(SQL Server) Create a CAdES-T Signature

Demonstrates how to create a signature with an external timestamp that certifies the time of signing. This requires an online TSA (Time Stamping Authority) service that is capable of producing RFC 3161 compliant timestamps.

Note: This example requires Chilkat v9.5.0.78 or greater.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    -- This example requires the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    DECLARE @crypt int
    -- Use "Chilkat_9_5_0.Crypt2" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @crypt OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    -- This example will use a certificate + private key from a .pfx/.p12 file.
    -- On Windows systems, it is also possible to use certs on smartcards/usb tokens or certs pre-installed in the Windows registry.
    DECLARE @cert int
    -- Use "Chilkat_9_5_0.Cert" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert OUT

    DECLARE @pfxPath nvarchar(4000)
    SELECT @pfxPath = 'qa_data/pfx/myCertAndKey.p12'
    DECLARE @pfxPassword nvarchar(4000)
    SELECT @pfxPassword = 'test123'

    DECLARE @success int
    EXEC sp_OAMethod @cert, 'LoadPfxFile', @success OUT, @pfxPath, @pfxPassword
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    EXEC sp_OAMethod @crypt, 'SetSigningCert', @success OUT, @cert

    -- Use SHA-256 rather than the default of SHA-1
    EXEC sp_OASetProperty @crypt, 'HashAlgorithm', 'sha256'

    -- Create JSON that tells Chilkat what signing attributes to include:
    DECLARE @attrs int
    -- Use "Chilkat_9_5_0.JsonObject" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @attrs OUT

    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'contentType', 1
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'signingTime', 1
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'messageDigest', 1
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'signingCertificateV2', 1

    -- A CAdES-T signature is one that includes a timestampToken created by an online TSA (time stamping authority).
    -- We must include the TSA's URL, as well as a few options to indicate what is desired.
    -- Except for the TSA URL, the options shown here are typically what you would need.
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'timestampToken.enabled', 1
    EXEC sp_OAMethod @attrs, 'UpdateString', @success OUT, 'timestampToken.tsaUrl', 'https://freetsa.org/tsr'
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'timestampToken.addNonce', 0
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'timestampToken.requestTsaCert', 1
    EXEC sp_OAMethod @attrs, 'UpdateString', @success OUT, 'timestampToken.hashAlg', 'sha256'

    EXEC sp_OAMethod @attrs, 'Emit', @sTmp0 OUT
    EXEC sp_OASetProperty @crypt, 'SigningAttributes', @sTmp0

    DECLARE @inFile nvarchar(4000)
    SELECT @inFile = 'qa_data/json/sample.json'
    DECLARE @outFile nvarchar(4000)
    SELECT @outFile = 'qa_output/sample_cades_t.p7m'

    -- This creates the CAdES-T signature.  During the signature creation, it
    -- communicates with the TSA to get a timestampToken.
    EXEC sp_OAMethod @crypt, 'CreateP7M', @success OUT, @inFile, @outFile
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @attrs
        RETURN
      END


    PRINT 'Success.'

    EXEC @hr = sp_OADestroy @crypt
    EXEC @hr = sp_OADestroy @cert
    EXEC @hr = sp_OADestroy @attrs


END
GO