DataFlex

Verify the Digital Signatures on an Email

Demonstrates the read-only Chilkat Email.SignaturesValid property, which is true when the email was received with one or more digital signatures and all of them validated, indicating the message was not altered. It is only meaningful when ReceivedSigned is true, so this example checks that first.

Background: A valid signature proves integrity — the bytes that were signed are exactly the bytes you received — but that is not the same as trust. A message can carry a perfectly valid signature from a certificate you have no reason to trust (self-signed, expired, or from an unknown issuer). So after confirming SignaturesValid, an application that needs assurance of who signed should separately examine the signer certificate and its chain (see LastSignerCert).

Chilkat DataFlex Downloads

Download Chilkat for DataFlex

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoEmail
    String sTemp1
    Boolean bTemp1

    Move False To iSuccess

    //  Demonstrates the read-only Email.SignaturesValid property, which is true if the email
    //  was received with one or more digital signatures AND all of them validated (indicating
    //  the email was not altered).  It is only meaningful when ReceivedSigned is true.

    Get Create (RefClass(cComChilkatEmail)) To hoEmail
    If (Not(IsComObjectCreated(hoEmail))) Begin
        Send CreateComObject of hoEmail
    End

    Get ComLoadEml Of hoEmail "qa_data/eml/signed.eml" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoEmail To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get ComReceivedSigned Of hoEmail To bTemp1
    If (bTemp1 = True) Begin
        Get ComSignaturesValid Of hoEmail To bTemp1
        If (bTemp1 = True) Begin
            Showln "The signature(s) verified: the email was not altered."
        End
        Else Begin
            Showln "Signature verification FAILED."
        End

    End
    Else Begin
        Showln "This email was not received with a digital signature."
    End

    //  Note: Paths such as "qa_data/..." are relative local filesystem paths,
    //  relative to the current working directory of the running application.


End_Procedure