Lua Requires Chilkat v11.0.0+

Duplicate OpensSSL to Sign File and Output Binary DER

See more OpenSSL Examples

This example duplicates the following:

openssl smime -sign -in INPUT.xml -signer SIGN.PEM -passin pass:MYPASS -outform der -binary -nodetach -out SIGNED.P7M

Note: Although "smime" is the OpenSSL command, it's not actually producing S/MIME. The arguments "-outform der -binary" indicates that the output is binary DER (i.e. the PKCS7 binary signature). The input can be any type of file: XML, PDF, JPG, ... *anything*...

Lua

local chilkat = require("chilkat")

-- This example requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

local crypt = chilkat.Crypt2.new()

-- Load the PEM containing cert + private key.
local pem = chilkat.Pem.new()
local success = pem:load_pem_file("qa_data/pem/myPem.pem", "password")
if not success then
    print(pem.last_error_text)
    return
end

local privkey = chilkat.PrivateKey.new()
success = pem:private_key_at(0, privkey)
if not success then
    print(pem.last_error_text)
    return
end

local cert = chilkat.Cert.new()
success = pem:cert_at(0, cert)
if not success then
    print(pem.last_error_text)
    return
end

success = crypt:set_signing_cert2(cert, privkey)
if not success then
    print(crypt.last_error_text)
    return
end

-- Alternatively, we could use a .pfx/.p12 file.
-- (Chilkat also supports other formats/sources for cert/private keys...)
local certFromP12 = chilkat.Cert.new()
success = certFromP12:load_pfx_file("qa_data/p12/myP12.p12", "password")
if not success then
    print(certFromP12.last_error_text)
    return
end

-- The certificate, when loaded from a .pfx/.p12, will automatically
-- include the associated private key, assuming it's present in the .p12.
-- We don't have to explicitly provide the private key as in the
-- lines of code above that use the PEM file.
success = crypt:set_signing_cert(certFromP12)
if not success then
    print(crypt.last_error_text)
    return
end

-- Create the opaque signature (PKCS7 binary DER that contains both the signature and original file data).
success = crypt:create_p7_m("qa_data/infile.anything", "qa_output/outfile.p7m")
if not success then
    print(crypt.last_error_text)
    return
end

print("Success.")