PdfSigner class
Namespace: PdfNetStack.Signing
Assembly: PdfNetStack.dll
Package: PdfNetStack
PAdES baseline signatures (ETSI EN 319 142-1): B-B with a CAdES detached CMS signature, B-T with an RFC 3161 signature timestamp, B-LT with validation data in the document security store, and B-LTA with a document timestamp over it all. Every step is an incremental update, so earlier signatures stay valid.
public static class PdfSignerInheritance
Remarks
Section titled “Remarks”The private key may be RSA or ECDSA, from a file or any key store X509Certificate2 can reach (Windows certificate store, smart cards through their providers). Encrypted documents are not supported. Time stamp authorities and revocation data are reached through the application; the library never opens a network connection.
Methods
Section titled “Methods”AddDocumentTimestamp(byte[], PdfTimestampClient, string?)
Section titled “ AddDocumentTimestamp(byte[], PdfTimestampClient, string?)”Adds a document timestamp (/DocTimeStamp, an RFC 3161 token with SubFilter ETSI.RFC3161) over the whole file in an incremental update. After AddValidationData this makes a PAdES B-LTA document; repeating both later extends its life before the algorithms or certificates involved weaken or expire.
public static byte[] AddDocumentTimestamp(byte[] pdf, PdfTimestampClient timestampAuthority, string? fieldName = null)Parameters
Section titled “Parameters”pdf byte[]
The document, signed or not.
timestampAuthority PdfTimestampClient
The authority to ask.
fieldName string?
The timestamp field’s name; null picks Timestamp1, Timestamp2 and so on.
Returns
Section titled “Returns”byte[]
Exceptions
Section titled “Exceptions”The document is encrypted.
The authority refused the request or replied with an invalid token.
AddValidationData(byte[], IPdfRevocationSource, IReadOnlyList<X509Certificate2>?)
Section titled “ AddValidationData(byte[], IPdfRevocationSource, IReadOnlyList<X509Certificate2>?)”Adds long term validation data (PAdES B-LT) in an incremental update: the document
security store (DSS) receives the certificate chains of every signature and timestamp in
the file, with OCSP responses and CRLs for each certificate, and a VRI entry per signature.
Chains are built from the certificates in the signatures, in the store already, and in
certificates, up to a self-signed root. Revocation data comes from
revocation and is kept only when it matches the certificate and is
signed by its issuer or the issuer’s OCSP responder.
public static byte[] AddValidationData(byte[] pdf, IPdfRevocationSource revocation, IReadOnlyList<X509Certificate2>? certificates = null)Parameters
Section titled “Parameters”pdf byte[]
A signed or timestamped document.
revocation IPdfRevocationSource
Supplies OCSP responses and CRLs; None to embed certificates only.
certificates IReadOnlyList<X509Certificate2>?
Extra certificates for the chains, such as intermediate and root CAs.
Returns
Section titled “Returns”byte[]
Exceptions
Section titled “Exceptions”The document has no readable signature or timestamp.
The document is encrypted.
The document’s certificates and validation data need an unreasonable number of signature checks.
Sign(byte[], X509Certificate2, PdfSignatureOptions?)
Section titled “ Sign(byte[], X509Certificate2, PdfSignatureOptions?)”Signs pdf and returns the signed file.
public static byte[] Sign(byte[] pdf, X509Certificate2 certificate, PdfSignatureOptions? options = null)Parameters
Section titled “Parameters”pdf byte[]
certificate X509Certificate2
options PdfSignatureOptions?
Returns
Section titled “Returns”byte[]
Exceptions
Section titled “Exceptions”The certificate has no usable private key.
The document is encrypted.
A timestamp was requested and the authority refused it or replied with an invalid token.
Verify(byte[])
Section titled “ Verify(byte[])”Checks every signature of a file: byte range, digest and cryptographic validity, and any timestamp.
public static IReadOnlyList<PdfSignatureInfo> Verify(byte[] pdf)Parameters
Section titled “Parameters”pdf byte[]
Returns
Section titled “Returns”IReadOnlyList<PdfSignatureInfo>
Verify(byte[], PdfValidationOptions?)
Section titled “ Verify(byte[], PdfValidationOptions?)”Checks every signature and document timestamp of a file and, with
options, validates the certificates of signers and time stamp
authorities: chain to a trust anchor, validity, usage, name constraints and revocation from
the document security store and supplied data, certificate policies along the chain, and
the qualified status the certificate claims. Certificates are checked at the time of a valid
timestamp when there is one, else now, unless the options set a time.
public static IReadOnlyList<PdfSignatureInfo> Verify(byte[] pdf, PdfValidationOptions? options)Parameters
Section titled “Parameters”pdf byte[]
options PdfValidationOptions?
Returns
Section titled “Returns”IReadOnlyList<PdfSignatureInfo>