Digital signature
Thank you for contacting syncfusion support.
We kindly request you to follow the steps below to accomplish your requirement using our deferred signing functionality.
The deferred signing works as a client-server interaction. Typically, PDF documents are created/manipulated on the server. If the end-user needs to sign a PDF document, they have to retrieve the entire document for signing and then send back the signed PDF document. With this feature, the customer can generate a hash from a PDF document and send it to the end-user for signing. Once the end-user signs it, they will return the signed hash to the server to apply it to the PDF document.
Note: In real-time, the signed hash may be encoded with or without PKCS7 information. Therefore, we recommend creating an empty signature and utilizing our ReplaceEmptySignature functionality to accomplish this.
Please refer to the below steps to deferred sign,
Step 1: Create an empty signature using your public certificate. You can refer to the example code here: [link to the example](https://github.com/SyncfusionExamples/PDF-Examples/blob/master/Digital%20Signature/Deferred-signing-in-PDF-document/.NET/Deferred-signing-in-PDF-document/Program.cs#L21).
static void CreateEmptySignedPDF() { // Get the stream from the document. FileStream documentStream = new FileStream(Path.GetFullPath("../../../Barcode.pdf"), FileMode.Open, FileAccess.Read);
//Load an existing PDF document. PdfLoadedDocument loadedDocument = new PdfLoadedDocument(documentStream);
//Creates a digital signature. PdfSignature signature = new PdfSignature(loadedDocument, loadedDocument.Pages[0], null, "Signature");
//Sets the signature information. signature.Bounds = new RectangleF(new PointF(0, 0), new SizeF(100, 30)); signature.Settings.CryptographicStandard = CryptographicStandard.CADES; signature.Settings.DigestAlgorithm = DigestAlgorithm.SHA1;
//Create an external signer. IPdfExternalSigner externalSignature = new SignEmpty("SHA1");
//Add public certificates. System.Collections.Generic.List<X509Certificate2> certificates = new System.Collections.Generic.List<X509Certificate2>(); certificates.Add(new X509Certificate2(Convert.FromBase64String(PublicCert))); signature.AddExternalSigner(externalSignature, certificates, null);
//Save the document. FileStream inputFileStream = new FileStream(Path.GetFullPath("../../../EmptySignature.pdf"), FileMode.Create, FileAccess.ReadWrite); loadedDocument.Save(inputFileStream);
//Close the PDF document. loadedDocument.Close(true); inputFileStream.Close(); } |
Step 2: When creating the empty signature file, please follow the steps outlined in the sign block. You can find the instructions here: [link to the code](https://github.com/SyncfusionExamples/PDF-Examples/blob/master/Digital%20Signature/Deferred-signing-in-PDF-document/.NET/Deferred-signing-in-PDF-document/Program.cs#L94).
The "message" parameter represents the bytes of a document sequence, but it should be a calculated hash or digest value. Therefore, before externally signing the document, you need to generate a hash or digest value from the message bytes, as indicated below:
public byte[] Sign(byte[] message, out byte[] timeStampResponse) { byte[] digest; using (SHA256Managed sha = new SHA256Managed()) { digest = sha.ComputeHash(message); } SignDocumentHash(digest); // Convert digest bytes to base64/Hex format if requested to send to sign the digest. // Set a null value to create an empty signed document. byte[] signedBytes = null; timeStampResponse = null; return signedBytes; }
|
Step 3: Please use the following overload for Deferred Sign:
If your signed digest message already contains encoded PKCS7 information, use the following overload to replace your signed signature bytes:
// Deferred signing without PKCS7 encoding. PdfSignature.ReplaceEmptySignature(inputFileStream, pdfPassword, outputFileStream, signatureName, externalSigner, publicCertificates, false); |
Step 4: Replace your signed signature bytes as shown in the code here: [link to the code](https://github.com/SyncfusionExamples/PDF-Examples/blob/master/Digital%20Signature/Deferred-signing-in-PDF-document/.NET/Deferred-signing-in-PDF-document/Program.cs#L137).
public byte[] Sign(byte[] message, out byte[] timeStampResponse) { // Set the signed hash message to replace an empty signature. byte[] signedBytes = _signedHash; timeStampResponse = null; return signedBytes; }
|
You can find the working sample from below link,
