Lua

FatturaPA XML Invoice Sign+Encrypt to P7M

See more Digital Signatures Examples

Demonstrates how to create a CAdES BES signed + encrypted invoice.xml.p7m for the Italian FatturaPA exchange system. Lua

local chilkat = require("chilkat")

-- This requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

local crypt = chilkat.Crypt2.new()

-- Use a digital certificate and private key from a PFX file (.pfx or .p12).
local pfxPath = "qa_data/pfx/cert_test123.pfx"
local pfxPassword = "test123"

local cert = chilkat.Cert.new()
local success = cert:load_pfx_file(pfxPath, pfxPassword)
if not success then
    print(cert.last_error_text)
    return
end

-- Provide the signing cert (with associated private key).
success = crypt:set_signing_cert(cert)
if not success then
    print(crypt.last_error_text)
    return
end

-- Indicate that SHA-256 should be used.
crypt.hash_algorithm = "sha256"

-- Specify the signed attributes to be included.
-- (This is what makes it CAdES-BES compliant.)
local jsonSignedAttrs = chilkat.JsonObject.new()
jsonSignedAttrs:update_int("contentType", 1)
jsonSignedAttrs:update_int("signingTime", 1)
jsonSignedAttrs:update_int("messageDigest", 1)
jsonSignedAttrs:update_int("signingCertificateV2", 1)
crypt.signing_attributes = jsonSignedAttrs:emit()

local inFile = "qa_data/xml/IT01234567890_11002.xml"
local sigFile = "qa_data/fatturapa/signed.p7m"

-- Create the CAdES-BES signature, which contains the original data.
success = crypt:create_p7_m(inFile, sigFile)
if not success then
    print(crypt.last_error_text)
    return
end

-- Now we'll encrypt what was signed using FatturaPA's certificate (from a PEM file)
local encryptCert = chilkat.Cert.new()
success = encryptCert:load_from_file("qa_data/certs/fatturapa_cert.pem")
if not success then
    print(encryptCert.last_error_text)
    return
end

crypt.crypt_algorithm = "pki"

success = crypt:set_encrypt_cert(encryptCert)
if not success then
    print(crypt.last_error_text)
    return
end

-- Indicate the underlying bulk encryption algorithm to be used:
crypt.pkcs7_crypt_alg = "aes"
crypt.key_length = 128

-- There's one last option that could be set.  If is the RSA encryption encryption/padding scheme.
-- By default, RSAES_PKCS1-V1_5 is used.  If desired, the OaepPadding property could be set to true to
-- use RSAES_OAEP.  (We'll leave it set at the default value of false)
crypt.oaep_padding = false

-- Everything is specified.  Encrypt the .p7m to create a new .p7m (which adds a layer of encryption around the opaque signature).
-- The output is PKCS7 in binary DER format.
success = crypt:ck_encrypt_file(sigFile, "qa_output/signed_and_encrypted.p7m")
if not success then
    print(crypt.last_error_text)
    return
end

print("Success.")