Package com.chilkatsoft.chilkat2

Class XmlDSigGen

java.lang.Object
com.chilkatsoft.chilkat2.ChilkatObject
com.chilkatsoft.chilkat2.XmlDSigGen
All Implemented Interfaces:
AutoCloseable
public class XmlDSigGen extends ChilkatObject
<section class="xmldsiggen-summary">

Create XML Digital Signatures with precise control over references, transforms, keys, and placement.

Chilkat.XmlDSigGen creates XML Digital Signatures for same-document XML, external XML, text, binary, file, and Object-based references. It supports enveloped, enveloping, and detached-style signing workflows; X.509 certificate KeyInfo; custom KeyInfo XML; RSA, DSA, and ECDSA private keys; HMAC signatures; canonicalization options; reference transforms; signature insertion placement; timestamp authority settings; and compatibility options for systems with strict or unusual XML signature requirements.

Same-document signatures

Sign XML already present in the document, including enveloped signatures where the signature is inserted into the signed XML.

External references

Add references to external XML, text, binary data, files, or custom application-provided content.

Object and enveloping signatures

Build signatures that include signed data inside XML Object elements or produce enveloping signature structures.

Keys and KeyInfo

Sign with private keys or HMAC secrets and include certificate-based, public-key, or fully custom KeyInfo XML.

Canonicalization and transforms

Configure canonicalization, digest algorithms, signature algorithms, and reference transforms required by the receiving system.

Placement and compatibility

Control where the signature is inserted and enable compatibility behaviors for XML signature profiles with special formatting rules.

Common pattern: Configure the signature algorithm, canonicalization method, signing key or certificate, and KeyInfo style; add one or more references with the required transforms and digest methods; choose where the signature should be placed; then generate the signed XML. Use Chilkat.XmlDSigGen to create signatures and Chilkat.XmlDSig to inspect or verify them.

For an extended overview, see XmlDSigGen Class Overview.

</section>

Event-capable: long-running methods report progress through a ProgressListener installed with setProgressListener(ProgressListener), onAbortCheck(BooleanSupplier), onPercentDone(IntPredicate) or onProgressInfo(BiConsumer).

Instances hold a native Chilkat object: close them with ChilkatObject.close() (try-with-resources) when done; an unclosed instance is freed when it becomes unreachable.

See Also:
Online reference

  • Constructor Details

    • XmlDSigGen

      public XmlDSigGen()
      Creates a new XmlDSigGen object.

  • Method Details

    • getBehaviors

      public String getBehaviors()
      A comma-separated list of keywords to specify special behaviors to work around potential oddities or special requirements needed for providing signatures to particular systems. This is an open-ended property where new behaviors can be implemented depending on the needs encountered by Chilkat customers. The possible behaviors are listed below.
      • AttributeSortingBug (introduced in v9.5.0.79) Tells Chilkat to produce a signature that duplicates a common XML canonicalization attribute sorting bug found in some XML signature implementations (such as JPK VAT signed XML documents for Polish government, i.e. mf.gov.pl, csioz.gov.pl, crd.gov.pl, etc). See XML Signature Canonicalization Bug for details.
      • Base64CrEntity Produce multi-line base64 for XML elements such as SignatureValue and X509Certificate, with each line ending in a CR hex entity, except for the last line. For example: 
        <ds:X509Certificate>MIIFNTCCBB2gAwIBAgIQHozVnBl1lTsusAh26u6WZTANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UE&#xD;
 BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG&#xD;
 A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxPTA7BgNVBAMTNENPTU9ETyBSU0EgQ2xpZW50IEF1dGhl&#xD;
 ...
 sp3FRlACVeb1Qlytr4vgc5FlCqn0rMtjlF4=
 </ds:X509Certificate>
      • Base64Cr13Entity Produce multi-line base64 for XML elements such as SignatureValue and X509Certificate, with each line ending in a CR decimal entity, except for the last line. For example: 
        <ds:X509Certificate>MIIFNTCCBB2gAwIBAgIQHozVnBl1lTsusAh26u6WZTANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UE&#13;
 BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG&#13;
 A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxPTA7BgNVBAMTNENPTU9ETyBSU0EgQ2xpZW50IEF1dGhl&#13;
 ...
 sp3FRlACVeb1Qlytr4vgc5FlCqn0rMtjlF4=
 </ds:X509Certificate>
      • Base64Multiline Produce multi-line base64 for XML elements such as SignatureValue and X509Certificate. For example: 
        <ds:X509Certificate>MIIFNTCCBB2gAwIBAgIQHozVnBl1lTsusAh26u6WZTANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UE
 BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG
 A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxPTA7BgNVBAMTNENPTU9ETyBSU0EgQ2xpZW50IEF1dGhl
 ...
 sp3FRlACVeb1Qlytr4vgc5FlCqn0rMtjlF4=
 </ds:X509Certificate>
      • ForceAddEnvelopedSignatureTransform The _LT_Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> is normally only added when the Signature is contained within the XML fragment that is signed. The meaning of this tranformation is to tell the verifier to remove the Signature from the data prior to canonicalizing. If the Signature is not contained within the XML fragment that was signed, then the signature was not enveloped. There would be no need to remove the Signature because the Signature is not contained in the XML fragment being verified. However.. some brain-dead verifiying systems require this Transform to be present regardless of whether it makes sense. This behavior will cause Chilkat to add the Transform regardless.
      • NoEnvelopedSignatureTransform (introduced in v9.5.0.82) Prevents the _LT_Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> from being added in all cases.
      • EnvelopedTransformFirst (introduced in v9.5.0.87) Forces the http://www.w3.org/2000/09/xmldsig#enveloped-signature to be listed first when there are multiple transforms for a reference.
      • ebXmlTransform (introduced in v9.5.0.73) Causes the following tranform to be added for ebXml messages:
         _LT_Transform Algorithm=http://www.w3.org/TR/1999/REC-xpath-19991116>
 _LT_XPath
 xmlns:SOAP-ENV=http://schemas.xmlsoap.org/soap/envelope/>not(ancestor-or-self::node()[@SOAP-ENV:actor=urn:oasis:names:tc:ebxml-msg:actor:nextMSH]
 |
 ancestor-or-self::node()[@SOAP-ENV:actor=http://schemas.xmlsoap.org/soap/actor/next])_LT_/XPath>
 _LT_/Transform>
 
      • TransformSignatureXPath (introduced in v9.5.0.75) Causes the following tranform to be
 added:
         _LT_ds:Transform Algorithm=http://www.w3.org/TR/1999/REC-xpath-19991116_GT_
 _LT_ds:XPath_GT_not(ancestor-or-self::ds:Signature)_LT_/ds:XPath_GT_
 _LT_/ds:Transform_GT_
 
      • CompactSignedXml (introduced in v9.5.0.73) The passed-in XML to be signed is first
 reformatted to a compact representation by removing all CR's, LF's, and unnecessary whitespace so
 that the XML to be signed is on a single line. The resulting XML (with signature) is also entirely
 contained on a single line. (If an XML declarator is present, then it will remain on it's own line.)
 
      • IndentedSignature (introduced in v9.5.0.73) Causes the XML Signature to be produced on
 multiple lines with indentation for easier human readability. The CompactSignedXml behavior takes
 precedence over this behavior.
 
      • FullLocalSigningTime (introduced in v9.5.0.76) Causes the signing time to be formatted
 like this: 2017-05-20T19:16:05.649+01:00.nnn, where the .nnn is added to indicate
 milliseconds.
 
      • LocalSigningTime (introduced in v9.5.0.76) Causes the signing time to be formatted using
 a local time (with a timezone offset such as +01:00 rather than Z to
 signify GMT).
 
      • NoReplaceSigningTime Don't replace the <SigningTime> content with a timestamp of
 the current date/time. Instead keep the current value provided by the application.
 
      • NoTimestampBias Exclude the timestamp bias from the generated <SigningTime>
 
      • DnReverseOrder (introduced in v9.5.0.77) Causes DN's (certificate Distinguished Names) to
 be written in reverse order. Reverse order leads with CN, such as CN=..., O=...,
 OU=..., C=..., whereas normal order ends with CN, such as C=..., OU=...,
 O=..., CN=...
 
      • IssuerSerialHex (introduced in v9.5.0.77) Causes the issuer serial number located in
 SignedProperties.SignedSignatureProperties.SigningCertificate to be emitted as uppercase hex instead
 of decimal. (Also, when signing XML for e-dokumenty.mf.gov.pl, Chilkat automatically recognizes it
 and uses IssuerSerialHex.)
 
      • IssuerSerialHexLower (introduced in v9.5.0.77) Causes the issuer serial number located in
 SignedProperties.SignedSignatureProperties.SigningCertificate to be emitted as lowercase hex instead
 of decimal.
 
      • SigningTimeAdjust-_LT_numSeconds_GT_ (introduced in v9.5.0.80) When Chilkat automatically
 fills in the value for a SigningTime, it will use the current system date/time. This behavior can be
 used to adjust the generate time to numSeconds in the past. For example:
 SigningTimeAdjust-60 will generate a signing time 60 seconds prior to the current time.
 
      • SigningTimeAdjust+_LT_numSeconds_GT_ (introduced in v9.5.0.88) When Chilkat automatically
 fills in the value for a SigningTime, it will use the current system date/time. This behavior can be
 used to adjust the generate time to numSeconds in the future. For example:
 SigningTimeAdjust+60 will generate a signing time 60 seconds past the current time.
 
      • UBLDocumentSignatures Causes an XPath ancestor-or-self Transform to be added
 for the 1st reference. See the example at
 UBL XAdES Enveloped
 Signature
 
      • SignExistingSignatures This keyword can be used when applying a 2nd or greater signature
 and the new signature will encompass one or more existing signatures. The default behavior is that
 existing signatures are not included in the canonicalization/digest before signing. Adding this
 keyword will cause existing signatures to be included in the canonicalization/digest.
      Returns:
      the value of the Behaviors property

    • setBehaviors

      public void setBehaviors​(String value)
      Sets the Behaviors property; see getBehaviors().
      Parameters:
      value - the new value (not null)

    • getCustomKeyInfoXml

      public String getCustomKeyInfoXml()
      Specifies custom XML to be inserted in the KeyInfo element of the Signature. A common use is to provide a wsse:SecurityTokenReference fragment of XML.
      Returns:
      the value of the CustomKeyInfoXml property

    • setCustomKeyInfoXml

      public void setCustomKeyInfoXml​(String value)
      Sets the CustomKeyInfoXml property; see getCustomKeyInfoXml().
      Parameters:
      value - the new value (not null)

    • getIncNamespacePrefix

      public String getIncNamespacePrefix()
      The namespace prefix to use for InclusiveNamespaces elements. The default value is ec. Set this property to the empty string to omit an InclusiveNamespaces prefix. For example, given the default values of IncNamespaceUri and IncNamespacePrefix, generated InclusiveNamespaces elements will appear like this: 
      <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"> ... </ec:InclusiveNamespaces>
      Returns:
      the value of the IncNamespacePrefix property

    • setIncNamespacePrefix

      public void setIncNamespacePrefix​(String value)
      Sets the IncNamespacePrefix property; see getIncNamespacePrefix().
      Parameters:
      value - the new value (not null)

    • getIncNamespaceUri

      public String getIncNamespaceUri()
      The namespace URI for any InclusiveNamespaces elements that are created. The default value is http://www.w3.org/2001/10/xml-exc-c14n#. For example, if the IncNamespacePrefix equals ec and this property remains at the default value, then the generated Signature element will be: 
      <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"> ... </ec:InclusiveNamespaces>
      Returns:
      the value of the IncNamespaceUri property

    • setIncNamespaceUri

      public void setIncNamespaceUri​(String value)
      Sets the IncNamespaceUri property; see getIncNamespaceUri().
      Parameters:
      value - the new value (not null)

    • getKeyInfoId

      public String getKeyInfoId()
      If set, causes the generated KeyInfo element to include an Id attribute with this value. For example: 
      ...
    _LT_ds:KeyInfo Id="KeyInfo"_GT_
       _LT_ds:X509Data_GT_
          _LT_ds:X509SubjectName_GT_CERTIFICADO DE ABC_LT_/ds:X509SubjectName_GT_
          _LT_ds:X509Certificate_GT_MIIITTCC....fIsIZeZOeQ=_LT_/ds:X509Certificate_GT_
       _LT_/ds:X509Data_GT_
    _LT_/ds:KeyInfo_GT_
 ...
      Returns:
      the value of the KeyInfoId property

    • setKeyInfoId

      public void setKeyInfoId​(String value)
      Sets the KeyInfoId property; see getKeyInfoId().
      Parameters:
      value - the new value (not null)

    • getKeyInfoKeyName

      public String getKeyInfoKeyName()
      Specifies the KeyName to be inserted in the KeyInfo element of the Signature if the KeyInfoType equals KeyName.
      Returns:
      the value of the KeyInfoKeyName property

    • setKeyInfoKeyName

      public void setKeyInfoKeyName​(String value)
      Sets the KeyInfoKeyName property; see getKeyInfoKeyName().
      Parameters:
      value - the new value (not null)

    • getKeyInfoType

      public String getKeyInfoType()
      Specifies the type of information that will be included in the optional KeyInfo element of the Signature. Possible values are:
      • None
      • KeyName
      • KeyValue
      • X509Data
      • X509Data+KeyValue
      • Custom

      The default value is KeyValue. The X509Data+KeyValue option was added in Chilkat v9.5.0.73.

      If None, then no KeyInfo element is added to the Signature when generated.

      If KeyValue, then the KeyInfo will contain the public key (RSA, DSA, or ECDSA).

      If X509Data, then the KeyInfo will contain information about an X.509 certificate as specified by the X509Type property.

      If Custom, then the KeyInfo will contain the custom XML contained in the CustomKeyInfoXml property.

      Returns:
      the value of the KeyInfoType property

    • setKeyInfoType

      public void setKeyInfoType​(String value)
      Sets the KeyInfoType property; see getKeyInfoType().
      Parameters:
      value - the new value (not null)

    • getSigId

      public String getSigId()
      An option Id attribute value for the Signature element. The default value is the empty string, which generates a Signature element with no Id attribute. For example: 
      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

      If this property is set to "abc123", then the Signature element would be generated like this: 

      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="abc123">
      Returns:
      the value of the SigId property

    • setSigId

      public void setSigId​(String value)
      Sets the SigId property; see getSigId().
      Parameters:
      value - the new value (not null)

    • getSigLocation

      public String getSigLocation()
      Indicates where the Signature is to be located within the XML that is signed. This is a path to the position in the XML where the Signature will be inserted, using Chilkat path syntax (using vertical bar characters to delimit tag names. If the Signature element is to be the root of XML document, then set this property equal to the empty string.

      For example, if we have the following SOAP XML and wish to insert the Signature at the indicated location, then the SigLocation property should be set to SOAP-ENV:Envelope|SOAP-ENV:Header|wsse:Security. 

      <?xml version="1.0" encoding="UTF-8" standalone="no"?>
 <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
     <SOAP-ENV:Header>
     <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" SOAP-ENV:mustUnderstand="1">
         ** The XML Signature is to be inserted here **
     </wsse:Security>
     </SOAP-ENV:Header>
 ...
 </SOAP-ENV:Envelope>
      Returns:
      the value of the SigLocation property

    • setSigLocation

      public void setSigLocation​(String value)
      Sets the SigLocation property; see getSigLocation().
      Parameters:
      value - the new value (not null)

    • getSigLocationIdx

      public int getSigLocationIdx()
      Insert the signature at the Nth occurrence of the getSigLocation(). The default is 0, which is to insert (according to getSigLocationMod() ) at the 1st occurrence. (An index value of 1 is for the 2nd occurrence, and so on.)
      Returns:
      the value of the SigLocationIdx property

    • setSigLocationIdx

      public void setSigLocationIdx​(int value)
      Sets the SigLocationIdx property; see getSigLocationIdx().
      Parameters:
      value - the new value

    • getSigLocationMod

      public int getSigLocationMod()
      Modifies the placement of the signature at the location specified by SigLocation. Possible values are:
      • 0: Insert the Signature as the last child of the element at SigLocation. This is the default.
      • 1: Insert the Signature as a sibling directly after the element at SigLocation.
      • 2: Insert the Signature as a sibling directly before the element at SigLocation.

      Returns:
      the value of the SigLocationMod property

    • setSigLocationMod

      public void setSigLocationMod​(int value)
      Sets the SigLocationMod property; see getSigLocationMod().
      Parameters:
      value - the new value

    • getSigNamespacePrefix

      public String getSigNamespacePrefix()
      The namespace prefix of the Signature that is to be created. The default value is ds. Set this property to the empty string to omit a Signature namespace URI and prefix. For example, given the default values of SigNamespaceUri and SigNamespacePrefix, the generated Signature element will be: 
      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> ... </ds:Signature>
      Returns:
      the value of the SigNamespacePrefix property

    • setSigNamespacePrefix

      public void setSigNamespacePrefix​(String value)
      Sets the SigNamespacePrefix property; see getSigNamespacePrefix().
      Parameters:
      value - the new value (not null)

    • getSigNamespaceUri

      public String getSigNamespaceUri()
      The namespace URI of the Signature that is to be created. The default value is http://www.w3.org/2000/09/xmldsig#. For example, if the SigNamespacePrefix equals ds and this property remains at the default value, then the generated Signature element will be: 
      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> ... </ds:Signature>
      Returns:
      the value of the SigNamespaceUri property

    • setSigNamespaceUri

      public void setSigNamespaceUri​(String value)
      Sets the SigNamespaceUri property; see getSigNamespaceUri().
      Parameters:
      value - the new value (not null)

    • getSigValueId

      public String getSigValueId()
      An option Id attribute value for the SignatureValue element. The default value is the empty string, which generates a SignatureValue element with no Id attribute. For example: 
      _LT_ds:SignatureValue_GT_

      If this property is set to "value-id-7d4a", then the Signature element would be generated like this: 

      _LT_ds:SignatureValue  Id="value-id-7d4a"_GT_
      Returns:
      the value of the SigValueId property

    • setSigValueId

      public void setSigValueId​(String value)
      Sets the SigValueId property; see getSigValueId().
      Parameters:
      value - the new value (not null)

    • getSignedInfoCanonAlg

      public String getSignedInfoCanonAlg()
      The canonicalization method to be used for the SignedInfo when creating the XML signature.
      • C14N -- for Inclusive Canonical XML (without comments)
      • C14N_11 -- for Inclusive Canonical XML 1.1 (without comments)
      • EXCL_C14N -- for Exclusive Canonical XML (without comments)
      • C14N_WithComments -- for Inclusive Canonical XML (with comments)
      • C14N_11_WithComments -- for Inclusive Canonical XML 1.1 (with comments)
      • EXCL_C14N_WithComments -- for Exclusive Canonical XML (with comments)
      • Note: The WithComments options are available in Chilkat v9.5.0.71 and later.

      The default value is EXCL_C14N.

      Returns:
      the value of the SignedInfoCanonAlg property

    • setSignedInfoCanonAlg

      public void setSignedInfoCanonAlg​(String value)
      Sets the SignedInfoCanonAlg property; see getSignedInfoCanonAlg().
      Parameters:
      value - the new value (not null)

    • getSignedInfoDigestMethod

      public String getSignedInfoDigestMethod()
      The digest method to be used for signing the SignedInfo part of the Signature. Possible values are sha1, sha256, sha384, and sha512. The default is sha256.
      Returns:
      the value of the SignedInfoDigestMethod property

    • setSignedInfoDigestMethod

      public void setSignedInfoDigestMethod​(String value)
      Sets the SignedInfoDigestMethod property; see getSignedInfoDigestMethod().
      Parameters:
      value - the new value (not null)

    • getSignedInfoId

      public String getSignedInfoId()
      Optional Id attribute to be added to the SignedInfo element. The default value is the empty string, meaning that the SignedInfo is generated without an Id attribute.
      Returns:
      the value of the SignedInfoId property

    • setSignedInfoId

      public void setSignedInfoId​(String value)
      Sets the SignedInfoId property; see getSignedInfoId().
      Parameters:
      value - the new value (not null)

    • getSignedInfoPrefixList

      public String getSignedInfoPrefixList()
      The inclusive namespace prefix list to be added, if any, when the SignedInfoCanonAlg is equal to EXCL_C14N. The defautl value is the empty string. If namespaces are listed, they are separated by space characters.

      If, for example, this property is set to wsse SOAP-ENV, then the CanonicalizationMethod part of the SignedInfo that is generated would look like this: 

      <ds:SignedInfo>
     <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
       <InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="wsse SOAP-ENV" />
     </ds:CanonicalizationMethod>
 ...
 </ds:SignedInfo>
      Returns:
      the value of the SignedInfoPrefixList property

    • setSignedInfoPrefixList

      public void setSignedInfoPrefixList​(String value)
      Sets the SignedInfoPrefixList property; see getSignedInfoPrefixList().
      Parameters:
      value - the new value (not null)

    • getSigningAlg

      public String getSigningAlg()
      Selects the signature algorithm to be used when using an RSA key to sign. The default value is PKCS1-v1_5. This can be set to RSASSA-PSS (or simply pss) to use the RSASSA-PSS signature scheme.

      Note: This property only applies when signing with an RSA private key. It does not apply for ECC or DSA private keys.

      Returns:
      the value of the SigningAlg property

    • setSigningAlg

      public void setSigningAlg​(String value)
      Sets the SigningAlg property; see getSigningAlg().
      Parameters:
      value - the new value (not null)

    • getUncommonOptions

      public String getUncommonOptions()
      This is a catch-all property to be used for uncommon needs. This property defaults to the empty string, and should typically remain empty.
      Returns:
      the value of the UncommonOptions property

    • setUncommonOptions

      public void setUncommonOptions​(String value)
      Sets the UncommonOptions property; see getUncommonOptions().
      Parameters:
      value - the new value (not null)

    • getX509Type

      public String getX509Type()
      Specifies the kind of X.509 certificate information is provided in the KeyInfo element when the KeyInfoType equals X509Data. Possible values are:
      • Certificate
      • CertChain
      • IssuerSerial
      • SubjectName
      • SKI

      The default value is Certificate.

      Note: This property can be set to a comma-separated list of the keywords above. For example, If set to SubjectName,Certificate, then both the X509SubjectName and X509Certificate parts will be added to the KeyInfo.

      If Certificate, then the KeyInfo will contain the base64 encoded X.509v3 certificate.

      If CertChain, then the KeyInfo will contain the base64 encoded X.509v3 certificate as well as any certificates available in the chain of authentication to the root cert.

      If IssuerSerial, then the KeyInfo will contain the X.509 issuer's distinguished name and the signing certificate's serial number.

      If SubjectName, then the KeyInfo will contain the X.509 subject distinguished name.

      If SKI, then the KeyInfo will contain the base64 encoded value of the cert's X.509 SubjectKeyIdentifier extension.

      Returns:
      the value of the X509Type property

    • setX509Type

      public void setX509Type​(String value)
      Sets the X509Type property; see getX509Type().
      Parameters:
      value - the new value (not null)

    • addEnvelopedRef

      public void addEnvelopedRef​(String id, StringBuilder content, String digestMethod, String canonMethod, String refType)
      Specifies an enveloped Reference to be added to the Signature when generated. An enveloped Reference is for data contained within the Signature. (The Signature is to be an enveloping signature, and the data is enveloped by the Signature.)

      The id is the value of the Id attribute of the Object element that is to be contained within the generated Signature. The content is the text content to be contained in the Object. Binary data can be signed by passing the bytes in content in an encoded format (such as base64 or hex).

      The digestMethod is the digest method and can be one of the following: sha1, sha256, sha384, sha512, ripemd160, or md5.

      The canonMethod is the canonicalization method, and can be one of the following.

      • C14N -- for Inclusive Canonical XML (without comments)
      • C14N_11 -- for Inclusive Canonical XML 1.1 (without comments)
      • EXCL_C14N -- for Exclusive Canonical XML (without comments)
      • C14N_WithComments -- for Inclusive Canonical XML (with comments)
      • C14N_11_WithComments -- for Inclusive Canonical XML 1.1 (with comments)
      • EXCL_C14N_WithComments -- for Exclusive Canonical XML (with comments)
      • Note: The WithComments options are available in Chilkat v9.5.0.71 and later.

      The refType is optional and is usually not needed. Set this to the empty string unless it is desired to add a Type attribute to the Reference that is advisory only.

      Parameters:
      id - the id argument (not null)
      content - the content argument (not null)
      digestMethod - the digestMethod argument (not null)
      canonMethod - the canonMethod argument (not null)
      refType - the refType argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • addExternalBinaryRef

      public void addExternalBinaryRef​(String uri, BinData content, String digestMethod, String refType)
      Specifies an external non-XML binary data Reference to be added to the Signature when generated.

      The uri is the value of the URI attribute of the Reference.

      The content contains the binary data to be digested according to the digestMethod.

      The digestMethod is the digest method and can be one of the following: sha1, sha256, sha384, sha512, ripemd160, or md5.

      The refType is optional and is usually not needed. Set this to the empty string unless it is desired to add a Type attribute to the Reference that is advisory only.

      Parameters:
      uri - the uri argument (not null)
      content - the content argument (not null)
      digestMethod - the digestMethod argument (not null)
      refType - the refType argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • addExternalFileRef

      public void addExternalFileRef​(String uri, String localFilePath, String digestMethod, String refType)
      Specifies an external file Reference to be added to the Signature when generated.

      The uri is the value of the URI attribute of the Reference. It can (and likely will) be different than the localFilePath which is the path to the local file to be added. (The local file is not read until the XML digital signature is actually created.)

      The digestMethod is the digest method and can be one of the following: sha1, sha256, sha384, sha512, ripemd160, or md5.

      The refType is optional and is usually not needed. Set this to the empty string unless it is desired to add a Type attribute to the Reference that is advisory only.

      Parameters:
      uri - the uri argument (not null)
      localFilePath - the localFilePath argument (not null)
      digestMethod - the digestMethod argument (not null)
      refType - the refType argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • addExternalTextRef

      public void addExternalTextRef​(String uri, StringBuilder content, String charset, boolean includeBom, String digestMethod, String refType)
      Specifies an external non-XML text data Reference to be added to the Signature when generated.

      The uri is the value of the URI attribute of the Reference.

      The content contains the non-XML data to be digested according to the charset. The charset specifies the charset (such as utf-8, windows-1252, etc.) for the byte reprsentation of the text to be digested. The includeBom indicates whether the BOM (Byte Order Mark, also known as the preamble) is included in the byte representation that is digested.

      The digestMethod is the digest method and can be one of the following: sha1, sha256, sha384, sha512, ripemd160, or md5.

      The refType is optional and is usually not needed. Set this to the empty string unless it is desired to add a Type attribute to the Reference that is advisory only.

      Parameters:
      uri - the uri argument (not null)
      content - the content argument (not null)
      charset - the charset argument (not null)
      includeBom - the includeBom argument
      digestMethod - the digestMethod argument (not null)
      refType - the refType argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • addExternalXmlRef

      public void addExternalXmlRef​(String uri, StringBuilder content, String digestMethod, String canonMethod, String refType)
      Specifies an external XML Reference to be added to the Signature when generated.

      The uri is the value of the URI attribute of the Reference.

      The content contains the XML document to be referenced.

      The digestMethod is the digest method and can be one of the following: sha1, sha256, sha384, sha512, ripemd160, or md5.

      The canonMethod is the canonicalization method, and can be one of the following.

      • C14N -- for Inclusive Canonical XML (without comments)
      • C14N_11 -- for Inclusive Canonical XML 1.1 (without comments)
      • EXCL_C14N -- for Exclusive Canonical XML (without comments)
      • C14N_WithComments -- for Inclusive Canonical XML (with comments)
      • C14N_11_WithComments -- for Inclusive Canonical XML 1.1 (with comments)
      • EXCL_C14N_WithComments -- for Exclusive Canonical XML (with comments)
      • -- An empty string indicates that no transformation should be included / applied for this reference.
      • Note: The WithComments options are available in Chilkat v9.5.0.71 and later.
      • Note: The empty-string canonMethod is available in Chilkat v9.5.0.75 and later.

      The refType is optional and is usually not needed. Set this to the empty string unless it is desired to add a Type attribute to the Reference that is advisory only.

      Parameters:
      uri - the uri argument (not null)
      content - the content argument (not null)
      digestMethod - the digestMethod argument (not null)
      canonMethod - the canonMethod argument (not null)
      refType - the refType argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • addObject

      public void addObject​(String id, String content, String mimeType, String encoding)
      Specifies an Object to be added to the Signature.
      1. The id is the value of the Object element's Id attribute.
      2. The content contains the content of the Object element, which may be XML or plain text.
      3. The mimeType is the value of the Object element's MimeType attribute
      4. The encoding is the value of the Object element's Encoding attribute

      In most cases, the mimeType and encoding are empty strings which cause the MimeType and Encoding attributes to be omitted.

      Parameters:
      id - the id argument (not null)
      content - the content argument (not null)
      mimeType - the mimeType argument (not null)
      encoding - the encoding argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • addObjectRef

      public void addObjectRef​(String id, String digestMethod, String canonMethod, String prefixList, String refType)
      This is the same as the AddSameDocRef method, except the reference is to content within an Object previously added via the AddObject method. The id must be an Id equal to the Id attribute of an Object, or the Id attribute of an element within the Object.

      Note: The canonMethod can be set to Base64 to use the http://www.w3.org/2000/09/xmldsig#base64 transform.

      Parameters:
      id - the id argument (not null)
      digestMethod - the digestMethod argument (not null)
      canonMethod - the canonMethod argument (not null)
      prefixList - the prefixList argument (not null)
      refType - the refType argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • addObjectRef2

      public void addObjectRef2​(String id, String digestMethod, Xml transforms, String refType)
      This method is the same as AddObjectRef, except it allows the Transforms to be specified exactly with a fragment of XML. See the example below.
      Parameters:
      id - the id argument (not null)
      digestMethod - the digestMethod argument (not null)
      transforms - the transforms argument (not null)
      refType - the refType argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • addSameDocRef

      public void addSameDocRef​(String id, String digestMethod, String canonMethod, String prefixList, String refType)
      Specifies a same document Reference to be added to the Signature when generated. A same document Reference can be the entire XML document, or a fragment of the XML document.

      The id can be the empty string to sign the entire XML document, or it can be the fragment identifier to sign a portion of the XML document.

      The digestMethod is the digest method and can be one of the following: sha1, sha256, sha384, sha512, ripemd160, or md5.

      The canonMethod is the canonicalization method, and can be one of the following:

      • C14N -- for Inclusive Canonical XML (without comments)
      • C14N_11 -- for Inclusive Canonical XML 1.1 (without comments)
      • EXCL_C14N -- for Exclusive Canonical XML (without comments)
      • C14N_WithComments -- for Inclusive Canonical XML (with comments)
      • C14N_11_WithComments -- for Inclusive Canonical XML 1.1 (with comments)
      • EXCL_C14N_WithComments -- for Exclusive Canonical XML (with comments)
      • -- An empty string indicates that no transformation should be included / applied for this reference.
      • Note: The WithComments options are available in Chilkat v9.5.0.71 and later.
      • Note: The empty-string canonMethod is available in Chilkat v9.5.0.75 and later.

      If exclusive canonicalization is selected, then the prefixList can contain a space separated list of inclusive namespace prefixes. For inclusive canonicalization, this argument is ignored. In general, pass an empty string for this argument unless you have specific knowledge of namespace prefixes that need to be treated as inclusive when EXCL_C14N is used.

      Starting in Chilkat v9.5.0.70, the prefixList can be set to the keyword _EMPTY_ to force the generation of an empty PrefixList under the Transform. For example: 

        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
     <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList=""/>
   </ds:Transform>

      The refType is optional and is usually not needed. Set this to the empty string unless it is desired to add a Type attribute to the Reference that is advisory only.

      Parameters:
      id - the id argument (not null)
      digestMethod - the digestMethod argument (not null)
      canonMethod - the canonMethod argument (not null)
      prefixList - the prefixList argument (not null)
      refType - the refType argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • addSameDocRef2

      public void addSameDocRef2​(String id, String digestMethod, Xml transforms, String refType)
      This method is the same as AddSameDocRef, except it allows the Transforms to be specified exactly with a fragment of XML. See the example below.
      Parameters:
      id - the id argument (not null)
      digestMethod - the digestMethod argument (not null)
      transforms - the transforms argument (not null)
      refType - the refType argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • addSignatureNamespace

      public void addSignatureNamespace​(String nsPrefix, String nsUri)
      Can be called one or more times to add additional namespaces to the Signature element.
      Parameters:
      nsPrefix - the nsPrefix argument (not null)
      nsUri - the nsUri argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • constructSignedInfo

      public String constructSignedInfo​(StringBuilder sbXml)
      This method will construct and return the canonicalized SignedInfo XML. The digests of each Reference are computed and included in the SignedInfo. This method is provided for certain special circumstances where one wants to get the exact canonicalized SignedInfo that would be signed using the private key.

      Note: Properties such as SigLocation, SigningAlg, etc. and references must be set exactly as if an XML signature was to be actually generated because they determine the content of the SignedInfo.

      Note, the sbXml is not signed by this method. It is not modified.

      Parameters:
      sbXml - the sbXml argument (not null)
      Returns:
      the result (never null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • createXmlDSig

      public String createXmlDSig​(String inXml)
      Creates an XML Digital Signature. The application passes in the XML to be signed, and the signed XML is returned. If creating an enveloping signature where the Signature element is the root, then the inXml may be the empty string.
      • Chilkat v9.5.0.76 or greater is required for XML signatures for www.csioz.gov.pl

      Parameters:
      inXml - the inXml argument (not null)
      Returns:
      the result (never null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • createXmlDSigSb

      public void createXmlDSigSb​(StringBuilder sbXml)
      Creates an XML Digital Signature. The application passes the XML to be signed in sbXml, and it is replaced with the signed XML if successful. (Thus, sbXml is both an input and output argument.) Note: If creating an enveloping signature where the Signature element is to be the root element, then the passed-in sbXml may be empty.
      Parameters:
      sbXml - the sbXml argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • setHmacKey

      public void setHmacKey​(String key, String encoding)
      Sets the HMAC key to be used if the Signature is to use an HMAC signing algorithm. The encoding specifies the encoding of key, and can be hex, base64, ascii, or any of the binary encodings supported by Chilkat in the link below.
      Parameters:
      key - the key argument (not null)
      encoding - the encoding argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • setHttpObj

      public void setHttpObj​(Http http)
      Sets the HTTP object to be used to communicate with OCSP responders, CRL distribution points, or timestamp authority (TSA) servers if needed. The http is used to send the requests, and it allows for connection related settings and timeouts to be set. For example, if HTTP or SOCKS proxies are required, these features can be specified on the http.
      Parameters:
      http - the http argument (not null)

    • setPrivateKey

      public void setPrivateKey​(PrivateKey privKey)
      Sets the private key to be used for creating the XML signature. The private key may be an RSA key, a DSA key, or an ECDSA key.
      Parameters:
      privKey - the privKey argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • setRefIdAttr

      public void setRefIdAttr​(String uri_or_id, String value)
      Sets the Id attribute for a Reference.
      Parameters:
      uri_or_id - the uri_or_id argument (not null)
      value - the value argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • setTsa

      public void setTsa​(JsonObject json)
      Sets the TSA (Timestamp Authority) URL and other related settings for automatically adding an EncapsulatedTimestamp.
      Parameters:
      json - the json argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • setX509Cert

      public void setX509Cert​(Cert cert, boolean usePrivateKey)
      Specifies the X.509 certificate to be used for the KeyInfo element when the KeyInfoType equals X509Data. If usePrivateKey is true, then the private key will also be set using the certificate's private key. Thus, the SetPrivateKey method does not need to be called. If usePrivateKey is true, and the certificate does not have an associated private key available, then this method will return false.

      Note: A certificate's private key is not stored within a certificate itself. If the certificate (cert) was obtained from a PFX, Java KeyStore, or other such source, which are containers for both certs and private keys, then Chilkat would have associated the cert with the private key when loading the PFX or JKS, and all is good. The same holds true if, on a Windows system, the certificate was obtained from a Windows-based registry certificate store where the private key was installed with the permission to export.

      If, however, the certificate was loaded from a .cer file, or another type of file that contains only the certificate and not the private key, then the associated private key needs to be obtained by the application and provided by calling SetPrivateKey.

      Parameters:
      cert - the cert argument (not null)
      usePrivateKey - the usePrivateKey argument
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • setProgressListener

      public void setProgressListener​(ProgressListener listener)
      Installs the listener that receives this object's progress events (abortCheck, percentDone, progressInfo) during its long-running methods; replaces any listener or lambda installed before; null removes it.
      Parameters:
      listener - the listener, or null
      Throws:
      IllegalStateException - if called from inside one of this object's own callbacks

    • getProgressListener

      public ProgressListener getProgressListener()
      Returns the installed listener, or null.
      Returns:
      the listener installed with setProgressListener(ProgressListener) or one of the on... methods

    • onAbortCheck

      public void onAbortCheck​(BooleanSupplier callback)
      Installs a listener whose only callback is abortCheck: called every HeartbeatMs milliseconds during a long-running method; return true to abort it. Replaces any listener installed before.
      Parameters:
      callback - the callback, or null to remove the listener

    • onPercentDone

      public void onPercentDone​(IntPredicate callback)
      Installs a listener whose only callback is percentDone: called with the completion percentage (0..100) as a long-running method progresses; return true to abort it. Replaces any listener installed before.
      Parameters:
      callback - the callback, or null to remove the listener

    • onProgressInfo

      public void onProgressInfo​(BiConsumer<String,​String> callback)
      Installs a listener whose only callback is progressInfo: called with a name/value pair of progress information as a long-running method proceeds. Replaces any listener installed before.
      Parameters:
      callback - the callback, or null to remove the listener