Create .p7s Signature with HSM / Smartcard

Download Chilkat Crypt ActiveX

Delphi example showing how to use a CSP (Cryptographic Service Provider) for a smart card / HSM (Hardware Security Module) to create a .p7s (PKCS7) output file. This example uses the NCipher HSM CSP.

uses
    Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
    Dialogs, StdCtrls,
    CHILKATCRYPT2Lib_TLB,
    CHILKATCERTIFICATELib_TLB,
    CHILKATUTILLib_TLB,
    OleCtrls;

...

procedure TForm1.Button1Click(Sender: TObject);
var
crypt: TChilkatCrypt2;
success: Integer;
ccs: TChilkatCreateCS;
certStore: CHILKATCERTIFICATELib_TLB.IChilkatCertStore;
cert: IChilkatCert;
csp: TChilkatCSP;

begin
crypt := TChilkatCrypt2.Create(Self);

//  Any string argument automatically begins the 30-day trial.
success := crypt.UnlockComponent('30-day trial');
if (success <> 1) then
  begin
    ShowMessage('Crypt component unlock failed');

  end;

//  Find our digital certificate from the Current User certificate store.
//  Note: There are several other ways to load your certificate
//  into a Chilkat cert object.  You may load directly from a .cer file,
//  PEM file, pfx, etc.
ccs := TChilkatCreateCS.Create(Self);

certStore := ccs.OpenCurrentUserStore();

cert := certStore.FindCertBySubjectCN('Chilkat Software, Inc.');
if (cert = nil ) then
  begin
    ShowMessage(cert.LastErrorText);

  end;

//  Tell the crypt component to use this cert.
crypt.SetSigningCert(cert);

//  To use an HSM or smartcard, create a CSP object,
//  set the service provider, and then tell the Chilkat Crypt
//  component to use the CSP:
//  This example uses the NCipher HSM.  The
//  provider names must be specied exactly.
//  The NCipher provider names are:
//  PROV_RSA_FULL ("nCipher Enhanced Cryptographic Provider")
//  PROV_RSA_AES ("nCipher Enhanced RSA and AES Cryptographic Provider")
//  PROV_RSA_SCHANNEL("nCipher Enhanced SChannel Cryptographic Provider")
//  PROV_DSS_DH ("nCipher Enhanced DSS and Diffie-Hellman Cryptographic Provider")
//  PROV_DH_SCHANNEL ("nCipher Enhanced DSS and Diffie-Hellman SChannel Cryptographic Provider")

//  We'll be using the RSA FULL provider:
csp := TChilkatCSP.Create(Self);
csp.ProviderName := 'nCipher Enhanced Cryptographic Provider';

//  Tell the crypt object to use the CSP:
crypt.SetCSP(csp);

//  We can sign any type of file, creating a .p7s detached signature as output:
success := crypt.CreateP7S('test.xml','test.p7s');
if (success = 0) then
  begin
    ShowMessage(crypt.LastErrorText);

  end;
ShowMessage(crypt.LastErrorText);
//  Verify the signature...
crypt.SetVerifyCert(cert);

success := crypt.VerifyP7S('test.xml','test.p7s');
if (success = 0) then
  begin
    ShowMessage(crypt.LastErrorText);

  end;

ShowMessage('Success!');
end;