(PowerBuilder) Verify Opaque Signature and Retrieve Signing Certificates

Demonstrates how to verify a PCKS7 opaque digital signature (signed data), extract the original file/data, and then extract the certificate(s) that were used to sign.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

integer li_rc
oleobject loo_Crypt
integer li_Success
oleobject loo_BinData
integer li_NumCerts
integer i
oleobject loo_Cert
oleobject loo_CertChain

// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

loo_Crypt = create oleobject
// Use "Chilkat_9_5_0.Crypt2" for versions of Chilkat < 10.0.0
li_rc = loo_Crypt.ConnectToNewObject("Chilkat.Crypt2")
if li_rc < 0 then
    destroy loo_Crypt
    MessageBox("Error","Connecting to COM object failed")
    return
end if

// Verify a PKCS7 signed-data (opaque signature) file and extract the original content to a file.
li_Success = loo_Crypt.VerifyP7M("qa_data/p7m/opaqueSig.p7","qa_output/originalData.dat")
if li_Success <> 1 then
    Write-Debug loo_Crypt.LastErrorText
    destroy loo_Crypt
    return
end if

// Alternatively, we can do it in memory...
loo_BinData = create oleobject
// Use "Chilkat_9_5_0.BinData" for versions of Chilkat < 10.0.0
li_rc = loo_BinData.ConnectToNewObject("Chilkat.BinData")

li_Success = loo_BinData.LoadFile("qa_data/p7m/opaqueSig.p7")
// Your app should check for success, but we'll skip the check for brevity..

// If verified, the signature is unwrapped and binData is replaced with the original data that was signed.
li_Success = loo_Crypt.OpaqueVerifyBd(loo_BinData)
if li_Success <> 1 then
    Write-Debug loo_Crypt.LastErrorText
    destroy loo_Crypt
    destroy loo_BinData
    return
end if

// For our testing, we signed some text, so we can get it from the binData..
Write-Debug "Original Data:"
Write-Debug loo_BinData.GetString("utf-8")

// After any method call that verifies a signature, the crypt object will contain the certificate(s)
// that were used for signing (assuming the X.509 certs were available in the signature, which is typically the case).

// Get the number of signing certificates, and get each..
li_NumCerts = loo_Crypt.NumSignerCerts
i = 0
do while i < li_NumCerts
    loo_Cert = loo_Crypt.GetSignerCert(i)
    Write-Debug loo_Cert.SubjectDN
    destroy loo_Cert
    i = i + 1
loop

// We could also get the complete certificate chain of each signer cert,
// assuming the certs in the chain of authentication to the trusted root
// are available on the system, or provided to Chilkat by some other means
// (such as via the XmlCertVault class, the TrustedRoots class, etc.)
i = 0
do while i < li_NumCerts
    loo_CertChain = loo_Crypt.GetSignerCertChain(i)
    // You can examine the various properties and methods for certChain in the online
    // reference documentation...
    destroy loo_CertChain
    i = i + 1
loop


destroy loo_Crypt
destroy loo_BinData