TChilkatPkcs11 Delphi ActiveX Reference Documentation

TChilkatPkcs11

Current Version: 9.5.0.88

A wrapper around the Cryptographic Token Interface (Cryptoki API) for thePKCS11 architecture of smart cards and tokens. This class provides functions for accessing, adding, deleting, and performing operations on data, certificates, and keys. It integrates with other Chilkat classes to allow for smartcards and tokens to be used in various protocols (TLS, SSH, PDF, etc.), across different operating systems and programming languages.

This class is introduced in Chilkat v9.5.0.88.

Importing the Chilkat ActiveX into Delphi

Important: When upgrading to a new version of Chilkat, make sure to re-imported ActiveX DLL into Delphi to regenerate the files described below.

Two things are required to use an ActiveX in Delphi:

  1. The ActiveX DLL needs to be registered via regsvr32 on the system where the Delphi application runs. See How To Register ActiveX DLLs for detailed information.
  2. See also: ActiveX Registration Tutorial
  3. The ActiveX component needs to be "imported". Use the Delphi Import Component Wizard to import the Chilkat type library. This creates the following files: Chilkat_v9_5_0_TLB.pas and Chilkat_v9_5_0_TLB.dcr. The Chilkat_v9_5_0_TLB.pas should be added to your project.

To import the Chilkat type library, do the following:

  1. In the Delphi RAD Studio, select the menu item "Component" --> "Import a Type Library".
  2. Find "Chilkat ActiveX v9.5.0" in the list and select it. This will only appear in the list if the ChilkatAx-9.5.0-win32.dll (or ChilkatAx-9.5.0-x64.dll) has been registered w/ regsvr32.
  3. Check the "Generate Component Wrappers" checkbox.
  4. Select a directory where the unit files (.pas and .dcr) should be generated.
  5. Select "Create Unit" and then "Finish".
  6. Add the .pas to your Delphi project.

To use a Chilkat ActiveX object in your Delphi code, add "Chilkat_v9_5_0_TLB" to the "uses" statement. For example:

uses
  Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
  Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Chilkat_v9_5_0_TLB;

Object Creation

var
obj: TChilkatPkcs11;
...
begin
obj := TChilkatPkcs11.Create(Self);
...
// When finished, free the object instance.
obj.Free();

Properties

DebugLogFilePath
property DebugLogFilePath: WideString

If set to a file path, causes each Chilkat method or property call to automatically append it's LastErrorText to the specified log file. The information is appended such that if a hang or crash occurs, it is possible to see the context in which the problem occurred, as well as a history of all Chilkat calls up to the point of the problem. The VerboseLogging property can be set to provide more detailed information.

This property is typically used for debugging the rare cases where a Chilkat method call hangs or generates an exception that halts program execution (i.e. crashes). A hang or crash should generally never happen. The typical causes of a hang are:

  1. a timeout related property was set to 0 to explicitly indicate that an infinite timeout is desired,
  2. the hang is actually a hang within an event callback (i.e. it is a hang within the application code), or
  3. there is an internal problem (bug) in the Chilkat code that causes the hang.

top
LastBinaryResult
property LastBinaryResult: OleVariant readonly
Introduced in version 9.5.0.52

The binary data returned by the last (binary data returning) method called. Only available if Chilkat.Global.KeepBinaryResult is set to 1. This provides a means for obtaining large varbinary results in the SQL Server environment (where limitations exist in getting large amounts of data returned by method calls, but where temp tables can be used for binary properties).

top
LastErrorHtml
property LastErrorHtml: WideString readonly

Provides information in HTML format about the last method/property called. If a method call returns a value indicating failure, or behaves unexpectedly, examine this property to get more information.

top
LastErrorText
property LastErrorText: WideString readonly

Provides information in plain-text format about the last method/property called. If a method call returns a value indicating failure, or behaves unexpectedly, examine this property to get more information.

top
LastErrorXml
property LastErrorXml: WideString readonly

Provides information in XML format about the last method/property called. If a method call returns a value indicating failure, or behaves unexpectedly, examine this property to get more information.

top
LastMethodSuccess
property LastMethodSuccess: Integer
Introduced in version 9.5.0.52

Indicate whether the last method call succeeded or failed. A value of 1 indicates success, a value of 0 indicates failure. This property is automatically set for method calls. It is not modified by property accesses. The property is automatically set to indicate success for the following types of method calls:

  • Any method that returns a string.
  • Any method returning a Chilkat object, binary bytes, or a date/time.
  • Any method returning a standard boolean status value where success = 1 and failure = 0.
  • Any method returning an integer where failure is defined by a return value less than zero.

Note: Methods that do not fit the above requirements will always set this property equal to 1. For example, a method that returns no value (such as a "void" in C++) will technically always succeed.

top
LastStringResult
property LastStringResult: WideString readonly
Introduced in version 9.5.0.52

The string return value of the last (string returning) method called. Only available if Chilkat.Global.KeepStringResult is set to 1. This provides a means for obtaining large string results in the SQL Server environment (where limitations exist in getting long strings returned by method calls, but where temp tables can be used for string properties).

top
LastStringResultLen
property LastStringResultLen: Integer readonly
Introduced in version 9.5.0.53

The length, in characters, of the string contained in the LastStringResult property.

top
NumCerts
property NumCerts: Integer readonly
Introduced in version 9.5.0.88

The number of certificates contained on the smart card or USB token. This property is set when FindAllCerts is called.

top
SharedLibPath
property SharedLibPath: WideString
Introduced in version 9.5.0.88

On Windows systems, then should be set to the name of the DLL file (if the DLL is located in C:\Windows\System32), or it can be the full path to the DLL.

On Linux, MacOSX, or other non-Windows systems, this can also be either the full path to the .so or .dylib, or just the .so or .dylib filename. On these systems, Chilkat calls the dlopen system function to load the shared library. If just the filename is passed in, the directories searched are those indicated in the dlopen function description at https://man7.org/linux/man-pages/man3/dlopen.3.html

More Information and Examples
top
VerboseLogging
property VerboseLogging: Integer

If set to 1, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. The default value is 0. Verbose logging should only be used for debugging. The potentially large quantity of logged information may adversely affect peformance.

top
Version
property Version: WideString readonly

Version of the component/library, such as "9.5.0.63"

top

Methods

CloseSession
function CloseSession(): Integer;
Introduced in version 9.5.0.88

Closes the session on the token (i.e. smart card).

Note: Memory leaks can occur if the session is not properly closed.

Returns 1 for success, 0 for failure.

More Information and Examples
top
Discover
function Discover(onlyTokensPresent: Integer; json: TChilkatJsonObject): Integer;
Introduced in version 9.5.0.88

Discovers the readers, smart cards, and USB tokens accessible via PKCS11 on the computer (using the DLL/shared lib specified by SharedLibPath). The onlyTokensPresent specifies if only slots (readers) with tokens (smart cards) present should be returned. The information is written to the json. (For details, see the example below.)

Returns 1 for success, 0 for failure.

top
FindAllCerts
function FindAllCerts(): Integer;
Introduced in version 9.5.0.88

Finds all certificates contained on the smart card (or USB token). This sets the NumCerts property. Each certificate can be obtained by calling GetCert(index) where the 1st cert is at index 0.

Important: Private keys will not be seen unless the PKCS11 session is authenticated. To authenticate, your application must call Login after calling OpenSession.

Returns 1 for success, 0 for failure.

top
FindCert
function FindCert(certPart: WideString; partValue: WideString; cert: TChilkatCert): Integer;
Introduced in version 9.5.0.88

Finds the certificate where the given certPart equals the partValue. Possible values for certPart are: "privateKey", "subjectDN", "subjectDN_withTags", "subjectCN", "serial", or "serial:issuerCN". If certPart equals "privateKey", then pass an empty string in partValue. Specifying "privateKey" means to return the first certificate having a private key.

The cert is loaded with the certificate if successful.

Important: Private keys will not be seen unless the PKCS11 session is authenticated. To authenticate, your application must call Login after calling OpenSession.

Note: If successful, the cert will be linked internally with this PKCS11 session such that certificate can be used for signing on the smart card when used in other Chilkat classes such as XmlDSigGen, Pdf, Crypt2, Mime, MailMan, etc.

Returns 1 for success, 0 for failure.

top
GetCert
function GetCert(index: Integer; cert: TChilkatCert): Integer;
Introduced in version 9.5.0.88

Loads cert with the Nth certificate indicated by index. The 1st certificate is at index 0. The FindAllCerts method must be called beforehand to load the certs from the smart card into this object. After calling FindAllCerts, the NumCerts property is set and each certificate can be retrieved by calling GetCert.

Returns 1 for success, 0 for failure.

top
Initialize
function Initialize(): Integer;
Introduced in version 9.5.0.88

Initializes the PKCS#11 library. Should be called after specifying the SharedLibPath. The DLL (or .so/.dylib) is dynamically loaded and the PKCS#11 lib is initialized.

Returns 1 for success, 0 for failure.

More Information and Examples
top
Login
function Login(userType: Integer; pin: WideString): Integer;
Introduced in version 9.5.0.88

Authenticates a session with a PIN. The userType can be one of the following integer values:

  1. Security Officer (0)
  2. Normal User (1)
  3. Context Specific (2)

Except for special circumstances, you'll always login as the Normal User.

Returns 1 for success, 0 for failure.

More Information and Examples
top
Logout
function Logout(): Integer;
Introduced in version 9.5.0.88

Logs out from a token (smart card).

Returns 1 for success, 0 for failure.

More Information and Examples
top
OpenSession
function OpenSession(slotId: Integer; readWrite: Integer): Integer;
Introduced in version 9.5.0.88

Opens a session on the token (i.e. smart card). The slotId is the ID of the slot (not the index). Set slotId equal to -1 to choose the first available non-empty slot. The readWrite indicates whether the session should be read-only or read-write.

The PKCS11 terminology is confusing:

  • A "slot" corresponds to a connected smart card reader or USB hardware token, such as a Feitian ePass3003Auto token.
  • A "token" corresponds to the smart card inserted into the reader. If we have a USB hardware token, such as the epass3003Auto (or many others), then technically there is always a "smart card" inserted, because the USB hardware token is effectively both the reader and smart card wrapped in one inseparable device.
  • The PKCS11 DLL (or .so shared lib, or .dylib) is the vendor supplied PKCS11 implementation (driver) that provides the low-level "C" PKCS11 functions (called by Chilkat internally).
  • Generally, the number of slots will equal the number of connected smart cards or tokens belonging to the vendor of the DLL, or compatible with the DLL. In most cases you'll have your single reader with a single smart card inserted, and therefore only one slot exists.
  • Some PKCS11 DLLs are provided by a 3rd party and support many smart cards. For example, A.E.T. Europe B.V.'s "SafeSign Identity Client Standard Version 3.5" DLL is "aetpkss1.dll". It supports the following tokens:
    • Defensiepas
    • Defensiepas 2
    • G&D Convego Join 4.01 40k/80k
    • G&D SkySIM Hercules
    • G&D SkySIM Scorpius
    • G&D Sm@rtCafé Expert 3.2
    • G&D Sm@rtCafé Expert 4.0
    • G&D Sm@rtCafé Expert 5.0
    • G&D Sm@rtCafé Expert 6.0
    • G&D Sm@rtCafé Expert 7.0
    • G&D Sm@rtCafé Expert 64
    • Gemalto Desineo ICP D72 FXR1 Java
    • Gemalto IDCore 30
    • Gemalto MultiApp ID v2.1
    • Gemalto Optelio D72 FR1
    • Gemalto TOP DL v2
    • Infineon Oracle JCOS Ed.1
    • JCOP21 v2.3
    • Morpho IDealCitiz v2.1
    • Morpho JMV ProCL V3.0
    • NXP J2A080 / J2A081 (JCOP 2.4.1 R3)
    • NXP JD081 (JCOP 2.4.1 R3)
    • NXP J3A080 (JCOP 2.4.1 R3)
    • NXP JCOP 2.4.2 R3
    • NXP JCOP 3 SecID P60
    • Oberthur IDOne Cosmo v7.0
    • RDW ABR kaart
    • Rijkspas
    • Rijkspas 2
    • Sagem YpsID s2
    • Sagem YpsID s3
    • StarSign Crypto USB Token S
    • Swissbit PS-100u SE
    • UZI-pas
    • UZI-pas 2

Returns 1 for success, 0 for failure.

More Information and Examples
top