PowerShell Requires Chilkat v11.7.0+

Encrypt and Sign a PDF, and Sign an Encrypted PDF

See more PDF Protection Examples

Demonstrates signing together with encryption. A pending encrypt is applied by SignPdf before it signs, so one call produces a PDF that is both encrypted and signed. A PDF that is already encrypted can be signed too, and stays encrypted. When it was opened with only the user password its permissions decide: adding a signature field needs both the modify and the annotate permission. Loading the PDF with its owner password lifts that. PowerShell

Add-Type -Path "C:\chilkat\ChilkatDotNet47-x64\ChilkatDotNet47.dll"

$success = $false

#  This example requires the Chilkat API to have been previously unlocked.
#  See Global Unlock Sample for sample code.

#  The PDF used in this example is available at two_page_memo.pdf

#  The signing certificate, with its private key.
$cert = New-Object Chilkat.Cert
$success = $cert.LoadPfxFile("qa_data/pfx/myPdfSigningCert.pfx","secret")
if ($success -eq $false) {
    $($cert.LastErrorText)
    exit
}

$pdf = New-Object Chilkat.Pdf
$success = $pdf.LoadFile("qa_data/pdf/two_page_memo.pdf")
if ($success -eq $false) {
    $($pdf.LastErrorText)
    exit
}

#  Encrypt with AES-256 and do not permit modifying.
$pdf.UserPassword = "user-secret"
$pdf.OwnerPassword = "owner-secret"
$json = New-Object Chilkat.JsonObject
$json.UpdateBool("permissions.modify",$false)
$jsonOut = New-Object Chilkat.JsonObject
$success = $pdf.Protection("encrypt",$json,$jsonOut)
if ($success -eq $false) {
    $($pdf.LastErrorText)
    exit
}

#  The encryption is still pending.  SignPdf applies it first and signs the encrypted result.
$success = $pdf.SetSigningCert($cert)
if ($success -eq $false) {
    $($pdf.LastErrorText)
    exit
}

$sigOpts = New-Object Chilkat.JsonObject
$sigOpts.UpdateBool("invisibleSignature",$true)
$sigOpts.UpdateInt("signingCertificateV2",1)
$sigOpts.UpdateInt("signingTime",1)
$success = $pdf.SignPdf($sigOpts,"qa_output/memo_encrypted_signed.pdf")
if ($success -eq $false) {
    $($pdf.LastErrorText)
    exit
}

#  The result is encrypted and signed.
$check = New-Object Chilkat.Pdf
$check.UserPassword = "user-secret"
$success = $check.LoadFile("qa_output/memo_encrypted_signed.pdf")
if ($success -eq $false) {
    $($check.LastErrorText)
    exit
}

$empty = New-Object Chilkat.JsonObject
$info = New-Object Chilkat.JsonObject
$success = $check.Protection("getInfo",$empty,$info)
if ($success -eq $false) {
    $($check.LastErrorText)
    exit
}

$("algorithm: " + $info.StringOf("loaded.algorithm"))
$("signatures: " + $check.NumSignatures)
$sigInfo = New-Object Chilkat.JsonObject
$verified = $check.VerifySignature(0,$sigInfo)
$("signature verifies: " + $verified)

#  Signing an encrypted PDF.  This one was opened with only the user password, and its
#  permissions do not allow modifying, so another signature is refused.
$success = $check.SetSigningCert($cert)
if ($success -eq $false) {
    $($check.LastErrorText)
    exit
}

$success = $check.SignPdf($sigOpts,"qa_output/memo_signed_twice.pdf")
if ($success -eq $false) {
    $("A second signature was refused: the permissions do not allow it.")
}

#  Loaded with the owner password, the same PDF can be signed.  It stays encrypted, and the
#  first signature stays valid because the new one is added as an incremental update.
$owner = New-Object Chilkat.Pdf
$owner.UserPassword = "user-secret"
$owner.OwnerPassword = "owner-secret"
$success = $owner.LoadFile("qa_output/memo_encrypted_signed.pdf")
if ($success -eq $false) {
    $($owner.LastErrorText)
    exit
}

$success = $owner.SetSigningCert($cert)
if ($success -eq $false) {
    $($owner.LastErrorText)
    exit
}

$success = $owner.SignPdf($sigOpts,"qa_output/memo_signed_twice.pdf")
if ($success -eq $false) {
    $($owner.LastErrorText)
    exit
}

$twice = New-Object Chilkat.Pdf
$twice.UserPassword = "user-secret"
$success = $twice.LoadFile("qa_output/memo_signed_twice.pdf")
if ($success -eq $false) {
    $($twice.LastErrorText)
    exit
}

$("signatures after signing with owner rights: " + $twice.NumSignatures)
$verified = $twice.VerifySignature(0,$sigInfo)
$("first signature still verifies: " + $verified)
$verified = $twice.VerifySignature(1,$sigInfo)
$("second signature verifies: " + $verified)

#  Sample output:

#  algorithm: aes-256
#  signatures: 1
#  signature verifies: True
#  A second signature was refused: the permissions do not allow it.
#  signatures after signing with owner rights: 2
#  first signature still verifies: True
#  second signature verifies: True