(Visual FoxPro) Verify Opaque Signature and Retrieve Signing Certificates

Demonstrates how to verify a PCKS7 opaque digital signature (signed data), extract the original file/data, and then extract the certificate(s) that were used to sign.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

LOCAL loCrypt
LOCAL lnSuccess
LOCAL loBinData
LOCAL lnNumCerts
LOCAL i
LOCAL loCert
LOCAL loCertChain

* This example assumes the Chilkat API to have been previously unlocked.
* See Global Unlock Sample for sample code.

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Crypt2')
loCrypt = CreateObject('Chilkat.Crypt2')

* Verify a PKCS7 signed-data (opaque signature) file and extract the original content to a file.
lnSuccess = loCrypt.VerifyP7M("qa_data/p7m/opaqueSig.p7","qa_output/originalData.dat")
IF (lnSuccess <> 1) THEN
    ? loCrypt.LastErrorText
    RELEASE loCrypt
    CANCEL
ENDIF

* Alternatively, we can do it in memory...
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.BinData')
loBinData = CreateObject('Chilkat.BinData')
lnSuccess = loBinData.LoadFile("qa_data/p7m/opaqueSig.p7")
* Your app should check for success, but we'll skip the check for brevity..

* If verified, the signature is unwrapped and binData is replaced with the original data that was signed.
lnSuccess = loCrypt.OpaqueVerifyBd(loBinData)
IF (lnSuccess <> 1) THEN
    ? loCrypt.LastErrorText
    RELEASE loCrypt
    RELEASE loBinData
    CANCEL
ENDIF

* For our testing, we signed some text, so we can get it from the binData..
? "Original Data:"
? loBinData.GetString("utf-8")

* After any method call that verifies a signature, the crypt object will contain the certificate(s)
* that were used for signing (assuming the X.509 certs were available in the signature, which is typically the case).

* Get the number of signing certificates, and get each..
lnNumCerts = loCrypt.NumSignerCerts
i = 0
DO WHILE i < lnNumCerts
    loCert = loCrypt.GetSignerCert(i)
    ? loCert.SubjectDN
    RELEASE loCert
    i = i + 1
ENDDO

* We could also get the complete certificate chain of each signer cert,
* assuming the certs in the chain of authentication to the trusted root
* are available on the system, or provided to Chilkat by some other means
* (such as via the XmlCertVault class, the TrustedRoots class, etc.)
i = 0
DO WHILE i < lnNumCerts
    loCertChain = loCrypt.GetSignerCertChain(i)
    * You can examine the various properties and methods for certChain in the online
    * reference documentation...
    RELEASE loCertChain
    i = i + 1
ENDDO

RELEASE loCrypt
RELEASE loBinData