(Chilkat2-Python) Create CMS Signed File (PDF) with Multiple Signing Certificates

Demonstrates how to sign a file by adding multiple signatures (multiple certificates). This example signs a PDF file to produce an output file that is a CMS signature wrapping the original PDF. (Note: This is different than modifying a PDF by injecting a signature into the PDF file format.)

Note: This example requires Chilkat v9.5.0.83 or greater.

Chilkat2 Python Downloads install with pip pip3 install chilkat2 or download... Python Module for Windows, Linux, Alpine Linux, MacOS, Solaris

import sys
import chilkat2

# This example assumes the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

crypt = chilkat2.Crypt2()

# ------------ This example requires Chilkat v9.5.0.83 or greater.

cert1 = chilkat2.Cert()
success = cert1.LoadPfxFile("qa_data/pfx/cert_test123.pfx","test123")
if (success != True):
    print(cert1.LastErrorText)
    sys.exit()

cert2 = chilkat2.Cert()
success = cert2.LoadPfxFile("qa_data/pfx/test_secret.pfx","secret")
if (success != True):
    print(cert2.LastErrorText)
    sys.exit()

# ------------ This example requires Chilkat v9.5.0.83 or greater.

# Tell the crypt component to use both certificates for signing. 
# When we create the signature, it will be signed by both certificates.
success = crypt.AddSigningCert(cert1)
if (success != True):
    print(crypt.LastErrorText)
    sys.exit()

success = crypt.AddSigningCert(cert2)
if (success != True):
    print(crypt.LastErrorText)
    sys.exit()

# The CadesEnabled property applies to all methods that create PKCS7 signatures. 
# To create a CAdES-BES signature, set this property equal to true. 
crypt.CadesEnabled = True

crypt.HashAlgorithm = "sha256"

# We can sign any type of file, creating a .p7s as output.
# The .p7s contains the signature and also embeds the data of the file that is signed.
inFile = "qa_data/pdf/sample.pdf"
p7sFile = "qa_output/sample.pdf.p7s"

# Create the CAdES-BES attached signature, which contains the original data.
# Note: Chilkat's function naming is not accurate.  CreateP7M creates a PKCS7 signature where the signed file
# is contained within the signature.  CreateP7S creates a detached PKCS7 signature where the signed file
# is NOT contained within the signature.  We want the data to be contained in the signature, therefore
# we call CreateP7M even though we are naming our output file .p7s.
success = crypt.CreateP7M(inFile,p7sFile)
if (success == False):
    print(crypt.LastErrorText)
    sys.exit()

# Verify the .p7s file and extract the original file from the .p7s. 
extractedToFilePath = "qa_output/sample.pdf"
success = crypt.VerifyP7M(p7sFile,extractedToFilePath)
if (success == False):
    print(crypt.LastErrorText)
    sys.exit()

print("Success!")