(SQL Server) Sign String to create a CAdES-T Signature

This example will sign a string to create a CAdEST-T signature.

Note: This example requires Chilkat v9.5.0.78 or greater.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    -- This example requires the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    DECLARE @crypt int
    -- Use "Chilkat_9_5_0.Crypt2" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @crypt OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    -- This example will use the certificate + private key currently inserted into a smartcard reader.
    DECLARE @cert int
    -- Use "Chilkat_9_5_0.Cert" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert OUT

    -- If we wish to provide the smartcard PIN (otherwise the user will be prompted by the operating system).
    EXEC sp_OASetProperty @cert, 'SmartCardPin', '000000'
    DECLARE @success int
    EXEC sp_OAMethod @cert, 'LoadFromSmartcard', @success OUT, ''
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    -- Note: It is also possible to use certs from .pfx/.p12, .pem, or other sources such as 
    -- pre-installed Windows certificates.

    EXEC sp_OAMethod @crypt, 'SetSigningCert', @success OUT, @cert

    -- Use SHA-256 rather than the default of SHA-1
    EXEC sp_OASetProperty @crypt, 'HashAlgorithm', 'sha256'

    -- Create JSON that tells Chilkat what signing attributes to include:
    DECLARE @attrs int
    -- Use "Chilkat_9_5_0.JsonObject" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @attrs OUT

    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'contentType', 1
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'signingTime', 1
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'messageDigest', 1
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'signingCertificateV2', 1

    -- A CAdES-T signature is one that includes a timestampToken created by an online TSA (time stamping authority).
    -- We must include the TSA's URL, as well as a few options to indicate what is desired.
    -- Except for the TSA URL, the options shown here are typically what you would need.
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'timestampToken.enabled', 1
    EXEC sp_OAMethod @attrs, 'UpdateString', @success OUT, 'timestampToken.tsaUrl', 'https://freetsa.org/tsr'
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'timestampToken.addNonce', 0
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'timestampToken.requestTsaCert', 1
    EXEC sp_OAMethod @attrs, 'UpdateString', @success OUT, 'timestampToken.hashAlg', 'sha256'

    EXEC sp_OAMethod @attrs, 'Emit', @sTmp0 OUT
    EXEC sp_OASetProperty @crypt, 'SigningAttributes', @sTmp0

    DECLARE @strToSign nvarchar(4000)
    SELECT @strToSign = 'THIS IS MY ID'

    DECLARE @bd int
    -- Use "Chilkat_9_5_0.BinData" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.BinData', @bd OUT

    EXEC sp_OAMethod @bd, 'AppendString', @success OUT, @strToSign, 'utf-8'

    -- This creates the CAdES-T signature.  During the signature creation, it
    -- communicates with the TSA to get a timestampToken.
    -- The contents of bd are signed and replaced with the CAdES-T signature (which embeds the original content).
    EXEC sp_OAMethod @crypt, 'OpaqueSignBd', @success OUT, @bd
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @attrs
        EXEC @hr = sp_OADestroy @bd
        RETURN
      END

    -- Get the signature in base64 format:
    EXEC sp_OAMethod @bd, 'GetEncoded', @sTmp0 OUT, 'base64_mime'
    PRINT @sTmp0

    -- Or save the signature to a file.
    EXEC sp_OAMethod @bd, 'WriteFile', @success OUT, 'qa_output/cades-t_sample.p7m'


    PRINT 'Success.'

    EXEC @hr = sp_OADestroy @crypt
    EXEC @hr = sp_OADestroy @cert
    EXEC @hr = sp_OADestroy @attrs
    EXEC @hr = sp_OADestroy @bd


END
GO