(Tcl) Verify Opaque Signature and Retrieve Signing Certificates

Demonstrates how to verify a PCKS7 opaque digital signature (signed data), extract the original file/data, and then extract the certificate(s) that were used to sign.

Note: This example requires Chilkat v11.0.0 or greater.

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

set success 0

# This example assumes the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

set crypt [new_CkCrypt2]

# Verify a PKCS7 signed-data (opaque signature) file and extract the original content to a file.
set success [CkCrypt2_VerifyP7M $crypt "qa_data/p7m/opaqueSig.p7" "qa_output/originalData.dat"]
if {$success == 0} then {
    puts [CkCrypt2_lastErrorText $crypt]
    delete_CkCrypt2 $crypt
    exit
}

# Alternatively, we can do it in memory...
set binData [new_CkBinData]

set success [CkBinData_LoadFile $binData "qa_data/p7m/opaqueSig.p7"]
# Your app should check for success, but we'll skip the check for brevity..

# If verified, the signature is unwrapped and binData is replaced with the original data that was signed.
set success [CkCrypt2_OpaqueVerifyBd $crypt $binData]
if {$success == 0} then {
    puts [CkCrypt2_lastErrorText $crypt]
    delete_CkCrypt2 $crypt
    delete_CkBinData $binData
    exit
}

# For our testing, we signed some text, so we can get it from the binData..
puts "Original Data:"
puts [CkBinData_getString $binData utf-8]

# After any method call that verifies a signature, the crypt object will contain the certificate(s)
# that were used for signing (assuming the X.509 certs were available in the signature, which is typically the case).

# Get each signing certificate, and build the certificate chain for each.
set cert [new_CkCert]

set certChain [new_CkCertChain]

set numCerts [CkCrypt2_get_NumSignerCerts $crypt]
set i 0
while {$i < $numCerts} {
    CkCrypt2_LastSignerCert $crypt $i $cert
    puts [CkCert_subjectDN $cert]

    set success [CkCert_BuildCertChain $cert $certChain]
    if {$success == 0} then {
        puts [CkCert_lastErrorText $cert]
        delete_CkCrypt2 $crypt
        delete_CkBinData $binData
        delete_CkCert $cert
        delete_CkCertChain $certChain
        exit
    }

    set i [expr $i + 1]
}

delete_CkCrypt2 $crypt
delete_CkBinData $binData
delete_CkCert $cert
delete_CkCertChain $certChain