(Tcl) Sign PDF using ARSS (Aruba Remote Signing Service)

See more Signing in the Cloud Examples

Demonstrates how to sign a PDF using the Aruba Remote Signing Service (ARSS).

Note: This example requires Chilkat v9.5.0.96 or greater.

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

set pdf [new_CkPdf]

# Load a PDF to be signed.
set success [CkPdf_LoadFile $pdf "qa_data/pdf/hello.pdf"]
if {$success == 0} then {
    puts [CkPdf_lastErrorText $pdf]
    delete_CkPdf $pdf
    exit
}

# Options for signing are specified in JSON.
set json [new_CkJsonObject]

# Indicate that we want an LTV-enabled signature
CkJsonObject_UpdateBool $json "ltvOcsp" 1

# Define the appearance of the signature.
CkJsonObject_UpdateInt $json "page" 1
CkJsonObject_UpdateString $json "appearance.y" "top"
CkJsonObject_UpdateString $json "appearance.x" "left"
CkJsonObject_UpdateString $json "appearance.fontScale" "10.0"
CkJsonObject_UpdateString $json "appearance.text[0]" "Digitally signed by: cert_cn"
CkJsonObject_UpdateString $json "appearance.text[1]" "current_dt"
CkJsonObject_UpdateString $json "appearance.text[2]" "This is an LTV-enabled signature."

# Load the certificate used for signing.  The certificate's private key is stored on 
# the Aruba.it server and the signing will happen remotely using the
# ARSS (Aruba Remote Signing Service).
# However, we still need the certificate locally (without private key).
set cert [new_CkCert]

set success [CkCert_LoadFromFile $cert "qa_data/certs/myCert.cer"]
if {$success == 0} then {
    puts [CkCert_lastErrorText $cert]
    delete_CkPdf $pdf
    delete_CkJsonObject $json
    delete_CkCert $cert
    exit
}

# To sign using the Aruba Remote Signing Service, 
# add the following lines of code to specify your authentication credentials,
# and the ID of the certificate w/ private key on the server to be used.
set jsonArss [new_CkJsonObject]

# Set the "service" equal to "ARSS" to tell Chilkat to use ARSS for signing.
CkJsonObject_UpdateString $jsonArss "service" "ARSS"
# Specify the certificate ID, such as "AS0"
# This certificate should match the certificate loaded in the above code.
CkJsonObject_UpdateString $jsonArss "certID" "YOUR_ARSS_CERT_ID"
CkJsonObject_UpdateString $jsonArss "otpPwd" "YOUR_OTP_PWD"
CkJsonObject_UpdateString $jsonArss "typeOtpAuth" "demoprod"
CkJsonObject_UpdateString $jsonArss "user" "YOUR_ARSS_USERNAME"
CkJsonObject_UpdateString $jsonArss "userPWD" "YOUR_ARSS_PASSWORD"
set success [CkCert_SetCloudSigner $cert $jsonArss]

# Tell the pdf object to use the certificate for signing.
set success [CkPdf_SetSigningCert $pdf $cert]
if {$success == 0} then {
    puts [CkPdf_lastErrorText $pdf]
    delete_CkPdf $pdf
    delete_CkJsonObject $json
    delete_CkCert $cert
    delete_CkJsonObject $jsonArss
    exit
}

# Chilkat will build the signed PDF locally, but will (internally) use ARSS
# to do the RSA sign hash operation.
set success [CkPdf_SignPdf $pdf $json "qa_output/hello_ltv_signed.pdf"]
if {$success == 0} then {
    puts [CkPdf_lastErrorText $pdf]
    delete_CkPdf $pdf
    delete_CkJsonObject $json
    delete_CkCert $cert
    delete_CkJsonObject $jsonArss
    exit
}

puts "The PDF has been successfully cryptographically signed with long-term validation."

delete_CkPdf $pdf
delete_CkJsonObject $json
delete_CkCert $cert
delete_CkJsonObject $jsonArss