AutoIt Requires Chilkat v11.7.0+

Encrypt and Sign a PDF, and Sign an Encrypted PDF

See more PDF Protection Examples

Demonstrates signing together with encryption. A pending encrypt is applied by SignPdf before it signs, so one call produces a PDF that is both encrypted and signed. A PDF that is already encrypted can be signed too, and stays encrypted. When it was opened with only the user password its permissions decide: adding a signature field needs both the modify and the annotate permission. Loading the PDF with its owner password lifts that. AutoIt

Local $bSuccess = False

;  This example requires the Chilkat API to have been previously unlocked.
;  See Global Unlock Sample for sample code.

;  The PDF used in this example is available at two_page_memo.pdf

;  The signing certificate, with its private key.
$oCert = ObjCreate("Chilkat.Cert")
$bSuccess = $oCert.LoadPfxFile("qa_data/pfx/myPdfSigningCert.pfx","secret")
If ($bSuccess = False) Then
    ConsoleWrite($oCert.LastErrorText & @CRLF)
    Exit
EndIf

$oPdf = ObjCreate("Chilkat.Pdf")
$bSuccess = $oPdf.LoadFile("qa_data/pdf/two_page_memo.pdf")
If ($bSuccess = False) Then
    ConsoleWrite($oPdf.LastErrorText & @CRLF)
    Exit
EndIf

;  Encrypt with AES-256 and do not permit modifying.
$oPdf.UserPassword = "user-secret"
$oPdf.OwnerPassword = "owner-secret"
$oJson = ObjCreate("Chilkat.JsonObject")
$oJson.UpdateBool("permissions.modify",False)
$oJsonOut = ObjCreate("Chilkat.JsonObject")
$bSuccess = $oPdf.Protection("encrypt",$oJson,$oJsonOut)
If ($bSuccess = False) Then
    ConsoleWrite($oPdf.LastErrorText & @CRLF)
    Exit
EndIf

;  The encryption is still pending.  SignPdf applies it first and signs the encrypted result.
$bSuccess = $oPdf.SetSigningCert($oCert)
If ($bSuccess = False) Then
    ConsoleWrite($oPdf.LastErrorText & @CRLF)
    Exit
EndIf

$oSigOpts = ObjCreate("Chilkat.JsonObject")
$oSigOpts.UpdateBool("invisibleSignature",True)
$oSigOpts.UpdateInt("signingCertificateV2",1)
$oSigOpts.UpdateInt("signingTime",1)
$bSuccess = $oPdf.SignPdf($oSigOpts,"qa_output/memo_encrypted_signed.pdf")
If ($bSuccess = False) Then
    ConsoleWrite($oPdf.LastErrorText & @CRLF)
    Exit
EndIf

;  The result is encrypted and signed.
$oCheck = ObjCreate("Chilkat.Pdf")
$oCheck.UserPassword = "user-secret"
$bSuccess = $oCheck.LoadFile("qa_output/memo_encrypted_signed.pdf")
If ($bSuccess = False) Then
    ConsoleWrite($oCheck.LastErrorText & @CRLF)
    Exit
EndIf

$oEmpty = ObjCreate("Chilkat.JsonObject")
$oInfo = ObjCreate("Chilkat.JsonObject")
$bSuccess = $oCheck.Protection("getInfo",$oEmpty,$oInfo)
If ($bSuccess = False) Then
    ConsoleWrite($oCheck.LastErrorText & @CRLF)
    Exit
EndIf

ConsoleWrite("algorithm: " & $oInfo.StringOf("loaded.algorithm") & @CRLF)
ConsoleWrite("signatures: " & $oCheck.NumSignatures & @CRLF)
$oSigInfo = ObjCreate("Chilkat.JsonObject")
Local $bVerified = $oCheck.VerifySignature(0,$oSigInfo)
ConsoleWrite("signature verifies: " & $bVerified & @CRLF)

;  Signing an encrypted PDF.  This one was opened with only the user password, and its
;  permissions do not allow modifying, so another signature is refused.
$bSuccess = $oCheck.SetSigningCert($oCert)
If ($bSuccess = False) Then
    ConsoleWrite($oCheck.LastErrorText & @CRLF)
    Exit
EndIf

$bSuccess = $oCheck.SignPdf($oSigOpts,"qa_output/memo_signed_twice.pdf")
If ($bSuccess = False) Then
    ConsoleWrite("A second signature was refused: the permissions do not allow it." & @CRLF)
EndIf

;  Loaded with the owner password, the same PDF can be signed.  It stays encrypted, and the
;  first signature stays valid because the new one is added as an incremental update.
$oOwner = ObjCreate("Chilkat.Pdf")
$oOwner.UserPassword = "user-secret"
$oOwner.OwnerPassword = "owner-secret"
$bSuccess = $oOwner.LoadFile("qa_output/memo_encrypted_signed.pdf")
If ($bSuccess = False) Then
    ConsoleWrite($oOwner.LastErrorText & @CRLF)
    Exit
EndIf

$bSuccess = $oOwner.SetSigningCert($oCert)
If ($bSuccess = False) Then
    ConsoleWrite($oOwner.LastErrorText & @CRLF)
    Exit
EndIf

$bSuccess = $oOwner.SignPdf($oSigOpts,"qa_output/memo_signed_twice.pdf")
If ($bSuccess = False) Then
    ConsoleWrite($oOwner.LastErrorText & @CRLF)
    Exit
EndIf

$oTwice = ObjCreate("Chilkat.Pdf")
$oTwice.UserPassword = "user-secret"
$bSuccess = $oTwice.LoadFile("qa_output/memo_signed_twice.pdf")
If ($bSuccess = False) Then
    ConsoleWrite($oTwice.LastErrorText & @CRLF)
    Exit
EndIf

ConsoleWrite("signatures after signing with owner rights: " & $oTwice.NumSignatures & @CRLF)
$bVerified = $oTwice.VerifySignature(0,$oSigInfo)
ConsoleWrite("first signature still verifies: " & $bVerified & @CRLF)
$bVerified = $oTwice.VerifySignature(1,$oSigInfo)
ConsoleWrite("second signature verifies: " & $bVerified & @CRLF)

;  Sample output:

;  algorithm: aes-256
;  signatures: 1
;  signature verifies: True
;  A second signature was refused: the permissions do not allow it.
;  signatures after signing with owner rights: 2
;  first signature still verifies: True
;  second signature verifies: True