P7S Signer and P7S Viewer User Manual

Sign documents of any type in the CAdES / P7S format, create eIDAS electronic signatures (including qualified signatures on a QSCD), and check signed files with P7S Viewer. No technical knowledge needed; developers find PowerShell, C# and VB.NET examples at the end.

1. What are P7S Signer and P7S Viewer?

A file (a contract, an invoice, a report) can be changed by anyone who has it. A digital signature solves two problems:

• Who signed it? The signature is created with your personal digital certificate, so it proves your identity.
• Was it changed? If even one character of the document is modified after signing, the signature is reported as not valid.

P7S Signer signs documents of any type (PDF, Word, images, XML, archives...) in the CAdES format (CMS Advanced Electronic Signatures, ETSI EN 319 122-1) and in the PKCS#7 / CMS format. You can sign a single document, or select an input folder and an output folder and sign hundreds of documents at once (bulk signing). The same signatures can be created automatically, without any window, from the command line (section 13).

The CAdES signatures are the signatures that the eIDAS Regulation (EU) No 910/2014 uses for advanced and qualified electronic signatures on any kind of file. When they are created with a qualified certificate stored on a QSCD (a qualified signature creation device, such as a smart card or a USB token), the result is a qualified electronic signature, which can be checked with the validation tool of the European Commission. Section 7 explains this in detail.

The product has two programs:

Who is this manual for?

• Users — sections 1 to 15 explain, step by step, how to install the product, register it, choose a certificate, sign documents and check them.
• Developers and administrators — sections 16 to 18 explain that P7S Signer is built on the Signature Library (SignLib), and show how to create and verify the same CAdES signatures from Windows PowerShell, C# or VB.NET. One of the purposes of P7S Signer is to let you see what the library can do before you write a single line of code.

Useful links

2. Product installation

We recommend installing the product with an Administrator account. After the setup file is verified, the operating system might ask for your permission to install the program: click Yes.

What you need

• Windows 8 or later (including Windows 10, Windows 11 and Windows Server 2022).
• Microsoft .NET Framework 4.6.2 or newer. It is already part of Windows 10 and Windows 11.
• A digital certificate to sign with. If you do not have one yet, you can create a test certificate (section 10).

Installation steps

1. Download the setup file. Get P7SSigner.msi from the product page and run it.
2. If Windows SmartScreen appears, allow the program to run. You may see the window Windows protected your PC. Click More info and then Run anyway. See the explanation below.
3. Read the license agreement. Read the EULA (End-User License Agreement). If you want to continue, select I Agree and click Next.
4. Select the installation folder. Keep the proposed folder, or click Browse... to choose another one. Choose Everyone to install the program for all the users of the computer, or Just me for your account only. Click Next.
5. Wait for the setup to finish. When Installation Complete appears, click Close. The program is now installed.

Where to find the programs

The setup installs P7S Signer and P7S Viewer. The icon of P7S Signer appears on the desktop, and both programs are in the P7S Signer folder of the Windows Start menu.

What is Windows SmartScreen?

SmartScreen is a protection built into Windows. When you run a program you downloaded, Windows compares it with a list of programs that are known and were already downloaded by many people. A program that Windows does not know yet, for example a new version that was published recently, is shown as an unrecognized app, and the window below appears.

This message does not mean that the file contains a virus. It only means that Windows has no reputation data about it yet. To continue:

1. Click More info. The name of the file and of the publisher are displayed.
2. Click Run anyway and the setup starts.

3. Trial period and product registration

A new, unregistered installation works for a trial period of about 30 days. The title of the window shows how much is left, for example P7S Signer - Expires in 30 days, and the buttons Register Now and Buy Now! are visible.

How to register the product

1. Get a serial number. To register the product you need a serial number (also called license code). You can buy it online directly from the product page, https://www.signfiles.com/p7s-signer/. You can also click Buy Now! in the program, which opens the same page.
2. Open the registration window. Open P7S Signer and click the Register Now button (or Help → Register Now...).
3. Type the license code. Enter the received serial in the first box. The second box, Licensed to (optional), is for a name: if you type one, it is shown in the title of the window.
4. Click Register. If the serial number is correct, the product is successfully registered.

4. Sign your first document

This is the whole process. It takes less than a minute once you have a certificate.

1. Choose the document. Keep A single document selected. Click the ... button under Source and select the file you want to sign. The Destination is filled in for you: the same name with .p7s added.
2. Check where to save the signed file. If you want another place or name, click the ... button under Destination. The destination must be a different file from the source.
3. Select your digital certificate. Click Select the Digital Certificate.... Choose the certificate from the Windows store, a .pfx file or a smart card, and click OK (details in section 6).
4. Leave the format on the recommended value. CAdES-B-B - basic (recommended) and SHA256 are already selected and are the right choice for most uses (see section 7).
5. Click Apply Digital Signature. After a moment you see the message The file was digitally signed succesfully. Your signed file is in the destination you chose.

5. The main window

Menus

6. Digital certificates

A digital certificate is your electronic identity card, issued by a certification authority. To sign with P7S Signer you need one. This section explains where certificates are kept and how to select the one you want to sign with.

6.1 Where the certificates are stored

A certificate that can sign documents has two parts: a public key (the part other people see, inside the certificate) and a private key (the secret part, which only you have). The digital signature is created with the private key. P7S Signer can use certificates from:

• the Windows Certificate Store (called Microsoft Store in the program);
• a PFX (or P12) file;
• a smart card, a USB token or an HSM, through the PKCS#11 interface of the device (6.3).

The Windows Certificate Store (Microsoft Store)

The Windows Certificate Store is the place where Windows keeps the certificates of the computer and of each user. In P7S Signer it appears as Windows Certificate Store and Certificates Available on Microsoft Store.

To see the certificates of your account, open the Windows Run window (press Win + R), type certmgr.msc and press Enter:

Then open Personal → Certificates. (The older way still works: Internet Options → Content tab → Certificates button, tab Personal.)

To create digital signatures, the certificates of the Personal store are used. They must have a public and a private key. You can check this by opening a certificate: in the General tab Windows writes You have a private key that corresponds to this certificate.

The private key itself can be stored:

• on the file system of the computer (for example, an imported PFX file);
• on a cryptographic smart card or USB token (like Aladdin eToken or SafeNet iKey) — see 6.2;
• on an HSM (Hardware Security Module), a device that keeps keys for a company.

The certificates you can use are listed per store location: Current User (your own certificates, the usual case) or Local Machine (certificates installed for all the users of the computer).

PFX and P12 files

Another way to keep a digital certificate is a PFX (or P12) file. The file contains the public and the private key of the certificate, and it is protected by a password, to keep the key pair safe.

6.2 Certificates stored on smart cards or USB tokens

If your certificate is stored on a smart card or on a USB token (like Aladdin eToken or SafeNet), the private key never leaves the device: it signs inside the device. This is the kind of device used for qualified certificates (QSCD, see section 7).

P7S Signer can use such a certificate in two ways:

• Through the Windows Certificate Store. The certificate of the device must appear in the store (6.1). When the token is inserted in the USB port, its driver or middleware (the software delivered with the token) usually imports the certificate in the store automatically. If the certificate does not appear in the store, it cannot be used this way: ask your vendor how to add it, and look at the options of the middleware (for example, an option that copies the certificates of the token to the local Windows store).
• Through PKCS#11, directly, with the library of the device (6.3, option C).

When you sign, the token asks for its PIN. The window belongs to the middleware of the token, for example:

If the token is not connected when you sign, its certificate is not in the list, or the signing ends with an error such as Keyset does not exist. Connect the token and try again.

6.3 Select the digital certificate for creating signatures

To digitally sign a document, a digital certificate must be selected first. Click Select the Digital Certificate... (or Tools → Select the Digital Certificate...). The certificate can be in a PFX file, in the Windows store or on a PKCS#11 device.

Option A: a PFX file

Some certificates are delivered as a file with the extension .pfx (or .p12), protected by a password.

1. Select PFX digital certificate file.
2. Click ... and pick your .pfx file (or type its path).
3. Type the PFX file password. The Show button next to it displays the details of the certificate so you can check you picked the right one; the Certificate Information line at the bottom summarizes it.
4. Click OK.

Option B: a certificate installed in Windows

Certificates installed on the computer, or stored on a USB token or smart card that Windows knows, appear in the Windows Certificate Store.

1. Select Windows Certificate Store.
2. In Certificate Store choose Current User (your own certificates, the usual case) or Local Machine (certificates installed for the whole computer).
3. Pick your certificate from the list Certificates Available on Microsoft Store. The list shows the name of the owner, the issuer and the expiry date; an expired certificate is marked EXPIRED. Show displays the full certificate.
4. If the certificate is on a smart card and you want to avoid the PIN window, tick Smart Card PIN and type the PIN (6.2).
5. Click OK.

Option C: a token or HSM through PKCS#11

Tokens, smart cards and hardware security modules come with a PKCS#11 library (a .dll file installed by the manufacturer's software). With this option the program talks to the device directly, without using the Windows store.

1. Select PKCS#11 interface.
2. In PKCS#11 driver path pick the library of your device. On a 64-bit Windows use the 64-bit version of the library.
3. Type the Slot number (0 is the first device) and the PIN. The PIN cannot be empty.
4. Click Select .CER file... and pick the public part of your certificate (a .cer or .crt file). The private key stays on the device.
5. Click Test. The program logs in, finds the key and makes a test signature, so you know everything works before signing. Then click OK.

Certificate Information

At the bottom of the window, Certificate Information summarizes the selected certificate: to whom and by whom it was issued, until when it is valid, and Certificate Service Provider. The last one is the name of the software (or of the device driver) that manages the private key of the certificate. It helps you understand where the key is:

(The abbreviations are CSP, Cryptographic Service Provider, for the classic providers, and KSP, Key Storage Provider, for the newer ones. You do not have to choose them: P7S Signer uses the provider of the certificate.) If the private key is not available on this computer, the line The private key is not available is added.

Both RSA and ECDSA (elliptic curve) certificates are supported, in the Windows store, in PFX files and on PKCS#11 devices. The button Create a self-signed Certificate... at the bottom left is explained in section 10.

7. eIDAS electronic signatures and signature formats

P7S Signer creates the signatures that the European Union uses for electronic signatures on files: CAdES signatures (ETSI EN 319 122-1), stored in a .p7s, .p7m or .cms file. This section explains how they relate to the eIDAS Regulation (EU) No 910/2014, what you need to obtain a qualified electronic signature, which format to choose, and how to check the result with the validation tool of the European Commission.

7.1 The levels of electronic signatures in the eIDAS Regulation

The same rules apply to electronic seals, which are the signatures of a legal entity, created with a certificate for electronic seals.

7.2 What you need for a qualified electronic signature

The level of a signature is given by the certificate and by the device that holds its private key, not by the software. P7S Signer creates the signature in the CAdES format that the validators expect, and it works with all the kinds of certificates:

7.3 Signature formats

The format decides how much information is stored inside the signature. If you are not sure, keep the first one. The four CAdES-B formats are the baseline profiles of ETSI EN 319 122-1, the formats recognised for advanced and qualified signatures.

The letters B, T, LT and LTA come from the standard: Basic, Time-stamp, Long Term and Long Term Archival.

7.4 Validate the signature with the European validator

The European Commission publishes an open validation tool, DSS (Digital Signature Service, part of the eSignature building block), that checks signatures according to the eIDAS rules. You can use it to confirm that a file created with P7S Signer is a correct CAdES signature and to see its level:

1. Open the validation page. Go to ec.europa.eu/digital-building-blocks/DSS/webapp-demo/validation.
2. Select the signed file. Choose the .p7s or .p7m file created by P7S Signer. For a detached signature, also select the original document in the field for the original documents.
3. Validate. Keep the default validation policy and start the validation. Read the Simple Report; the Detailed Report and the Diagnostic data explain every check.

The report shows, for each signature:

• the signature format, for example CAdES-BASELINE-B, -T, -LT or -LTA;
• the signer and the certificate chain;
• the signing time or the time of the time stamp;
• the indication of the validation (passed, failed or indeterminate);
• the qualification of the signature. The validator reads the EU Trusted Lists and tells you whether the certificate is qualified and whether its key was on a QSCD. A qualified signature is reported as a qualified electronic signature (QESig).

The same file can be opened with P7S Viewer (section 14), which checks the signature on your computer and shows the signer, the format and the time stamp, but it does not use the EU Trusted Lists.

8. File format and detached signatures

P7S, P7M or CMS

The three choices of Digital signature file format contain the same kind of data: a signed message in the PKCS#7 / CMS standard. Only the extension differs. Keep P7S unless the party who receives the file expects P7M or CMS. When you change the format, the extension of the proposed destination changes as well.

Detached signature

Normally the signed file contains your document and its signature, so a single file travels. If you tick Save the digital signature on a separate file (detached signature), the signed file contains only the signature. You then keep and send two files: the document and its signature (for example invoice-001.pdf and invoice-001.pdf.p7s).

9. Time stamp settings

A time stamp is issued by a Time Stamp Authority (TSA), an independent service. It proves that your signature existed at a given moment and cannot be back-dated. It is used by CAdES-B-T, -LT, -LTA and CAdES-X Long. Open it with Time Stamp Settings... (also in the Tools menu).

10. Creating a test certificate

If you do not have a certificate yet and only want to try the program, P7S Signer can create a self-signed one. Open Tools → Create a self-signed Digital Certificate... (or the button in the certificate window).

1. Choose where to save it: On Microsoft Certificate Store or On a password protected PKCS#12 PFX file (you will be asked for the file name and a password).
2. Type Issued to (your name, required) and, if you wish, the organization, unit, title, e-mail address and country code.
3. Choose the Validity period (default 3 years), the RSA Key Algorithm length (2048 or 4096 bits, default 2048) and the Signature Algorithm (default SHA256WithRSA). The defaults are fine.
4. Keep Set as current digital certificate ticked to use it right away, then click OK.

11. Signing a whole folder

To sign many documents at once, select A folder with documents.

1. Under Source choose the folder with your documents.
2. Under Destination choose another folder. Every file of the source folder is signed and saved in the destination folder with the same name plus the extension of the signature format: contract-001.pdf becomes contract-001.pdf.p7s. The source and the destination must be different folders.
3. Click Apply Digital Signature. While it works, the bottom bar shows the progress and a Cancel button. When it finishes you see how many documents were signed.

A problem with one file does not stop the others. At the end the message lists the files that failed and why (the first ten). If the PIN of your smart card is rejected, the folder is stopped at once, so the card is not locked by repeated wrong attempts.

12. Saving your settings

The program remembers your choices (certificate, format, hash algorithm, time stamp server...) the next time you start it. You can also keep several sets of settings in files — for example one for contracts and one for reports:

• File → Save Configuration As... saves the current settings in a file you name.
• File → Load Configuration... loads them again.
• Tools → Restore Defaults returns everything to the original values.

A saved configuration file is also what the command line uses to sign documents automatically.

13. Batch signatures (automatically made without user intervention)

P7S Signer can also sign without showing its window, for example from a scheduled task, from a script or from another program. Nobody has to click anything: the program reads the settings from a configuration file, signs, and closes.

By default, P7S Signer is installed in the folder C:\Program Files (x86)\Secure Soft\P7S Signer (on a 32-bit Windows: C:\Program Files\Secure Soft\P7S Signer) and the program is P7S Signer.exe.

Command line parameters

"P7S Signer.exe" <source file> <destination file> [<configuration file>]
"P7S Signer.exe" <source folder> <destination folder> [<configuration file>]

• source folder: all the files of the folder are signed, with the same names plus the signature extension (.p7s, .p7m or .cms), in the destination folder. The destination folder must exist.
• configuration file: a file saved with File → Save Configuration As.... When it is not given, the current configuration of the window is used.
• Do not end a path written between quotes with a backslash: write "C:\Folder", not "C:\Folder\". Windows would read the last backslash and quote as one character and the arguments would be mixed up.
• An error on one file of a folder does not stop the other files.

Sign one file

To automatically sign a file, use a command like this one:

c:\Program Files (x86)\Secure Soft\P7S Signer>"P7S Signer.exe" c:\contract.pdf c:\contract.pdf.p7s

Sign a folder

To automatically sign all the files of a folder:

c:\Program Files (x86)\Secure Soft\P7S Signer>"P7S Signer.exe" c:\InputFolder c:\OutputFolder

Custom configuration

In some cases you need a different signature configuration (for example a different certificate, signature format or file format) for different files or folders. To save a specific configuration, open the window, set everything you want, and go to File → Save Configuration As... Save the configuration in a file. Later you can use that file in batch mode to apply a different signature configuration on the signed files.

To automatically sign a folder using a custom configuration:

"P7S Signer.exe" c:\InputFolder c:\OutputFolder c:\config-client2.xml

Result codes

The error messages are also written in the command window. P7S Signer is a Windows application, so the command prompt does not wait for it. To wait and read the result code:

cmd:         start "" /wait "P7S Signer.exe" C:\Demo\Contracts C:\Demo\Signed C:\Demo\contracts.config
             echo %errorlevel%

PowerShell:  (Start-Process "P7S Signer.exe" -ArgumentList '"C:\Demo\Contracts" "C:\Demo\Signed" "C:\Demo\contracts.config"' -Wait -PassThru).ExitCode

The reverse operation, extracting the original documents from a folder of signed files, is also available from the command line: see section 15.

14. P7S Viewer

P7S Viewer is the second program of the product. Use it to check a signed file you created or received.

Opening a file

Start P7S Viewer, click ... next to Source file and pick the signed file (.p7s, .p7m or .cms; the list also offers All files). You can also start the program with the file as argument, for example "P7S Viewer.exe" "C:\Demo\Signed\contract-001.pdf.p7s".

What you see

A document that was changed

If somebody changes the document after it was signed, the Viewer says so clearly, and the buttons that give you the unsigned document are disabled:

Detached signatures

A detached signature contains no document. The Viewer looks for the document next to it (invoice-001.pdf for invoice-001.pdf.p7s). If it does not find it, it tells you and asks you to select the document.

Buttons

• Show certificate — opens the Windows certificate window for the selected signer, with all its details.
• Time Stamp Information — shows the details of the time stamp of the selected signature (only when it has one).
• Open unsigned file — opens a copy of the document, without the signature, in the program associated with its type. If the document is a program or a script (for example .exe, .bat, .js, .ps1), the Viewer first asks you to confirm, because opening it would run it.
• Save unsigned file — saves a copy of the document without the signature.
• About... and Quit.

15. Extracting the documents from many signed files

P7S Viewer can also work without a window, on a whole folder of signed files. It checks the signature of every file and saves the original document in another folder. Use it, for example, to receive many signed documents and get the plain files back.

"P7S Viewer.exe" unsign <source folder> <destination folder>

• All the .p7s, .p7m and .cms files of the source folder are processed (other files are ignored). contract-001.pdf.p7s gives contract-001.pdf in the destination folder.
• A detached signature is verified with its document, which must be next to it in the source folder; the document is copied to the destination.
• An expired certificate is not an error: the document is extracted and the program only notes that the certificate has expired.
• The files that cannot be used — not a PKCS#7 signature, an invalid signature (the document was changed), a detached signature without its document — are copied to the folder errors, created inside the destination folder, and every problem is written to errors\errors.log. Your source folder is never changed.
• When two signed files would give the same name, the second one is saved as name (2).pdf.

This is the result on the demonstration folder (the last file was changed after signing):

OK     contract-001.pdf.p7s -> contract-001.pdf
OK     invoice-001.pdf.p7s -> invoice-001.pdf (detached signature, verified with invoice-001.pdf)
OK     old-contract.pdf.p7s -> old-contract.pdf
OK     quarterly-report.pdf.p7s -> quarterly-report.pdf
OK     report-2026.pdf.p7s -> report-2026.pdf
ERROR  tampered-contract.pdf.p7s: The digital signature is not valid: the signed document was modified or the signature is damaged.

Signed files: 6, original documents saved: 5, errors: 1.
The files with errors were copied to D:\Demo\Documents\errors and the errors were written to D:\Demo\Documents\errors\errors.log.

Like P7S Signer, P7S Viewer is a Windows application: use start "" /wait or Start-Process -Wait -PassThru as in section 13 to read the result code.

16. The Signature Library behind P7S Signer

P7S Signer is an application built on the Signature Library (SignLib), a library for .NET that creates and verifies digital signatures: PDF (PAdES), CAdES / PKCS#7, XML (XAdES), Office and more. Everything P7S Signer does is available to your own programs and scripts through the library:

• Library page: https://www.signfiles.com/signature-library/
• Download (library, samples and PowerShell scripts): https://www.signfiles.com/sdk/SignatureLibrary.zip
• Code samples: sign in CAdES format, verify CAdES signatures, batch signatures

The library works with Windows PowerShell, C#, VB.NET and ASP.NET, on .NET Framework and on the recent .NET versions, and it supports certificates from PFX files, from the Windows store and from smart cards, USB tokens and HSMs.

From the window to the code

CAdES and PKCS#7 signatures are created with the class SignLib.Cades.CadesSignature, and verified with SignLib.Cades.CadesVerify. The table shows what each setting of P7S Signer is in the library.

The library can do more than the window: co-signatures of a file that is already signed, an explicit signature policy, and the verification of the certificates and of the time stamps. They are shown in section 18.

17. Digitally sign P7S Signer files using Windows PowerShell

The main functions of P7S Signer are available in the SignLib library, which you can download from this link: https://www.signfiles.com/sdk/SignatureLibrary.zip

To digitally sign a P7S file using Windows PowerShell, simply download the library above and inspect the Signature Library\PowerShell Scripts folder. The script for CAdES signatures, signInCAdESFormat.ps1, is there. The version below also verifies the result.

The script

Save it as signInCAdESFormat.ps1, in the same folder with SignLib.dll. It creates a test PFX certificate on the fly, signs the file in the CAdES-B-B format (SHA256) and verifies the result.

#digitally sign a file in the CAdES format (P7S), using a PFX certificate created on the fly
#the script can be configured to use an existing PFX file or a certificate loaded from Microsoft Store (smart card certificate)

if ($args.Length -eq 0)
{
    echo "Usage: signInCAdESFormat.ps1 <unsigned file> <signed file>"
}
else
{
    #SignLib.dll must be on the same folder as the script (or write its full path)
    $DllPath = Join-Path $PSScriptRoot 'SignLib.dll'
    [System.Reflection.Assembly]::LoadFrom($DllPath) | Out-Null

    #create a PFX digital certificate
    $generator = new-object -typeName SignLib.Certificates.X509CertificateGenerator("serial number")
    $pFXFilePassword = "tempP@ssword"
    $generator.Subject = "CN=Your Certificate, E=useremail@email.com, O=Organization"
    $generator.Extensions.AddKeyUsage([SignLib.Certificates.CertificateKeyUsage]::DigitalSignature)
    $generator.Extensions.AddEnhancedKeyUsage([SignLib.Certificates.CertificateEnhancedKeyUsage]::DocumentSigning)

    echo "Create the certificate..."
    $certificate = $generator.GenerateCertificate($pFXFilePassword)

    #digitally sign the file in CAdES format (CAdES-B-B, SHA256)
    $sign = new-object -typeName SignLib.Cades.CadesSignature("serial number")
    $sign.DigitalSignatureCertificate = [SignLib.Certificates.DigitalCertificate]::LoadCertificate($certificate, $pFXFilePassword)

    echo "Perform the digital signature..."
    [System.IO.File]::WriteAllBytes($args[1], $sign.ApplyDigitalSignature($args[0]))

    #verify the signature
    $verify = new-object -typeName SignLib.Cades.CadesVerify($args[1], "serial number")
    echo ("Signatures: " + $verify.Signatures.Count)
    echo ("Valid: " + $verify.Signatures[0].SignatureIsValid)
}

How to run it

How to run the Windows PowerShell script from the command line:

powershell -executionPolicy bypass -file d:\signInCAdESFormat.ps1 d:\test.pdf d:\test.pdf.p7s

The result in the window:

Create the certificate...
Perform the digital signature...
Signatures: 1
Valid: True

18. Digitally sign P7S Signer files using C# or VB.NET

The main functions of P7S Signer are available in the SignLib library (download). To digitally sign a file using C# or VB.NET, download the library, add a reference to SignLib.dll in your project, and inspect the sample projects of the package and the code samples: sign, verify, batch.

Files of any type are signed with the class CadesSignature (namespace SignLib.Cades). It creates CAdES and PKCS#7 / CMS signatures, attached or detached, with an optional time stamp and long-term validation data, and it adds a new signature to a file that is already signed (co-signature). The class CadesVerify verifies the signatures and gives you back the original document.

All the examples below use these namespaces. Every example was run with the library to check the result.

using SignLib;                 // HashAlgorithm
using SignLib.Cades;           // CadesSignature, CadesVerify
using SignLib.Certificates;    // DigitalCertificate
using SignLib.Timestamping;    // time stamp settings

18.1 Sign a file and verify the signature

The smallest program: load a certificate from a PFX file, sign, save the signed file and verify it. The signature format is CAdES-B-B (CadesBes) and the hash is SHA256, exactly like the defaults of P7S Signer. ApplyDigitalSignature returns the bytes of the signed file: you choose where to save it and the extension (.p7s, .p7m).

using SignLib;
using SignLib.Cades;
using SignLib.Certificates;

// "serial number" is the serial number of the library
CadesSignature cs = new CadesSignature("serial number");
cs.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"d:\certificate.pfx", "123456");
cs.SignatureStandard = CadesSignatureStandard.CadesBes;
cs.HashAlgorithm = HashAlgorithm.SHA256;

// apply the digital signature: the input file is not changed
byte[] signed = cs.ApplyDigitalSignature("contract.pdf");
File.WriteAllBytes("contract.pdf.p7s", signed);

// verify the signature
CadesVerify cv = new CadesVerify("contract.pdf.p7s", "serial number");
Console.WriteLine("Format: " + cv.SignatureStandard + ", signatures: " + cv.Signatures.Count + ", document: " + cv.DocumentName);
foreach (CadesSignatureInfo csi in cv.Signatures)
{
    Console.WriteLine("Signer: " + csi.SignatureCertificate.GetNameInfo(X509NameType.SimpleName, false));
    Console.WriteLine("Hash: " + csi.HashAlgorithm.FriendlyName);
    Console.WriteLine("Valid: " + csi.SignatureIsValid);
    Console.WriteLine("Time: " + csi.SignatureTime.ToLocalTime());
    Console.WriteLine("Time stamped: " + csi.SignatureIsTimestamped);
}

// the original document, without the signature
File.WriteAllBytes("contract-unsigned.pdf", cv.UnsignedDocument);

The result:

Format: CadesBes, signatures: 1, document: contract.pdf
Signer: Elaine Smith
Hash: sha256
Valid: True
Time: 9/30/2026 9:24:40 PM
Time stamped: False

(X509NameType is in the namespace System.Security.Cryptography.X509Certificates.) The same example in VB.NET:

Imports SignLib
Imports SignLib.Cades
Imports SignLib.Certificates

Module Module1
    Sub Main()
        Dim cs As New CadesSignature("serial number")
        cs.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate("d:\certificate.pfx", "123456")
        cs.SignatureStandard = CadesSignatureStandard.CadesBes
        cs.HashAlgorithm = HashAlgorithm.SHA256

        'apply the digital signature and save the signed file
        File.WriteAllBytes("contract.pdf.p7s", cs.ApplyDigitalSignature("contract.pdf"))

        Dim cv As New CadesVerify("contract.pdf.p7s", "serial number")
        Console.WriteLine("Signatures: " & cv.Signatures.Count)
        For Each csi As CadesSignatureInfo In cv.Signatures
            Console.WriteLine("Valid: " & csi.SignatureIsValid)
        Next
    End Sub
End Module

18.2 Signature levels, time stamp and long-term validation

The format is chosen with SignatureStandard, and the signature is time stamped (CAdES-B-T) when you set the address of a time stamp server (section 9):

CadesSignature cs = new CadesSignature("serial number");
cs.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"d:\certificate.pfx", "123456");

cs.HashAlgorithm = HashAlgorithm.SHA384;                              // SHA256 (default), SHA384 or SHA512
cs.SignatureStandard = CadesSignatureStandard.CadesLT;                // CAdES-B-LT: time stamp + certificates and revocation data
cs.TimeStamping.ServerUrl = new Uri("https://ca.signfiles.com/TSAServer.aspx");
cs.TimeStamping.UseNonce = true;                                      // a random number that protects the request
cs.TimeStamping.HashAlgorithm = HashAlgorithm.SHA256;                 // the hash of the time stamp request
// cs.TimeStamping.UserName = "user"; cs.TimeStamping.Password = "password";   // only if the server requires authentication

File.WriteAllBytes("contract-lt.pdf.p7s", cs.ApplyDigitalSignature("contract.pdf"));

CadesVerify cv = new CadesVerify("contract-lt.pdf.p7s", "serial number");
CadesSignatureInfo csi = cv.Signatures[0];
Console.WriteLine("Format: " + cv.SignatureStandard);
Console.WriteLine("Time stamped: " + csi.SignatureIsTimestamped);
Console.WriteLine("TSA: " + csi.TimestampInfo.TsaCertificate.GetNameInfo(X509NameType.SimpleName, false));
Console.WriteLine("Time stamp altered: " + csi.TimestampInfo.IsTimestampAltered);

The same code with CadesSignatureStandard.CadesA creates a CAdES-B-LTA signature, with an archive time stamp. The time stamp server can be a qualified time stamp authority (section 7.3).

18.3 A certificate from the Windows store or a smart card

When the certificate is in the Windows store (for instance, a qualified certificate on a smart card, section 6.2), load it with a search criterion. No window is shown, so the code can run without a user.

CadesSignature cs = new CadesSignature("serial number");

// the first certificate of the current user whose common name (CN) is "Elaine Smith"
// true = only the valid certificates (issued by a trusted authority); false = any certificate, also a self-signed test one
cs.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(true, DigitalCertificateSearchCriteria.CommonNameCN, "Elaine Smith");

// the PIN of the smart card, to avoid the PIN window. It applies to the next signature, made on this thread
DigitalCertificate.SmartCardPin = "1234";

File.WriteAllBytes("contract.pdf.p7s", cs.ApplyDigitalSignature("contract.pdf"));

Other search criteria are the other fields of the subject (OrganizationO, EmailE...), the thumbprint and the serial number of the certificate. To let the user choose the certificate in a Windows window, call DigitalCertificate.LoadCertificate() without parameters.

18.4 Detached signatures

By default the signed file contains the document and its signature. With a detached signature the file contains only the signature. The original document is needed to verify it.

CadesSignature cs = new CadesSignature("serial number");
cs.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"d:\certificate.pfx", "123456");
cs.IsDetachedSignature = true;

File.WriteAllBytes("invoice.pdf.p7s", cs.ApplyDigitalSignature("invoice.pdf"));

// verify: the signature and the original document
byte[] signature = File.ReadAllBytes("invoice.pdf.p7s");
byte[] original = File.ReadAllBytes("invoice.pdf");
CadesVerify cv = new CadesVerify(signature, original, "serial number");
Console.WriteLine("Valid: " + cv.Signatures[0].SignatureIsValid);      // False if the document was changed

18.5 Sign all the files of a folder

Create the CadesSignature object once, and sign each file of the folder. For a smart card, set the PIN before every signature. A file that fails must not stop the others.

static void SignFolder(string sourceFolder, string destinationFolder)
{
    CadesSignature cs = new CadesSignature("serial number");
    cs.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"d:\certificate.pfx", "123456");
    cs.SignatureStandard = CadesSignatureStandard.CadesBes;

    foreach (string file in Directory.GetFiles(sourceFolder))
    {
        try
        {
            // DigitalCertificate.SmartCardPin = "1234";      // for a smart card: before each signature
            byte[] signed = cs.ApplyDigitalSignature(file);
            File.WriteAllBytes(Path.Combine(destinationFolder, Path.GetFileName(file) + ".p7s"), signed);
        }
        catch (Exception ex)
        {
            Console.WriteLine("Error: " + file + ": " + ex.Message);
        }
    }
}

18.6 Several signatures in the same file (co-signatures)

A file can be signed by several people. To add a signature, give the signed file as the input: the new signature is added and the previous ones stay valid.

CadesSignature first = new CadesSignature("serial number");
first.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"d:\manager.pfx", "123456");
File.WriteAllBytes("contract.pdf.p7s", first.ApplyDigitalSignature("contract.pdf"));

CadesSignature second = new CadesSignature("serial number");
second.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"d:\accountant.pfx", "123456");
File.WriteAllBytes("contract.pdf.p7s", second.ApplyDigitalSignature("contract.pdf.p7s"));    // the input is the signed file

CadesVerify cv = new CadesVerify("contract.pdf.p7s", "serial number");
for (int i = 0; i < cv.Signatures.Count; i++)
    Console.WriteLine("Signature " + (i + 1) + ": " + cv.Signatures[i].SignatureIsValid + ", signer: "
        + cv.Signatures[i].SignatureCertificate.GetNameInfo(X509NameType.SimpleName, false));

The result:

Signatures: 2
Signature 1: True, signer: Elaine Smith
Signature 2: True, signer: Elaine Smith

18.7 Check the certificate of the signer

SignatureIsValid tells you that the document was not changed and that the signature matches it. It does not tell you whether you trust the signer. Read the certificate and check it:

CadesVerify cv = new CadesVerify("contract.pdf.p7s", "serial number");
X509Certificate2 certificate = cv.Signatures[0].SignatureCertificate;

Console.WriteLine("Issued by: " + certificate.Issuer);
Console.WriteLine("Expires: " + certificate.NotAfter.ToShortDateString());
Console.WriteLine("Status: " + DigitalCertificate.VerifyDigitalCertificate(certificate, VerificationType.LocalTime));
// other checks: VerificationType.OCSP, VerificationType.CRL (they contact the certification authority)

The result: Status: Valid.

18.8 More options of the signature

// an explicit signature policy: identifier (OID), hash of the policy document, OID of the hash algorithm, address of the policy
cs.SetSignaturePolicyInformation("2.16.76.1.7.1.5.2.3", policyHash, "2.16.840.1.101.3.4.2.1", "https://example.com/policy.html");

// the largest CRL that is included in the long-term formats, in bytes (default: 20 MB)
cs.MaxCrlSize = 5 * 1024 * 1024;

18.9 Good to know

19. Problems and solutions

20. Glossary

21. Warning and disclaimer, trademarks

Every effort has been made to make this manual as complete and accurate as possible, but no warranty or fitness is implied. The information provided is on an “as is” basis. The author shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this manual. The information about the eIDAS Regulation is a simplified explanation and it is not legal advice.

.NET, Windows, PowerShell, SmartScreen and Visual Studio are trademarks of Microsoft Corporation. All other trademarks are the property of their respective owners.