(SQL Server) Sign String to create a CAdES-T Signature, using HTTP Proxy to Access Timestamp Server

This example will sign a string to create a CAdEST-T signature. It will use an HTTP proxy to access the timestamp server.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @crypt int
    EXEC @hr = sp_OACreate 'Chilkat.Crypt2', @crypt OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    DECLARE @cert int
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert OUT

    EXEC sp_OASetProperty @cert, 'SmartCardPin', '123456'
    DECLARE @success int
    EXEC sp_OAMethod @cert, 'LoadFromSmartcard', @success OUT, ''
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    EXEC sp_OAMethod @crypt, 'SetSigningCert', @success OUT, @cert

    -- Use SHA-256 rather than the default of SHA-1
    EXEC sp_OASetProperty @crypt, 'HashAlgorithm', 'sha256'

    -- Create JSON that tells Chilkat what signing attributes to include:
    DECLARE @attrs int
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @attrs OUT

    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'contentType', 1
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'signingTime', 1
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'messageDigest', 1
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'signingCertificateV2', 1

    -- A CAdES-T signature is one that includes a timestampToken created by an online TSA (time stamping authority).
    -- We must include the TSA's URL, as well as a few options to indicate what is desired.
    -- Except for the TSA URL, the options shown here are typically what you would need.
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'timestampToken.enabled', 1
    EXEC sp_OAMethod @attrs, 'UpdateString', @success OUT, 'timestampToken.tsaUrl', 'https://freetsa.org/tsr'
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'timestampToken.addNonce', 0
    EXEC sp_OAMethod @attrs, 'UpdateBool', @success OUT, 'timestampToken.requestTsaCert', 1
    EXEC sp_OAMethod @attrs, 'UpdateString', @success OUT, 'timestampToken.hashAlg', 'sha256'

    EXEC sp_OAMethod @attrs, 'Emit', @sTmp0 OUT
    EXEC sp_OASetProperty @crypt, 'SigningAttributes', @sTmp0

    DECLARE @strToSign nvarchar(4000)
    SELECT @strToSign = 'Hello World!'

    DECLARE @bd int
    EXEC @hr = sp_OACreate 'Chilkat.BinData', @bd OUT

    EXEC sp_OAMethod @bd, 'AppendString', @success OUT, @strToSign, 'utf-8'

    -- -------------------------------------------------------------------------
    -- The purpose of this example is to show how an HTTP object with custom
    -- settings can be used to access the Internet when signing.
    -- Access to the Internet is needed to communicate with the timestamp server.
    DECLARE @http int
    EXEC @hr = sp_OACreate 'Chilkat.Http', @http OUT

    -- This can be a domain name, hostname, or IP address.
    EXEC sp_OASetProperty @http, 'ProxyDomain', '172.16.16.56'
    EXEC sp_OASetProperty @http, 'ProxyPort', 808
    EXEC sp_OASetProperty @http, 'ProxyLogin', 'myProxyLogin'
    EXEC sp_OASetProperty @http, 'ProxyPassword', 'myProxyPassword'
    EXEC sp_OAMethod @crypt, 'SetTsaHttpObj', NULL, @http
    -- -------------------------------------------------------------------------

    -- This creates the CAdES-T signature.  During the signature creation, it
    -- communicates with the TSA to get a timestampToken.
    -- The contents of bd are signed and replaced with the CAdES-T signature (which embeds the original content).
    EXEC sp_OAMethod @crypt, 'OpaqueSignBd', @success OUT, @bd
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @crypt, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @crypt
        EXEC @hr = sp_OADestroy @cert
        EXEC @hr = sp_OADestroy @attrs
        EXEC @hr = sp_OADestroy @bd
        EXEC @hr = sp_OADestroy @http
        RETURN
      END

    -- Get the signature in base64 format:
    EXEC sp_OAMethod @bd, 'GetEncoded', @sTmp0 OUT, 'base64_mime'
    PRINT @sTmp0


    PRINT 'Success.'

    EXEC @hr = sp_OADestroy @crypt
    EXEC @hr = sp_OADestroy @cert
    EXEC @hr = sp_OADestroy @attrs
    EXEC @hr = sp_OADestroy @bd
    EXEC @hr = sp_OADestroy @http


END
GO