MessageSigner Class

Properties   Methods   Events   Config Settings   Errors  

The MessageSigner class digitally signs data and stores it in the PKCS#7 format.

Syntax

secureblackbox.MessageSigner

Remarks

PKCS#7 (Public Key Cryptography Standard #7) is a common format used to store encrypted and signed data. It is used by a variety of protocols, including S/MIME and CMS.

MessageSigner can sign binary data into PKCS#7 SignedData and AuthenticatedData subformats. RSA, ECDSA, and EdDSA algorithms are supported.

Setting up and using MessageSigner is easy:

• Set up your source and destination via InputFile (InputBytes) and OutputFile (OutputBytes) properties.
• Set SignatureType as per the desired signature type (PKCS#7 SignedData or AuthenticatedData, or PKCS#1) and the detached option.
• Set signature properties, such as ClaimedSigningTime and attributes (AddAttribute).
• For the SignedData-type signature (most commonly used), assign the signing certificate with its private key to the SigningCertificate property.
• For the AuthenticatedData-type signature, assign the recipient's certificate to RecipientCertificate property.
• Optionally provide the timestamping server URL to TimestampServer.
• Call Sign to execute the operation.

Note that MessageSigner always produces binary PKCS#7-compliant signed messages. For S/MIME email signing, see MailWriter. For PGP signing, see PGPWriter. For XML-SIG encryption, see XMLSigner.

MessageSigner is a simplified form of CAdESSigner. Both classes work with PKCS#7 signed messages. CAdESSigner, however, provides support for advanced (CAdES) signatures, including long-term validity, archival, and full chain validation capabilities. These advanced capabilities are absent from MessageSigner, which is only capable of creating basic PKCS#7 signatures. MessageSigner signer = new MessageSigner(); signer.setHashAlgorithm("SHA256"); // Default hashing algorithm SHA256 // Select the file which contains the message that will be signed signer.setInputFile("message.txt"); // Select the file where the signed message will be written signer.setOutputFile("signedMessage.bin"); // Specify the certificate that shall be used for signing the data signer.setSigningCertificate(new Certificate("cert.pfx","password")); // Provide the address of the Time Stamping Authority (TSA) server to be used for timestamping the signature signer.setTimestampServer("http://..."); signer.sign(); // Sign

Property List

---

The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

Method List

---

The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

Event List

---

The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

Config Settings

---

The following is a list of config settings for the class with short descriptions. Click on the links for further details.

ClaimedSigningTime Property (MessageSigner Class)

The signing time from the signer's computer.

Syntax

public String getClaimedSigningTime();
public void setClaimedSigningTime(String claimedSigningTime);

Default Value

""

Remarks

Use this property to provide the signature production time. The claimed time is not supported by a trusted source; it may be inaccurate, forfeited, or wrong, and as such is usually taken for informational purposes only by verifiers. Use timestamp servers to embed verifiable trusted timestamps. The time is in UTC.

ExternalCrypto Property (MessageSigner Class)

Provides access to external signing and DC parameters.

Syntax

public ExternalCrypto getExternalCrypto();

Remarks

Use this property to tune-up remote cryptography settings. SecureBlackbox supports two independent types of external cryptography: synchronous (based on the ExternalSign event) and asynchronous (based on the DC protocol and the DCAuth signing component).

This property is read-only.

Please refer to the ExternalCrypto type for a complete list of fields.

FIPSMode Property (MessageSigner Class)

Reserved.

Syntax

public boolean isFIPSMode();
public void setFIPSMode(boolean FIPSMode);

Default Value

False

Remarks

This property is reserved for future use.

HashAlgorithm Property (MessageSigner Class)

Specifies the hash algorithm to be used.

Syntax

public String getHashAlgorithm();
public void setHashAlgorithm(String hashAlgorithm);

Default Value

"SHA256"

Remarks

This property specifies the hash algorithm to used for calculating the signature.

InputBytes Property (MessageSigner Class)

Use this property to pass the input to class in byte array form.

Syntax

public byte[] getInputBytes();
public void setInputBytes(byte[] inputBytes);

Remarks

Assign a byte array containing the data to be processed to this property.

This property is not available at design time.

InputFile Property (MessageSigner Class)

A path to the source file.

Syntax

public String getInputFile();
public void setInputFile(String inputFile);

Default Value

""

Remarks

Use this property to provide a path to the file containing the data to be signed.

InputIsHash Property (MessageSigner Class)

Specifies whether the input source contains the hash of the data or the actual data.

Syntax

public boolean isInputIsHash();
public void setInputIsHash(boolean inputIsHash);

Default Value

False

Remarks

Use this property to tell the component whether the input source contains the actual data or its hash.

This property is not available at design time.

InputStream Property (MessageSigner Class)

A stream containing the data to be signed.

Syntax

public java.io.InputStream getInputStream();
public void setInputStream(java.io.InputStream inputStream);

Default Value

null

Remarks

Use this property to provide the data to be signed from a stream.

This property is not available at design time.

MACAlgorithm Property (MessageSigner Class)

Specifies the keyed MAC algorithm to use.

Syntax

public String getMACAlgorithm();
public void setMACAlgorithm(String MACAlgorithm);

Default Value

"SHA256"

Remarks

This property specifies the MAC algorithm to use for calculating the MAC signature.

OutputBytes Property (MessageSigner Class)

Use this property to read the output the class object has produced.

Syntax

public byte[] getOutputBytes();

Remarks

Read the contents of this property after the operation has completed to read the produced output. This property will only be set if the OutputFile and OutputStream properties had not been assigned.

This property is read-only and not available at design time.

OutputFile Property (MessageSigner Class)

A path to the output file.

Syntax

public String getOutputFile();
public void setOutputFile(String outputFile);

Default Value

""

Remarks

Use this property to specify the file to save the signed message to.

OutputStream Property (MessageSigner Class)

A stream where the signed data should be written.

Syntax

public java.io.OutputStream getOutputStream();
public void setOutputStream(java.io.OutputStream outputStream);

Default Value

null

Remarks

Use this property to specify the stream to save the signed message to.

This property is not available at design time.

Proxy Property (MessageSigner Class)

The proxy server settings.

Syntax

public ProxySettings getProxy();

Remarks

Use this property to tune up the proxy server settings.

This property is read-only.

Please refer to the ProxySettings type for a complete list of fields.

RecipientCertificate Property (MessageSigner Class)

The recipient certificate for HMAC-based signing.

Syntax

public Certificate getRecipientCertificate();
public void setRecipientCertificate(Certificate recipientCertificate);

Remarks

Use this property to specify the certificate to be used for encryption of the HMAC key. This is a "recipient's" certificate, and as such it does not need to have an associated private key.

The certificate is used with SignatureType set to one of the MAC options to generate an encrypted session key block. Upon receiving the signed message, the recipient decrypts the HMAC key and uses that to verify the integrity of the message.

This property is not available at design time.

Please refer to the Certificate type for a complete list of fields.

SignatureType Property (MessageSigner Class)

Specifies the kind of signature to create.

Syntax

public int getSignatureType();
public void setSignatureType(int signatureType);

Enumerated values:
  public final static int stUnknown = 0;
  public final static int stPKCS1Detached = 1;
  public final static int stPKCS7Detached = 2;
  public final static int stPKCS7Enveloping = 3;
  public final static int stPKCS7MACDetached = 4;
  public final static int stPKCS7MACEnveloping = 5;

Default Value

2

Remarks

Possible values:

SignedAttributes Property (MessageSigner Class)

Custom signature attributes to be covered by the electronic signature.

Syntax

public SignatureAttributeList getSignedAttributes();

Remarks

Signature attributes are used to store auxiliary information in the signature. Values included as signed attributes are covered by the signature.

This property is read-only and not available at design time.

Please refer to the SignatureAttribute type for a complete list of fields.

SigningCertificate Property (MessageSigner Class)

The certificate to be used for signing.

Syntax

public Certificate getSigningCertificate();
public void setSigningCertificate(Certificate signingCertificate);

Remarks

Use this property to specify the certificate that shall be used for signing the data. Note that this certificate should have a private key associated with it. Use SigningChain to supply the rest of the certificate chain for inclusion into the signature.

This property is not available at design time.

Please refer to the Certificate type for a complete list of fields.

SigningChain Property (MessageSigner Class)

The signing certificate chain.

Syntax

public CertificateList getSigningChain();
public void setSigningChain(CertificateList signingChain);

Remarks

Use this property to provide the chain for the signing certificate. Use the SigningCertificate property, if it is available, to provide the signing certificate itself.

This property is not available at design time.

Please refer to the Certificate type for a complete list of fields.

SocketSettings Property (MessageSigner Class)

Manages network connection settings.

Syntax

public SocketSettings getSocketSettings();

Remarks

Use this property to tune up network connection parameters.

This property is read-only.

Please refer to the SocketSettings type for a complete list of fields.

TimestampServer Property (MessageSigner Class)

The address of the timestamping server.

Syntax

public String getTimestampServer();
public void setTimestampServer(String timestampServer);

Default Value

""

Remarks

Use this property to provide the address of the Time Stamping Authority (TSA) server to be used for timestamping the signature.

SecureBlackbox supports RFC3161-compliant timestamping servers, available via HTTP or HTTPS.

If your timestamping service enforces credential-based user authentication (basic or digest), you can provide the credentials in the same URL:

http://user:password@timestamp.server.com/TsaService

For TSAs using certificate-based TLS authentication, provide the client certificate via the TLSClientChain property.

If this property is left empty, no timestamp will be added to the signature.

Starting from summer 2021 update (Vol. 2), the virtual timestamping service is supported, which allows you to intervene in the timestamping routine and provide your own handling for the TSA exchange. This may be handy if the service that you are requesting timestamps from uses a non-standard TSP protocol or requires special authentication option.

To employ the virtual service, assign an URI of the following format to this property:

virtual://localhost?hashonly=true&includecerts=true&reqpolicy=1.2.3.4.5&halg=SHA256&ignorenonce=true

Subscribe to Notification event to get notified about the virtualized timestamping event. The EventID of the timestamping event is TimestampRequest. Inside the event handler, read the base16-encoded request from the EventParam parameter and forward it to the timestamping authority. Upon receiving the response, pass it back to the component, encoded in base16, via the TimestampResponse config property:

component.Config("TimestampResponse=308208ab...");

Note that all the exchange with your custom TSA should take place within the same invocation of the Notification event.

The hashonly parameter of the virtual URI tells the component to only return the timestamp message imprint via the EventParam parameter. If set to false, EventParam will contain the complete RFC3161 timestamping request.

The includecerts parameter specifies that the requestCertificates parameter of the timestamping request should be set to true.

The reqpolicy parameter lets you specify the request policy, and the halg parameter specifies the hash algorithm to use for timestamping.

The ignorenonce parameter allows you to switch off client nonce verification to enable compatibility with TSA services that do not support nonce mirroring.

All the parameters are optional.

TLSClientChain Property (MessageSigner Class)

The TLS client certificate chain.

Syntax

public CertificateList getTLSClientChain();
public void setTLSClientChain(CertificateList TLSClientChain);

Remarks

Assign a certificate chain to this property to enable TLS client authentication in the class. Note that the client's end-entity certificate should have a private key associated with it.

Use the CertificateStorage or CertificateManager components to import the certificate from a file, system store, or PKCS11 device.

This property is not available at design time.

Please refer to the Certificate type for a complete list of fields.

TLSServerChain Property (MessageSigner Class)

The TLS server's certificate chain.

Syntax

public CertificateList getTLSServerChain();

Remarks

Use this property to access the certificate chain sent by the TLS server. This property is ready to read when the TLSCertValidate event is fired by the client component.

This property is read-only and not available at design time.

Please refer to the Certificate type for a complete list of fields.

TLSSettings Property (MessageSigner Class)

Manages TLS layer settings.

Syntax

public TLSSettings getTLSSettings();

Remarks

Use this property to tune up the TLS layer parameters.

This property is read-only.

Please refer to the TLSSettings type for a complete list of fields.

UnsignedAttributes Property (MessageSigner Class)

Custom unsigned attributes to be included in the electronic signature.

Syntax

public SignatureAttributeList getUnsignedAttributes();

Remarks

Signature attributes are used to store auxiliary information in the signature. Values included as unsigned attributes are not covered by the signature and can be changed or removed without affecting the signature.

This property is read-only and not available at design time.

Please refer to the SignatureAttribute type for a complete list of fields.

AddAttribute Method (MessageSigner Class)

Adds an attribute to the signature.

Syntax

public int addAttribute(String OID, byte[] value, boolean signedAttribute);

Remarks

Use this method to add a signed or unsigned attribute to the collection of attributes included in the new signature.

Note that CAdESSigner creates certain mandatory and/or widely used attributes automatically in accordance with requirements for a specific signing profile. For example, attributes such as SigningCertificateV2 or SigningTime are always added. Policy attributes are added if specified via the PolicyID or PolicyURI properties of the signature object.

Use the OID parameter to provide the object identifier of the attribute, in string form. For example, the OID for the SigningCertificateV2 attribute is 1.2.840.113549.1.9.16.2.47. The Value parameter should contain a well-formed, DER-encoded representation of the attribute value, in accordance with its specification.

Config Method (MessageSigner Class)

Sets or retrieves a configuration setting.

Syntax

public String config(String configurationString);

Remarks

Config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

Countersign Method (MessageSigner Class)

Countersigns an existing signature.

Syntax

public void countersign();

Remarks

Use this method to certify an existing document signature. Countersigning doesn't alter the existing signatures or the signed document itself.

DoAction Method (MessageSigner Class)

Performs an additional action.

Syntax

public String doAction(String actionID, String actionParams);

Remarks

DoAction is a generic method available in every class. It is used to perform an additional action introduced after the product major release. The list of actions is not fixed, and may be flexibly extended over time.

The unique identifier (case insensitive) of the action is provided in the ActionID parameter.

ActionParams contains the value of a single parameter, or a list of multiple parameters for the action in the form of PARAM1=VALUE1;PARAM2=VALUE2;....

Common ActionIDs:

ExtractAsyncData Method (MessageSigner Class)

Extracts user data from the DC signing service response.

Syntax

public String extractAsyncData(String asyncReply);

Remarks

Call this method before finalizing the asynchronous signing process to extract the data passed to the ExternalCrypto.Data property on the pre-signing stage.

The Data parameter can be used to pass some state or document identifier along with the signing request from the pre-signing to the completion async stage.

Reset Method (MessageSigner Class)

Resets the class settings.

Syntax

public void reset();

Remarks

Reset is a generic method available in every class.

Sign Method (MessageSigner Class)

Signs the data.

Syntax

public void sign();

Remarks

This method signs the data provided via InputFile (or InputStream) with SigningCertificate, and saves the signature in OutputFile (OutputStream). Set the desired signature variant via SignatureType property.

The class automatically timestamps the created signature if a TimestampServer is provided.

SignAsyncBegin Method (MessageSigner Class)

Initiates the asynchronous signing operation.

Syntax

public String signAsyncBegin();

Remarks

When using the DC framework, call this method to initiate the asynchronous signing process. Upon completion, a pre-signed copy of the document will be saved in OutputFile (or OutputStream). Keep the pre-signed copy somewhere local, and pass the returned string ('the request state') to the DC processor for handling.

Upon receiving the response state from the DC processor, assign the path to the pre-signed copy to InputFile (or InputStream), and call SignAsyncEnd to finalize the signing.

Note that depending on the signing method and DC configuration used, you may still need to provide the public part of the signing certificate via the SigningCertificate property.

Use the ExternalCrypto.AsyncDocumentID property to supply a unique document ID to include in the request. This is helpful when creating batches of multiple async requests, as it allows you to pass the whole response batch to SignAsyncEnd and expect it to recover the correct response from the batch automatically.

AsyncState is a message of the distributed cryptography (DC) protocol. The DC protocol is based on the exchange of async states between a DC client (an application that wants to sign a PDF, XML, or Office document) and a DC server (an application that controls access to the private key). An async state can carry one or more signing requests, comprised of document hashes, or one or more signatures produced over those hashes.

In a typical scenario you get a client-side async state from the SignAsyncBegin method. This state contains document hashes to be signed on the DC server side. You then send the async state to the DC server (often represented by the DCAuth class), which processes it and produces a matching signature state. The async state produced by the server is then passed to the SignAsyncEnd method.

SignAsyncEnd Method (MessageSigner Class)

Completes the asynchronous signing operation.

Syntax

public void signAsyncEnd(String asyncReply);

Remarks

When using the DC framework, call this method upon receiving the response state from the DC processor to complete the asynchronous signing process.

Before calling this method, assign the path to the pre-signed copy of the document obtained from the prior SignAsyncBegin call to InputFile (or InputStream). The method will embed the signature into the pre-signed document, and save the complete signed document to OutputFile (or OutputStream).

Note that depending on the signing method and DC configuration used, you may still need to provide the public part of the signing certificate via the SigningCertificate property.

Use the ExternalCrypto.AsyncDocumentID parameter to pass a specific document ID if using batched AsyncReply. If used, it should match the value provided on the pre-signing (SignAsyncBegin) stage.

AsyncState is a message of the distributed cryptography (DC) protocol. The DC protocol is based on the exchange of async states between a DC client (an application that wants to sign a PDF, XML, or Office document) and a DC server (an application that controls access to the private key). An async state can carry one or more signing requests, comprised of document hashes, or one or more signatures produced over those hashes.

In a typical scenario you get a client-side async state from the SignAsyncBegin method. This state contains document hashes to be signed on the DC server side. You then send the async state to the DC server (often represented by the DCAuth class), which processes it and produces a matching signature state. The async state produced by the server is then passed to the SignAsyncEnd method.

Timestamp Method (MessageSigner Class)

Timestamps a signature.

Syntax

public void timestamp();

Remarks

This method timestamps an existing PKCS#7 signature with TimestampServer. Pass your existing signature via InputFile (or InputStream), and collect the timestamped variant from OutputFile (OutputStream).

Error Event (MessageSigner Class)

Information about errors during PKCS#7 message signing.

Syntax

public class DefaultMessageSignerEventListener implements MessageSignerEventListener {
  ...
  public void error(MessageSignerErrorEvent e) {}
  ...
}

public class MessageSignerErrorEvent {
  public int errorCode;
  public String description;
}

Remarks

The event is fired in case of exceptional conditions during message processing.

ErrorCode contains an error code and Description contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the Messages section.

ExternalSign Event (MessageSigner Class)

Handles remote or external signing initiated by the SignExternal method or other source.

Syntax

public class DefaultMessageSignerEventListener implements MessageSignerEventListener {
  ...
  public void externalSign(MessageSignerExternalSignEvent e) {}
  ...
}

public class MessageSignerExternalSignEvent {
  public String operationId;
  public String hashAlgorithm;
  public String pars;
  public String data;
  public String signedData; //read-write
}

Remarks

Assign a handler to this event if you need to delegate a low-level signing operation to an external, remote, or custom signing engine. Depending on the settings, the handler will receive a hashed or unhashed value to be signed.

The event handler must pass the value of Data to the signer, obtain the signature, and pass it back to the class via the SignedData parameter.

OperationId provides a comment about the operation and its origin. It depends on the exact class being used, and may be empty. HashAlgorithm specifies the hash algorithm being used for the operation, and Pars contains algorithm-dependent parameters.

The class uses base16 (hex) encoding for the Data, SignedData, and Pars parameters. If your signing engine uses a different input and output encoding, you may need to decode and/or encode the data before and/or after the signing.

A sample MD5 hash encoded in base16: a0dee2a0382afbb09120ffa7ccd8a152 - lower case base16 A0DEE2A0382AFBB09120FFA7CCD8A152 - upper case base16

A sample event handler that uses the .NET RSACryptoServiceProvider class may look like the following: signer.OnExternalSign += (s, e) => { var cert = new X509Certificate2("cert.pfx", "", X509KeyStorageFlags.Exportable); var key = (RSACryptoServiceProvider)cert.PrivateKey; var dataToSign = e.Data.FromBase16String(); var signedData = key.SignHash(dataToSign, "2.16.840.1.101.3.4.2.1"); e.SignedData = signedData.ToBase16String(); };

Notification Event (MessageSigner Class)

This event notifies the application about an underlying control flow event.

Syntax

public class DefaultMessageSignerEventListener implements MessageSignerEventListener {
  ...
  public void notification(MessageSignerNotificationEvent e) {}
  ...
}

public class MessageSignerNotificationEvent {
  public String eventID;
  public String eventParam;
}

Remarks

The class fires this event to let the application know about some event, occurrence, or milestone in the class. For example, it may fire to report completion of the document processing. The list of events being reported is not fixed, and may be flexibly extended over time.

The unique identifier of the event is provided in the EventID parameter. EventParam contains any parameters accompanying the occurrence. Depending on the type of the class, the exact action it is performing, or the document being processed, one or both may be omitted.

This class can fire this event with the following EventID values:

TimestampRequest Event (MessageSigner Class)

Fires when the class is ready to request a timestamp from an external TSA.

Syntax

public class DefaultMessageSignerEventListener implements MessageSignerEventListener {
  ...
  public void timestampRequest(MessageSignerTimestampRequestEvent e) {}
  ...
}

public class MessageSignerTimestampRequestEvent {
  public String TSA;
  public String timestampRequest;
  public String timestampResponse; //read-write
  public boolean suppressDefault; //read-write
}

Remarks

Subscribe to this event to intercept timestamp requests. You can use it to override timestamping requests and perform them in your code.

The TSA parameter indicates the timestamping service being used. It matches the value passed to the TimestampServer property. Set the SuppressDefault parameter to false if you would like to stop the built-in TSA request from going ahead. The built-in TSA request is also not performed if the returned TimestampResponse parameter is not empty.

TLSCertNeeded Event (MessageSigner Class)

Fires when a remote TLS party requests a client certificate.

Syntax

public class DefaultMessageSignerEventListener implements MessageSignerEventListener {
  ...
  public void TLSCertNeeded(MessageSignerTLSCertNeededEvent e) {}
  ...
}

public class MessageSignerTLSCertNeededEvent {
  public String host;
  public String CANames;
}

Remarks

This event fires to notify the implementation that a remote TLS server has requested a client certificate. The Host parameter identifies the host that makes a request, and the CANames parameter (optional, according to the TLS spec) advises on the accepted issuing CAs.

Use the TLSClientChain property in response to this event to provide the requested certificate. Please make sure the client certificate includes the associated private key. Note that you may set the certificates before the connection without waiting for this event to fire.

This event is preceded by the TLSHandshake event for the given host and, if the certificate was accepted, succeeded by the TLSEstablished event.

TLSCertValidate Event (MessageSigner Class)

This event is fired upon receipt of the TLS server's certificate, allowing the user to control its acceptance.

Syntax

public class DefaultMessageSignerEventListener implements MessageSignerEventListener {
  ...
  public void TLSCertValidate(MessageSignerTLSCertValidateEvent e) {}
  ...
}

public class MessageSignerTLSCertValidateEvent {
  public String serverHost;
  public String serverIP;
  public boolean accept; //read-write
}

Remarks

This event is fired during a TLS handshake. Use the TLSServerChain property to access the certificate chain. In general, classes may contact a number of TLS endpoints during their work, depending on their configuration.

Accept is assigned in accordance with the outcome of the internal validation check performed by the class, and can be adjusted if needed.

TLSEstablished Event (MessageSigner Class)

Fires when a TLS handshake with Host successfully completes.

Syntax

public class DefaultMessageSignerEventListener implements MessageSignerEventListener {
  ...
  public void TLSEstablished(MessageSignerTLSEstablishedEvent e) {}
  ...
}

public class MessageSignerTLSEstablishedEvent {
  public String host;
  public String version;
  public String ciphersuite;
  public byte[] connectionId;
  public boolean abort; //read-write
}

Remarks

The class uses this event to notify the application about a successful completion of a TLS handshake.

The Version, Ciphersuite, and ConnectionId parameters indicate the security parameters of the new connection. Use the Abort parameter if you need to terminate the connection at this stage.

TLSHandshake Event (MessageSigner Class)

Fires when a new TLS handshake is initiated, before the handshake commences.

Syntax

public class DefaultMessageSignerEventListener implements MessageSignerEventListener {
  ...
  public void TLSHandshake(MessageSignerTLSHandshakeEvent e) {}
  ...
}

public class MessageSignerTLSHandshakeEvent {
  public String host;
  public boolean abort; //read-write
}

Remarks

The class uses this event to notify the application about the start of a new TLS handshake to Host. If the handshake is successful, this event will be followed by the TLSEstablished event. If the server chooses to request a client certificate, the TLSCertNeeded event will also be fired.

TLSShutdown Event (MessageSigner Class)

Reports the graceful closure of a TLS connection.

Syntax

public class DefaultMessageSignerEventListener implements MessageSignerEventListener {
  ...
  public void TLSShutdown(MessageSignerTLSShutdownEvent e) {}
  ...
}

public class MessageSignerTLSShutdownEvent {
  public String host;
}

Remarks

This event notifies the application about the closure of an earlier established TLS connection. Note that only graceful connection closures are reported.

Certificate Type

Encapsulates an individual X.509 certificate.

Remarks

This type keeps and provides access to X.509 certificate details.

Fields

Constructors

public Certificate( bytes,  startIndex,  count,  password);

public Certificate( certBytes,  certStartIndex,  certCount,  keyBytes,  keyStartIndex,  keyCount,  password);

public Certificate( bytes,  startIndex,  count);

public Certificate( path,  password);

public Certificate( certPath,  keyPath,  password);

public Certificate( path);

public Certificate( stream);

public Certificate( stream,  password);

public Certificate( certStream,  keyStream,  password);

public Certificate();

ExternalCrypto Type

Specifies the parameters of external cryptographic calls.

Remarks

External cryptocalls are used in a Distributed Cryptography (DC) subsystem, which allows the delegation of security operations to the remote agent. For instance, it can be used to compute the signature value on the server, while retaining the client's private key locally.

Fields

Constructors

public ExternalCrypto();

ProxySettings Type

A container for proxy server settings.

Remarks

This type exposes a collection of properties for tuning up the proxy server configuration.

Fields

Constructors

public ProxySettings();

SignatureAttribute Type

Represents an attribute of a digital PKCS#7/CMS signature.

Remarks

Attributes store auxiliary information about the signed message, the signature, or the owner. Each attribute is a OID=Value pair.

Common attributes are signing time, a content type, a policy identifier, and a signature timestamp.

Fields

Constructors

public SignatureAttribute();

SocketSettings Type

A container for the socket settings.

Remarks

This type is a container for socket-layer parameters.

Fields

Constructors

public SocketSettings();

TLSSettings Type

A container for TLS connection settings.

Remarks

The TLS (Transport Layer Security) protocol provides security for information exchanged over insecure connections such as TCP/IP.

Fields

Constructors

public TLSSettings();

Config Settings (MessageSigner Class)

The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

MessageSigner Config Settings

Base Config Settings

Trappable Errors (MessageSigner Class)

MessageSigner Errors