Pascal (Lazarus/Delphi)

Sign PDF in the Cloud using AWS CloudHSM

See more Signing in the Cloud Examples

Demonstrates how to sign a PDF using AWS CloudHSM. The signing of the hash happens on a hardware token in AWS CloudHSM. Everything else involving the updating the PDF to add the signature happens locally within Chilkat.

Note: This example requires Chilkat v9.5.0.96 or greater.

Pascal (Lazarus/Delphi)

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.Pkcs11,
  Chilkat.Pdf,
  Chilkat.Cert,
  Chilkat.JsonObject;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  pkcs11: TPkcs11;
  pin: string;
  userType: Integer;
  cert: TCert;
  pdf: TPdf;
  json: TJsonObject;
  i: Integer;

begin
  success := False;

  //  This example requires the Chilkat API to have been previously unlocked.
  //  See Global Unlock Sample for sample code.

  //  Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

  pkcs11 := TPkcs11.Create;

  //  Provide the path to the AWS CloudHSM PKCS11 driver.
  //  This example runs on Windows, so we'll provide the CloudHSM DLL.
  //  If your code runs on Linux, the CloudHSM driver might be at /opt/cloudhsm/lib/libcloudhsm_pkcs11.so
  pkcs11.SharedLibPath := 'C:\\Program Files\\Amazon\\CloudHSM\\lib\\cloudhsm_pkcs11.dll';

  //  Your PIN should be a string containing your crypto user's login and password, with a colon char delimiting.
  //  See https://docs.aws.amazon.com/cloudhsm/latest/userguide/pkcs11-pin.html
  pin := 'user:password';
  userType := 1;

  //  Establish a PKCS logged-on session using the driver (.so, .dylib, or .dll) as specified in the SharedLibPath above.
  success := pkcs11.QuickSession(userType,pin);
  if (success = False) then
    begin
      WriteLn(pkcs11.LastErrorText);
      Exit;
    end;

  cert := TCert.Create;
  success := cert.LoadFromFile('qa_data/certs/myCert.cer');
  if (success = False) then
    begin
      WriteLn(cert.LastErrorText);
      Exit;
    end;

  //  Tell the certificate to link with the PKCS11 session.
  //  The cert's private key should be installed on the CloudHSM.
  //  If there are multiple private keys on the CloudHSM, then Chilkat will automatically
  //  locate and use the private key corresponding to the certificate.
  success := cert.LinkPkcs11(pkcs11);
  if (success = False) then
    begin
      WriteLn(cert.LastErrorText);
      Exit;
    end;

  //  --------------------------------------------------------------------------
  //  At this point, we have the cert to be used for signing.
  //  Our PDF signing code is the same as for a cert obtained from any other source..

  pdf := TPdf.Create;

  //  Load a PDF to be signed.
  success := pdf.LoadFile('qa_data/pdf/hello.pdf');
  if (success = False) then
    begin
      WriteLn(pdf.LastErrorText);
      success := pkcs11.CloseSession();
      Exit;
    end;

  json := TJsonObject.Create;

  json.UpdateInt('page',1);
  json.UpdateString('appearance.y','top');
  json.UpdateString('appearance.x','left');
  json.UpdateString('appearance.fontScale','10.0');
  json.UpdateString('signingAlgorithm','pss');
  json.UpdateString('hashAlgorithm','sha256');

  i := 0;
  json.I := i;
  json.UpdateString('appearance.text[i]','Digitaly signed by: Xyz Widgets, Inc.');
  i := i + 1;
  json.I := i;
  json.UpdateString('appearance.text[i]','current_dt');
  i := i + 1;
  json.I := i;
  json.UpdateString('appearance.text[i]','blah blah blah');

  //  The certificate is internally linked to the Pkcs11 object, which is currently in an authenticated session.
  success := pdf.SetSigningCert(cert);

  success := pdf.SignPdf(json,'qa_output/out.pdf');
  if (success = False) then
    begin
      WriteLn(pdf.LastErrorText);
      success := pkcs11.CloseSession();
      Exit;
    end;

  //  --------------------------------------------------------------------------

  //  Revert to an unauthenticated session by calling Logout.
  success := pkcs11.Logout();
  if (success = False) then
    begin
      WriteLn(pkcs11.LastErrorText);
      success := pkcs11.CloseSession();
      Exit;
    end;

  //  When finished, close the session.
  //  It is important to close the session (memory leaks will occur if the session is not properly closed).
  success := pkcs11.CloseSession();
  if (success = False) then
    begin
      WriteLn(pkcs11.LastErrorText);
      Exit;
    end;

  WriteLn('Success.');


  pkcs11.Free;
  cert.Free;
  pdf.Free;
  json.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.