Create .p7s Signature with HSM / Smartcard

SQL Server example showing how to use a CSP (Cryptographic Service Provider) for a smart card / HSM (Hardware Security Module) to create a .p7s (PKCS7) output file. This example uses the NCipher HSM CSP.

Download Chilkat Crypt ActiveX

CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @crypt int
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @crypt OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    --  Any string argument automatically begins the 30-day trial.
    DECLARE @success int

    EXEC sp_OAMethod @crypt, 'UnlockComponent', @success OUT, '30-day trial'
    IF @success <> 1
      BEGIN
        PRINT 'Crypt component unlock failed'
        RETURN
      END

    --  Find our digital certificate from the Current User certificate store.
    --  Note: There are several other ways to load your certificate
    --  into a Chilkat cert object.  You may load directly from a .cer file,
    --  PEM file, pfx, etc.
    DECLARE @ccs int
    EXEC @hr = sp_OACreate 'Chilkat.CreateCS', @ccs OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    DECLARE @certStore int

    EXEC sp_OAMethod @ccs, 'OpenCurrentUserStore', @certStore OUT
    DECLARE @cert int

    EXEC sp_OAMethod @certStore, 'FindCertBySubjectCN', @cert OUT, 'Chilkat Software, Inc.'
    IF @cert Is NULL 
      BEGIN
        EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0

        RETURN
      END

    --  Tell the crypt component to use this cert.
    EXEC sp_OAMethod @crypt, 'SetSigningCert', NULL, @cert

    --  To use an HSM or smartcard, create a CSP object,
    --  set the service provider, and then tell the Chilkat Crypt
    --  component to use the CSP:
    --  This example uses the NCipher HSM.  The
    --  provider names must be specied exactly.
    --  The NCipher provider names are:
    --  PROV_RSA_FULL ("nCipher Enhanced Cryptographic Provider")
    --  PROV_RSA_AES ("nCipher Enhanced RSA and AES Cryptographic Provider")
    --  PROV_RSA_SCHANNEL("nCipher Enhanced SChannel Cryptographic Provider")
    --  PROV_DSS_DH ("nCipher Enhanced DSS and Diffie-Hellman Cryptographic Provider")
    --  PROV_DH_SCHANNEL ("nCipher Enhanced DSS and Diffie-Hellman SChannel Cryptographic Provider")

    --  We'll be using the RSA FULL provider:
    DECLARE @csp int
    EXEC @hr = sp_OACreate 'Chilkat.Csp', @csp OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    EXEC sp_OASetProperty @csp, 'ProviderName', 'nCipher Enhanced Cryptographic Provider'

    --  Tell the crypt object to use the CSP:
    EXEC sp_OAMethod @crypt, 'SetCSP', NULL, @csp

    --  We can sign any type of file, creating a .p7s detached signature as output:
    EXEC sp_OAMethod @crypt, 'CreateP7S', @success OUT, 'test.xml', 'test.p7s'
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0

        RETURN
      END
    EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
    PRINT @sTmp0
    --  Verify the signature...
    EXEC sp_OAMethod @crypt, 'SetVerifyCert', NULL, @cert

    EXEC sp_OAMethod @crypt, 'VerifyP7S', @success OUT, 'test.xml', 'test.p7s'
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0

        RETURN
      END

    PRINT 'Success!'
END
GO