SQL Server
SQL Server
Sign PDF in the Cloud using AWS CloudHSM
See more Signing in the Cloud Examples
Demonstrates how to sign a PDF using AWS CloudHSM. The signing of the hash happens on a hardware token in AWS CloudHSM. Everything else involving the updating the PDF to add the signature happens locally within Chilkat.Note: This example requires Chilkat v9.5.0.96 or greater.
Chilkat SQL Server Downloads
-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
DECLARE @hr int
-- Important: Do not use nvarchar(max). See the warning about using nvarchar(max).
DECLARE @sTmp0 nvarchar(4000)
DECLARE @success int
SELECT @success = 0
-- This example requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.
-- Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.
DECLARE @pkcs11 int
EXEC @hr = sp_OACreate 'Chilkat.Pkcs11', @pkcs11 OUT
IF @hr <> 0
BEGIN
PRINT 'Failed to create ActiveX component'
RETURN
END
-- Provide the path to the AWS CloudHSM PKCS11 driver.
-- This example runs on Windows, so we'll provide the CloudHSM DLL.
-- If your code runs on Linux, the CloudHSM driver might be at /opt/cloudhsm/lib/libcloudhsm_pkcs11.so
EXEC sp_OASetProperty @pkcs11, 'SharedLibPath', 'C:\Program Files\Amazon\CloudHSM\lib\cloudhsm_pkcs11.dll'
-- Your PIN should be a string containing your crypto user's login and password, with a colon char delimiting.
-- See https://docs.aws.amazon.com/cloudhsm/latest/userguide/pkcs11-pin.html
DECLARE @pin nvarchar(4000)
SELECT @pin = 'user:password'
DECLARE @userType int
SELECT @userType = 1
-- Establish a PKCS logged-on session using the driver (.so, .dylib, or .dll) as specified in the SharedLibPath above.
EXEC sp_OAMethod @pkcs11, 'QuickSession', @success OUT, @userType, @pin
IF @success = 0
BEGIN
EXEC sp_OAGetProperty @pkcs11, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
EXEC @hr = sp_OADestroy @pkcs11
RETURN
END
DECLARE @cert int
EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert OUT
EXEC sp_OAMethod @cert, 'LoadFromFile', @success OUT, 'qa_data/certs/myCert.cer'
IF @success = 0
BEGIN
EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
EXEC @hr = sp_OADestroy @pkcs11
EXEC @hr = sp_OADestroy @cert
RETURN
END
-- Tell the certificate to link with the PKCS11 session.
-- The cert's private key should be installed on the CloudHSM.
-- If there are multiple private keys on the CloudHSM, then Chilkat will automatically
-- locate and use the private key corresponding to the certificate.
EXEC sp_OAMethod @cert, 'LinkPkcs11', @success OUT, @pkcs11
IF @success = 0
BEGIN
EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
EXEC @hr = sp_OADestroy @pkcs11
EXEC @hr = sp_OADestroy @cert
RETURN
END
-- --------------------------------------------------------------------------
-- At this point, we have the cert to be used for signing.
-- Our PDF signing code is the same as for a cert obtained from any other source..
DECLARE @pdf int
EXEC @hr = sp_OACreate 'Chilkat.Pdf', @pdf OUT
-- Load a PDF to be signed.
EXEC sp_OAMethod @pdf, 'LoadFile', @success OUT, 'qa_data/pdf/hello.pdf'
IF @success = 0
BEGIN
EXEC sp_OAGetProperty @pdf, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
EXEC sp_OAMethod @pkcs11, 'CloseSession', @success OUT
EXEC @hr = sp_OADestroy @pkcs11
EXEC @hr = sp_OADestroy @cert
EXEC @hr = sp_OADestroy @pdf
RETURN
END
DECLARE @json int
EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @json OUT
EXEC sp_OAMethod @json, 'UpdateInt', @success OUT, 'page', 1
EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'appearance.y', 'top'
EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'appearance.x', 'left'
EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'appearance.fontScale', '10.0'
EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'signingAlgorithm', 'pss'
EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'hashAlgorithm', 'sha256'
DECLARE @i int
SELECT @i = 0
EXEC sp_OASetProperty @json, 'I', @i
EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'appearance.text[i]', 'Digitaly signed by: Xyz Widgets, Inc.'
SELECT @i = @i + 1
EXEC sp_OASetProperty @json, 'I', @i
EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'appearance.text[i]', 'current_dt'
SELECT @i = @i + 1
EXEC sp_OASetProperty @json, 'I', @i
EXEC sp_OAMethod @json, 'UpdateString', @success OUT, 'appearance.text[i]', 'blah blah blah'
-- The certificate is internally linked to the Pkcs11 object, which is currently in an authenticated session.
EXEC sp_OAMethod @pdf, 'SetSigningCert', @success OUT, @cert
EXEC sp_OAMethod @pdf, 'SignPdf', @success OUT, @json, 'qa_output/out.pdf'
IF @success = 0
BEGIN
EXEC sp_OAGetProperty @pdf, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
EXEC sp_OAMethod @pkcs11, 'CloseSession', @success OUT
EXEC @hr = sp_OADestroy @pkcs11
EXEC @hr = sp_OADestroy @cert
EXEC @hr = sp_OADestroy @pdf
EXEC @hr = sp_OADestroy @json
RETURN
END
-- --------------------------------------------------------------------------
-- Revert to an unauthenticated session by calling Logout.
EXEC sp_OAMethod @pkcs11, 'Logout', @success OUT
IF @success = 0
BEGIN
EXEC sp_OAGetProperty @pkcs11, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
EXEC sp_OAMethod @pkcs11, 'CloseSession', @success OUT
EXEC @hr = sp_OADestroy @pkcs11
EXEC @hr = sp_OADestroy @cert
EXEC @hr = sp_OADestroy @pdf
EXEC @hr = sp_OADestroy @json
RETURN
END
-- When finished, close the session.
-- It is important to close the session (memory leaks will occur if the session is not properly closed).
EXEC sp_OAMethod @pkcs11, 'CloseSession', @success OUT
IF @success = 0
BEGIN
EXEC sp_OAGetProperty @pkcs11, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
EXEC @hr = sp_OADestroy @pkcs11
EXEC @hr = sp_OADestroy @cert
EXEC @hr = sp_OADestroy @pdf
EXEC @hr = sp_OADestroy @json
RETURN
END
PRINT 'Success.'
EXEC @hr = sp_OADestroy @pkcs11
EXEC @hr = sp_OADestroy @cert
EXEC @hr = sp_OADestroy @pdf
EXEC @hr = sp_OADestroy @json
END
GO