Zig Requires Chilkat v11.0.0+

Duplicate OpensSSL to Sign File and Output Binary DER

See more OpenSSL Examples

This example duplicates the following:

openssl smime -sign -in INPUT.xml -signer SIGN.PEM -passin pass:MYPASS -outform der -binary -nodetach -out SIGNED.P7M

Note: Although "smime" is the OpenSSL command, it's not actually producing S/MIME. The arguments "-outform der -binary" indicates that the output is binary DER (i.e. the PKCS7 binary signature). The input can be any type of file: XML, PDF, JPG, ... *anything*...

Zig

const std = @import("std");
const chilkat = @import("chilkat");

pub fn main(init: std.process.Init) !void {
    const alloc = init.arena.allocator();

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    const crypt = try chilkat.Crypt2.init();
    defer crypt.deinit();

    // Load the PEM containing cert + private key.
    const pem = try chilkat.Pem.init();
    defer pem.deinit();
    pem.loadPemFile("qa_data/pem/myPem.pem", "password") catch {
        std.debug.print("{s}\n", .{try pem.getLastErrorText(alloc)});
        return;
    };

    const privkey = try chilkat.PrivateKey.init();
    defer privkey.deinit();
    pem.privateKeyAt(0, privkey) catch {
        std.debug.print("{s}\n", .{try pem.getLastErrorText(alloc)});
        return;
    };

    const cert = try chilkat.Cert.init();
    defer cert.deinit();
    pem.certAt(0, cert) catch {
        std.debug.print("{s}\n", .{try pem.getLastErrorText(alloc)});
        return;
    };

    crypt.setSigningCert2(cert, privkey) catch {
        std.debug.print("{s}\n", .{try crypt.getLastErrorText(alloc)});
        return;
    };

    // Alternatively, we could use a .pfx/.p12 file.
    // (Chilkat also supports other formats/sources for cert/private keys...)
    const cert_from_p12 = try chilkat.Cert.init();
    defer cert_from_p12.deinit();
    cert_from_p12.loadPfxFile("qa_data/p12/myP12.p12", "password") catch {
        std.debug.print("{s}\n", .{try cert_from_p12.getLastErrorText(alloc)});
        return;
    };

    // The certificate, when loaded from a .pfx/.p12, will automatically
    // include the associated private key, assuming it's present in the .p12.
    // We don't have to explicitly provide the private key as in the
    // lines of code above that use the PEM file.
    crypt.setSigningCert(cert_from_p12) catch {
        std.debug.print("{s}\n", .{try crypt.getLastErrorText(alloc)});
        return;
    };

    // Create the opaque signature (PKCS7 binary DER that contains both the signature and original file data).
    crypt.createP7M("qa_data/infile.anything", "qa_output/outfile.p7m") catch {
        std.debug.print("{s}\n", .{try crypt.getLastErrorText(alloc)});
        return;
    };

    std.debug.print("Success.\n", .{});
}