Pascal (Lazarus/Delphi)
Pascal (Lazarus/Delphi)
PKCS11 XML Signature using Certificate and Private Key on Smart Card / USB Token
See more PKCS11 Examples
Sample code showing how to use PKCS11 to create an XML digital signature with a certificate and private key stored on a smart card or USB token.Note: This example requires Chilkat v9.5.0.96 or later.
Chilkat Pascal (Lazarus/Delphi) Downloads
program ChilkatDemo;
// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.
{$IFDEF FPC}
{$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}
uses
{$IFDEF UNIX}
cthreads,
{$ENDIF}
SysUtils,
CkDllLoader,
Chilkat.Xml,
Chilkat.StringBuilder,
Chilkat.Pkcs11,
Chilkat.XmlDSigGen,
Chilkat.Cert;
// ---------------------------------------------------------------------------
procedure RunDemo;
var
success: Boolean;
pkcs11: TPkcs11;
userType: Integer;
pin: string;
cert: TCert;
xml: TXml;
gen: TXmlDSigGen;
bUsePrivateKey: Boolean;
sbXml: TStringBuilder;
begin
success := False;
// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.
// Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.
pkcs11 := TPkcs11.Create;
// This example is tested on Windows using a Giesecke and Devrient Sm@rtCafe Expert 3.2 smart card.
// You will use the DLL (or shared lib) provided by your smart card vendor, or a DLL compatible with your smart card.
// On Windows, if the DLL is located in C:\Windows\System32, specify only the filename.
// Otherwise provide the full path.
pkcs11.SharedLibPath := 'aetpkss1.dll';
// Make it an authenticated session by calling Login.
userType := 1;
// Make sure to use the correct PIN for your smart card..
pin := '0000';
success := pkcs11.QuickSession(userType,pin);
if (success = False) then
begin
WriteLn(pkcs11.LastErrorText);
Exit;
end;
// Get the certificate (on the smart card) that has a private key.
cert := TCert.Create;
success := pkcs11.FindCert('privateKey','',cert);
if (success = True) then
begin
WriteLn('Cert with private key: ' + cert.SubjectCN);
end
else
begin
WriteLn('No certificates having a private key were found.');
success := pkcs11.CloseSession();
Exit;
end;
// --------------------------------------------------------------------------
// At this point, we have the cert to be used for signing.
// Our XML signing code is the same as for a cert obtained from any other source..
// First generate the following XML to be signed:
// Use this online tool to generate code from sample XML:
// Generate Code to Create XML
// <?xml version="1.0" encoding="UTF-8" standalone="no" ?>
// <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
// <SOAP-ENV:Header>
// <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" SOAP-ENV:mustUnderstand="1"></wsse:Security>
// </SOAP-ENV:Header>
// <SOAP-ENV:Body xmlns:SOAP-SEC="http://schemas.xmlsoap.org/soap/security/2000-12" SOAP-SEC:id="Body">
// <z:FooBar xmlns:z="http://example.com" />
// </SOAP-ENV:Body>
// </SOAP-ENV:Envelope>
xml := TXml.Create;
xml.Tag := 'SOAP-ENV:Envelope';
xml.AddAttribute('xmlns:SOAP-ENV','http://schemas.xmlsoap.org/soap/envelope/');
xml.UpdateAttrAt('SOAP-ENV:Header|wsse:Security',True,'xmlns:wsse','http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd');
xml.UpdateAttrAt('SOAP-ENV:Header|wsse:Security',True,'SOAP-ENV:mustUnderstand','1');
xml.UpdateAttrAt('SOAP-ENV:Body',True,'xmlns:SOAP-SEC','http://schemas.xmlsoap.org/soap/security/2000-12');
xml.UpdateAttrAt('SOAP-ENV:Body',True,'SOAP-SEC:id','Body');
xml.UpdateAttrAt('SOAP-ENV:Body|z:FooBar',True,'xmlns:z','http://example.com');
gen := TXmlDSigGen.Create;
// Indicate where the Signature will be inserted.
gen.SigLocation := 'SOAP-ENV:Envelope|SOAP-ENV:Header|wsse:Security';
// Add a reference to the fragment of the XML to be signed.
// Note: "Body" refers to the XML element having an "id" equal to "Body", where "id" is case insensitive
// and where any namespace might qualify the attribute. In this case, the SOAP-ENV:Body fragment is signed
// NOT because the tag = "Body", but because it has SOAP-SEC:id="Body"
gen.AddSameDocRef('Body','sha1','EXCL_C14N','','');
// (You can read about the SignedInfoPrefixList in the online reference documentation. It's optional..)
gen.SignedInfoPrefixList := 'wsse SOAP-ENV';
// Provide the private key for signing via the certificate, and indicate that
// we want the base64 of the certificate embedded in the KeyInfo.
gen.KeyInfoType := 'X509Data';
gen.X509Type := 'Certificate';
bUsePrivateKey := True;
success := gen.SetX509Cert(cert,bUsePrivateKey);
if (success <> True) then
begin
WriteLn(gen.LastErrorText);
success := pkcs11.CloseSession();
Exit;
end;
// Everything's specified. Now create and insert the Signature
sbXml := TStringBuilder.Create;
xml.EmitCompact := True;
xml.GetXmlSb(sbXml);
success := gen.CreateXmlDSigSb(sbXml);
if (success <> True) then
begin
WriteLn(gen.LastErrorText);
success := pkcs11.CloseSession();
Exit;
end;
// Examine the XML with the digital signature inserted
WriteLn(sbXml.GetAsString());
// --------------------------------------------------------------------------
// Revert to an unauthenticated session by calling Logout.
success := pkcs11.Logout();
if (success = False) then
begin
WriteLn(pkcs11.LastErrorText);
success := pkcs11.CloseSession();
Exit;
end;
// When finished, close the session.
// It is important to close the session (memory leaks will occur if the session is not properly closed).
success := pkcs11.CloseSession();
if (success = False) then
begin
WriteLn(pkcs11.LastErrorText);
Exit;
end;
WriteLn('Success.');
pkcs11.Free;
cert.Free;
xml.Free;
gen.Free;
sbXml.Free;
end;
// ---------------------------------------------------------------------------
begin
try
RunDemo;
except
on E: Exception do
WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
end;
WriteLn;
{$IFDEF MSWINDOWS}
WriteLn('Press Enter to exit...');
ReadLn;
{$ENDIF}
end.