Objective-C Requires Chilkat v11.7.0+

Encrypt a PDF for a Certificate Instead of a Password

See more PDF Protection Examples

Demonstrates certificate security, where a PDF is encrypted for one or more recipients and each opens it with their own certificate and private key. No password is involved. Only the public certificate of a recipient is needed to encrypt. Each recipient has its own permissions, and the changeSecurity permission gives a recipient owner rights. PreLoadCheck tells an application that a file is certificate-encrypted and which certificates can open it. A PDF that cannot be opened, because no matching certificate and private key were provided, fails to load. Objective-C

#import <CkoCert.h>
#import <CkoPdf.h>
#import <CkoJsonObject.h>

BOOL success = NO;

//  This example requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  The PDF used in this example is available at two_page_memo.pdf

//  The recipient's certificate.  Only the public certificate is needed to encrypt.
CkoCert *recipient = [[CkoCert alloc] init];
success = [recipient LoadFromFile: @"qa_data/certs/recipient.cer"];
if (success == NO) {
    NSLog(@"%@",recipient.LastErrorText);
    return;
}

CkoPdf *pdf = [[CkoPdf alloc] init];
success = [pdf LoadFile: @"qa_data/pdf/two_page_memo.pdf"];
if (success == NO) {
    NSLog(@"%@",pdf.LastErrorText);
    return;
}

//  Call AddEncryptCert once for each recipient.
success = [pdf AddEncryptCert: recipient];
if (success == NO) {
    NSLog(@"%@",pdf.LastErrorText);
    return;
}

//  recipientPermissions[0] belongs to the first certificate added.  changeSecurity gives that
//  recipient owner rights, so the file can be managed later.
CkoJsonObject *json = [[CkoJsonObject alloc] init];
[json UpdateString: @"method" value: @"certificate"];
[json UpdateBool: @"recipientPermissions[0].changeSecurity" value: YES];

CkoJsonObject *jsonOut = [[CkoJsonObject alloc] init];
success = [pdf Protection: @"encrypt" jsonIn: json jsonOut: jsonOut];
if (success == NO) {
    NSLog(@"%@",pdf.LastErrorText);
    return;
}

NSLog(@"%@%@",@"method: ",[jsonOut StringOf: @"pending.method"]);
NSLog(@"%@%@",@"algorithm: ",[jsonOut StringOf: @"pending.algorithm"]);
NSLog(@"%@%d",@"recipients: ",[[jsonOut SizeOfArray: @"pending.recipients"] intValue]);

success = [pdf WriteFile: @"qa_output/memo_for_recipient.pdf"];
if (success == NO) {
    NSLog(@"%@",pdf.LastErrorText);
    return;
}

//  PreLoadCheck says how the file is protected, without loading it.
CkoPdf *reader = [[CkoPdf alloc] init];
CkoJsonObject *info = [[CkoJsonObject alloc] init];
success = [reader PreLoadCheck: @"qa_output/memo_for_recipient.pdf" jsonOut: info];
if (success == NO) {
    NSLog(@"%@",reader.LastErrorText);
    return;
}

NSLog(@"%@%@",@"saved file, method: ",[info StringOf: @"method"]);
NSLog(@"%@%d",@"saved file, recipients: ",[[info SizeOfArray: @"recipients"] intValue]);

//  The recipient opens it with the certificate and its private key, here from a .pfx file.
//  (On Windows, a certificate that is installed in the Windows certificate store with its private
//  key is found automatically when the PDF is loaded, and SetDecryptCert is not needed for it.)
CkoCert *myCert = [[CkoCert alloc] init];
success = [myCert LoadPfxFile: @"qa_data/pfx/recipient.pfx" password: @"pfx-password"];
if (success == NO) {
    NSLog(@"%@",myCert.LastErrorText);
    return;
}

success = [reader SetDecryptCert: myCert];
if (success == NO) {
    NSLog(@"%@",reader.LastErrorText);
    return;
}

success = [reader LoadFile: @"qa_output/memo_for_recipient.pdf"];
if (success == NO) {
    NSLog(@"%@",reader.LastErrorText);
    return;
}

CkoJsonObject *empty = [[CkoJsonObject alloc] init];
CkoJsonObject *loadedInfo = [[CkoJsonObject alloc] init];
success = [reader Protection: @"getInfo" jsonIn: empty jsonOut: loadedInfo];
if (success == NO) {
    NSLog(@"%@",reader.LastErrorText);
    return;
}

NSLog(@"%@%@",@"opened with: ",[loadedInfo StringOf: @"loaded.openedWith"]);
NSLog(@"%@%d",@"pages: ",[reader.NumPages intValue]);

//  Sample output:

//  method: certificate
//  algorithm: aes-256
//  recipients: 1
//  saved file, method: certificate
//  saved file, recipients: 1
//  opened with: certificate
//  pages: 2