = pkcs11.QuickSession(userType,pin)
if (success == False):
    print(pkcs11.lastErrorText())
    sys.exit()

# Get the certificate (on the smart card) that has a private key.
# There are other ways to locate a certificate on the HSM.
# This example assumes there is a single certificate w/ private key.
cert = chilkat.CkCert()
success = pkcs11.FindCert("privateKey","",cert)
if (success == True):
    print("Cert with private key: " + cert.subjectCN())
else:
    print("No certificates having a private key were found.")
    success = pkcs11.CloseSession()
    sys.exit()

# --------------------------------------------------------------------------
# At this point, we have the cert to be used for signing.
# Our PDF signing code is the same as for a cert obtained from any other source..

pdf = chilkat.CkPdf()

# Load a PDF to be signed.
success = pdf.LoadFile("qa_data/pdf/hello.pdf")
if (success == False):
    print(pdf.lastErrorText())
    success = pkcs11.CloseSession()
    sys.exit()

json = chilkat.CkJsonObject()

json.UpdateInt("page",1)
json.UpdateString("appearance.y","top")
json.UpdateString("appearance.x","left")
json.UpdateString("appearance.fontScale","10.0")
json.UpdateString("signingAlgorithm","pss")
json.UpdateString("hashAlgorithm","sha256")

i = 0
json.put_I(i)
json.UpdateString("appearance.text[i]","Digitaly signed by: Xyz Widgets, Inc.")
i = i + 1
json.put_I(i)
json.UpdateString("appearance.text[i]","current_dt")
i = i + 1
json.put_I(i)
json.UpdateString("appearance.text[i]","blah blah blah")

# The certificate is internally linked to the Pkcs11 object, which is currently in an authenticated session.
success = pdf.SetSigningCert(cert)

success = pdf.SignPdf(json,"qa_output/out.pdf")
if (success == False):
    print(pdf.lastErrorText())
    success = pkcs11.CloseSession()
    sys.exit()

# --------------------------------------------------------------------------

# Revert to an unauthenticated session by calling Logout.
success = pkcs11.Logout()
if (success == False):
    print(pkcs11.lastErrorText())
    success = pkcs11.CloseSession()
    sys.exit()

# When finished, close the session.
# It is important to close the session (memory leaks will occur if the session is not properly closed).
success = pkcs11.CloseSession()
if (success == False):
    print(pkcs11.lastErrorText())
    sys.exit()

print("Success.")