# PdfSigner class

> PAdES baseline signatures (ETSI EN 319 142-1): B-B with a CAdES detached CMS signature, B-T with an RFC 3161 signature timestamp, B-LT with validation...

Namespace: [PdfNetStack.Signing](https://www.jadev-corp.com/api/pdfnetstack-signing/)  
Assembly: PdfNetStack.dll  
Package: `PdfNetStack`

PAdES baseline signatures (ETSI EN 319 142-1): B-B with a CAdES detached CMS signature, B-T
with an RFC 3161 signature timestamp, B-LT with validation data in the document security
store, and B-LTA with a document timestamp over it all. Every step is an incremental update,
so earlier signatures stay valid.

```csharp
public static class PdfSigner
```

**Inheritance**

[object](https://learn.microsoft.com/dotnet/api/system.object) ← 
[PdfSigner](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfsigner/)

## Remarks

The private key may be RSA or ECDSA, from a file or any key store X509Certificate2 can reach
(Windows certificate store, smart cards through their providers). Encrypted documents are not
supported. Time stamp authorities and revocation data are reached through the application;
the library never opens a network connection.

## Methods

### <a id="PdfNetStack_Signing_PdfSigner_AddDocumentTimestamp_System_Byte___PdfNetStack_Signing_PdfTimestampClient_System_String_"></a> AddDocumentTimestamp\(byte\[\], PdfTimestampClient, string?\)

Adds a document timestamp (/DocTimeStamp, an RFC 3161 token with SubFilter ETSI.RFC3161)
over the whole file in an incremental update. After [AddValidationData](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfsigner/#PdfNetStack_Signing_PdfSigner_AddValidationData_System_Byte___PdfNetStack_Signing_IPdfRevocationSource_System_Collections_Generic_IReadOnlyList_System_Security_Cryptography_X509Certificates_X509Certificate2__) this
makes a PAdES B-LTA document; repeating both later extends its life before the algorithms
or certificates involved weaken or expire.

```csharp
public static byte[] AddDocumentTimestamp(byte[] pdf, PdfTimestampClient timestampAuthority, string? fieldName = null)
```

#### Parameters

`pdf` [byte](https://learn.microsoft.com/dotnet/api/system.byte)\[\]

The document, signed or not.

`timestampAuthority` [PdfTimestampClient](https://www.jadev-corp.com/api/pdfnetstack-signing/pdftimestampclient/)

The authority to ask.

`fieldName` [string](https://learn.microsoft.com/dotnet/api/system.string)?

The timestamp field's name; null picks Timestamp1, Timestamp2 and so on.

#### Returns

 [byte](https://learn.microsoft.com/dotnet/api/system.byte)\[\]

#### Exceptions

 [NotSupportedException](https://learn.microsoft.com/dotnet/api/system.notsupportedexception)

The document is encrypted.

 [CryptographicException](https://learn.microsoft.com/dotnet/api/system.security.cryptography.cryptographicexception)

The authority refused the request or replied with an invalid token.

### <a id="PdfNetStack_Signing_PdfSigner_AddValidationData_System_Byte___PdfNetStack_Signing_IPdfRevocationSource_System_Collections_Generic_IReadOnlyList_System_Security_Cryptography_X509Certificates_X509Certificate2__"></a> AddValidationData\(byte\[\], IPdfRevocationSource, IReadOnlyList&lt;X509Certificate2\>?\)

Adds long term validation data (PAdES B-LT) in an incremental update: the document
security store (DSS) receives the certificate chains of every signature and timestamp in
the file, with OCSP responses and CRLs for each certificate, and a VRI entry per signature.
Chains are built from the certificates in the signatures, in the store already, and in
<code class="paramref">certificates</code>, up to a self-signed root. Revocation data comes from
<code class="paramref">revocation</code> and is kept only when it matches the certificate and is
signed by its issuer or the issuer's OCSP responder.

```csharp
public static byte[] AddValidationData(byte[] pdf, IPdfRevocationSource revocation, IReadOnlyList<X509Certificate2>? certificates = null)
```

#### Parameters

`pdf` [byte](https://learn.microsoft.com/dotnet/api/system.byte)\[\]

A signed or timestamped document.

`revocation` [IPdfRevocationSource](https://www.jadev-corp.com/api/pdfnetstack-signing/ipdfrevocationsource/)

Supplies OCSP responses and CRLs; [None](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfrevocationvalues/#PdfNetStack_Signing_PdfRevocationValues_None) to embed certificates only.

`certificates` [IReadOnlyList](https://learn.microsoft.com/dotnet/api/system.collections.generic.ireadonlylist\-1)<[X509Certificate2](https://learn.microsoft.com/dotnet/api/system.security.cryptography.x509certificates.x509certificate2)\>?

Extra certificates for the chains, such as intermediate and root CAs.

#### Returns

 [byte](https://learn.microsoft.com/dotnet/api/system.byte)\[\]

#### Exceptions

 [InvalidOperationException](https://learn.microsoft.com/dotnet/api/system.invalidoperationexception)

The document has no readable signature or timestamp.

 [NotSupportedException](https://learn.microsoft.com/dotnet/api/system.notsupportedexception)

The document is encrypted.

 [PdfFormatException](https://www.jadev-corp.com/api/pdfnetstack/pdfformatexception/)

The document's certificates and validation data need an unreasonable number of signature checks.

### <a id="PdfNetStack_Signing_PdfSigner_Sign_System_Byte___System_Security_Cryptography_X509Certificates_X509Certificate2_PdfNetStack_Signing_PdfSignatureOptions_"></a> Sign\(byte\[\], X509Certificate2, PdfSignatureOptions?\)

Signs <code class="paramref">pdf</code> and returns the signed file.

```csharp
public static byte[] Sign(byte[] pdf, X509Certificate2 certificate, PdfSignatureOptions? options = null)
```

#### Parameters

`pdf` [byte](https://learn.microsoft.com/dotnet/api/system.byte)\[\]

`certificate` [X509Certificate2](https://learn.microsoft.com/dotnet/api/system.security.cryptography.x509certificates.x509certificate2)

`options` [PdfSignatureOptions](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfsignatureoptions/)?

#### Returns

 [byte](https://learn.microsoft.com/dotnet/api/system.byte)\[\]

#### Exceptions

 [ArgumentException](https://learn.microsoft.com/dotnet/api/system.argumentexception)

The certificate has no usable private key.

 [NotSupportedException](https://learn.microsoft.com/dotnet/api/system.notsupportedexception)

The document is encrypted.

 [CryptographicException](https://learn.microsoft.com/dotnet/api/system.security.cryptography.cryptographicexception)

A timestamp was requested and the authority refused it or replied with an invalid token.

### <a id="PdfNetStack_Signing_PdfSigner_Verify_System_Byte___"></a> Verify\(byte\[\]\)

Checks every signature of a file: byte range, digest and cryptographic validity, and any timestamp.

```csharp
public static IReadOnlyList<PdfSignatureInfo> Verify(byte[] pdf)
```

#### Parameters

`pdf` [byte](https://learn.microsoft.com/dotnet/api/system.byte)\[\]

#### Returns

 [IReadOnlyList](https://learn.microsoft.com/dotnet/api/system.collections.generic.ireadonlylist\-1)<[PdfSignatureInfo](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfsignatureinfo/)\>

### <a id="PdfNetStack_Signing_PdfSigner_Verify_System_Byte___PdfNetStack_Signing_PdfValidationOptions_"></a> Verify\(byte\[\], PdfValidationOptions?\)

Checks every signature and document timestamp of a file and, with
<code class="paramref">options</code>, validates the certificates of signers and time stamp
authorities: chain to a trust anchor, validity, usage, name constraints and revocation from
the document security store and supplied data, certificate policies along the chain, and
the qualified status the certificate claims. Certificates are checked at the time of a valid
timestamp when there is one, else now, unless the options set a time.

```csharp
public static IReadOnlyList<PdfSignatureInfo> Verify(byte[] pdf, PdfValidationOptions? options)
```

#### Parameters

`pdf` [byte](https://learn.microsoft.com/dotnet/api/system.byte)\[\]

`options` [PdfValidationOptions](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfvalidationoptions/)?

#### Returns

 [IReadOnlyList](https://learn.microsoft.com/dotnet/api/system.collections.generic.ireadonlylist\-1)<[PdfSignatureInfo](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfsignatureinfo/)\>

## Used in

- [Work with large PDF files in C#](https://www.jadev-corp.com/guides/large-files/)
- [Digitally sign PDF files in C# and .NET](https://www.jadev-corp.com/guides/signatures/)
- [Add a signature field to a PDF in C#](https://www.jadev-corp.com/recipes/add-signature-field/)

Source: https://www.jadev-corp.com/pdfnetstack/api/pdfnetstack-signing/pdfsigner/