PDF Signer Server User Manual

Sign PDF documents in bulk and automatically: the program watches a folder, signs every new document with your certificate, seal or qualified certificate, sends the signed documents by e-mail or to an FTP server, archives the originals and keeps a log. Made for companies, accounting departments and administrators; developers find PowerShell, C# and VB.NET examples at the end.

1. What is PDF Signer Server?

A PDF document (an invoice, a contract, a report) can be changed by anyone who has it. A digital signature solves two problems:

• Who signed it? The signature is created with a digital certificate: the personal certificate of a person, or the certificate of a company (an electronic seal), so it proves the origin of the document.
• Was it changed? If even one character of the document is modified after signing, the signature is reported as not valid.

PDF Signer Server adds digital signatures to PDF documents. You can sign one document, or select an input folder and an output folder and sign all the PDF documents of the folder at once (bulk signing). The program can also watch the input folder: every few seconds it looks for new documents and signs them, without anyone clicking anything. Around the signing it can send the signed documents by e-mail (even to a different recipient for each document), upload them to an FTP server, archive the original documents, move the documents that failed to an error folder, and write everything in a log.

The signature can be visible on the page (with the name of the signer, the date, the reason and the place of the signing, even with an image) or invisible. PDF Signer Server creates PAdES signatures (PDF Advanced Electronic Signatures, ETSI EN 319 142-1), the format of the advanced and qualified electronic signatures of the eIDAS Regulation (EU) No 910/2014, and the older PKCS#7 signatures, for the PDF readers that do not know PAdES. When the document is signed with a qualified certificate on a QSCD (a qualified signature creation device, such as a smart card, a USB token or a hardware security module), the result is a qualified electronic signature or a qualified electronic seal, with the legal effect described by the Regulation. The same applies to qualified time stamps. Section 7 explains this in detail.

What you can do with PDF Signer Server

• Sign a PDF document, or all the documents of a folder, with a certificate from the Windows certificate store, from a PFX / P12 file, or directly from a smart card, a USB token or an HSM through the PKCS#11 interface.
• Watch a folder and sign the new documents automatically (section 13).
• Choose the signature format from a single list: PAdES-B-B (recommended), PAdES-B-T (with time stamp), PAdES-B-LT (long term validation), PAdES-B-LTA (long term archival) and three older PKCS#7 formats; choose the hash algorithm (SHA256, SHA384, SHA512).
• Add a time stamp from a time stamp server, also a qualified time stamp (section 7.5).
• Choose the appearance of the signature: the page, the position, the text, the font and an image (section 9).
• Certify the documents and encrypt the signed documents with a password and restrictions (section 10).
• Send the signed documents by e-mail and upload them to an FTP server (section 14).
• Archive the originals, delete them after the signing and keep the failed documents in an error folder; all the actions are written in a log (section 13.2, section 17.1).
• Sign documents that are protected with a password, and rebuild documents with a damaged structure (section 11).
• Save the settings in files, and sign from the command line, without any window (section 18).

Who is this manual for?

• Users and administrators — sections 1 to 18 explain, step by step, how to install the product, register it, choose a certificate, sign documents and folders, set up the automatic signing, the e-mail and the FTP delivery, and check the signed documents.
• Developers — sections 19 to 21 explain that PDF Signer Server is built on the Signature Library (SignLib) and show how to create and verify the same PDF signatures from Windows PowerShell, C# or VB.NET.

PDF Signer and PDF Signer Server

Both products sign PDF documents with the same signing engine and the same signature formats. They are made for different jobs:

If you only need to sign documents from time to time, PDF Signer is the simpler choice.

Useful links

2. Product installation

We recommend installing the product with an Administrator account. After the setup file is verified, the operating system might ask for your permission to install the program: click Yes.

What you need

• Windows 8 or later (including Windows 10, Windows 11 and Windows Server 2022).
• Microsoft .NET Framework 4.6.2 or newer. It is already part of the current versions of Windows 10, Windows 11 and Windows Server; for the other versions of Windows you can download it from the Microsoft site.
• A digital certificate to sign with. If you do not have one yet, you can create a test certificate (section 16).

Installation steps

1. Download the setup file. Get PDFSignerServer.msi from the product page (direct link: https://www.signfiles.com/apps/PDFSignerServer.msi) and run it.
2. If Windows SmartScreen appears, allow the program to run. You may see the window Windows protected your PC. Click More info and then Run anyway. See the explanation below.
3. Read the license agreement. Read the EULA (End-User License Agreement). If you want to continue, select I Agree and click Next.
4. Select the installation folder. Keep the proposed folder, or click Browse... to choose another one. Choose Everyone to install the program for all the users of the computer, or Just me for your account only. Click Next.
5. Wait for the setup to finish. When Installation Complete appears, click Close. The program is now installed.

By default the program is installed in the folder Secure Soft\PDF Signer Server of Program Files (on a 64-bit Windows: C:\Program Files (x86)\Secure Soft\PDF Signer Server), and the program file is PDF Server.exe.

Where to find the program

After the installation, the icon of PDF Signer Server appears on the desktop and in the Windows Start menu. Double-click it to start the program.

What is Windows SmartScreen?

SmartScreen is a protection built into Windows. When you run a program you downloaded, Windows compares it with a list of programs that are known and were already downloaded by many people. A program that Windows does not know yet, for example a new version that was published recently, is shown as an unrecognized app, and the window below appears.

This message does not mean that the file contains a virus. It only means that Windows has no reputation data about it yet. To continue:

1. Click More info. The name of the file and of the publisher are displayed.
2. Click Run anyway and the setup starts.

3. Trial period and product registration

A new, unregistered installation works for a trial period. The title of the window shows how much is left, for example PDF Signer Server - Expires in 30 days, and the buttons Register Now and Buy Now! are visible.

How to register the product

1. Get a serial number. To register the product you need a serial number (also called license code). You can buy it online directly from the product page, https://www.signfiles.com/pdf-signer-server/. You can also click Buy Now! in the program, which opens the same page.
2. Open the registration window. Open PDF Signer Server and click the Register Now button (or Help → Register Now...).
3. Type the license code. Enter the received serial in the first box. The second box, Licensed to (optional), is for a name: if you type one, it is shown in the title of the window.
4. Click Register. If the serial number is correct, the product is successfully registered.

4. Sign your first document

This is the whole process. It takes less than a minute once you have a certificate. (To sign a whole folder, see section 12; to sign automatically, see section 13.)

1. Choose the document. Keep A single PDF document selected. Click the ... button under Source and select the PDF document you want to sign. The Destination is filled in for you: the same folder and the same name with [signed] added.
2. Check where to save the signed document. If you want another place or name, click the ... button under Destination. The destination must be a different file from the source.
3. Select your digital certificate. Click Select the Digital Certificate.... Choose the certificate from the Windows store (the certificates of a smart card or of a token are there too), a .pfx file or a PKCS#11 device, and click OK (details in section 6).
4. Leave the format on the recommended value. PAdES-B-B - basic (recommended) is already selected and is the right choice for most uses (see section 7.3).
5. Click Apply Digital Signature. After a moment you see a message that the file was digitally signed.

5. The main window

Menus

6. Digital certificates

A digital certificate is an electronic identity card, issued by a certification authority: for a person, or for a company (a certificate for electronic seals). To sign with PDF Signer Server you need one. This section explains where certificates are kept and how to select the one you want to sign with.

6.1 Where the certificates are stored

A certificate that can sign documents has two parts: a public key (the part other people see, inside the certificate) and a private key (the secret part, which only you have). The digital signature is created with the private key. PDF Signer Server can use certificates from:

• the Windows Certificate Store (the list of the certificates of Windows). The certificates of a smart card or of a USB token are in this list too, when the token is connected;
• a PFX (or P12) file;
• a smart card, a USB token or a hardware security module (HSM), directly through its PKCS#11 interface, without the Windows store (section 6.3).

The Windows Certificate Store

The Windows Certificate Store is the place where Windows keeps the certificates of the computer and of each user. PDF Signer Server shows its certificates in the window Digital Certificates, in the group Certificates Available on Microsoft Store.

To see the certificates of your account, open the Windows Run window (press Win + R), type certmgr.msc and press Enter:

Then open Personal → Certificates.

To create digital signatures, the certificates of the Personal store are used. They must have a public and a private key. You can check this by opening a certificate: in the General tab Windows writes You have a private key that corresponds to this certificate.

The private key itself can be stored:

• on the file system of the computer (for example, an imported PFX file);
• on a cryptographic smart card or USB token — see section 6.2;
• on an HSM (Hardware Security Module), a device that keeps keys for a company — see section 6.3.

The certificates are listed per store location: Current User (the certificates of the account that runs the program, the usual case) or Local Machine (certificates installed for all the users of the computer).

PFX and P12 files

Another way to keep a digital certificate is a PFX (or P12) file. The file contains the public and the private key of the certificate, and it is protected by a password, to keep the key pair safe.

6.2 Certificates stored on smart cards or USB tokens

If your certificate is stored on a smart card or on a USB token (like Aladdin eToken or SafeNet), the private key never leaves the device: it signs inside the device. This is the kind of device used for qualified certificates (QSCD, see section 7).

PDF Signer Server uses such a certificate through the Windows Certificate Store. When the token is inserted in the USB port, its driver or middleware (the software delivered with the token) usually imports the certificate in the store automatically. If the certificate does not appear in the store, it cannot be used this way: ask your vendor how to add it, and look at the options of the middleware (for example, an option that copies the certificates of the token to the local Windows store). A device can also be used directly through the PKCS#11 interface (section 6.3).

When you sign, the token asks for its PIN. The window belongs to the middleware of the token, for example:

If the token is not connected, its certificate is not in the Windows store: the main window shows Digital certificate is not set under the certificate button, and when you click Apply Digital Signature the program asks you to select a certificate. Insert the token, select the certificate again and sign.

6.3 Smart cards, tokens and HSMs through PKCS#11

PKCS#11 is the standard way in which a program uses the keys of a token, of a smart card or of a hardware security module (HSM): the manufacturer of the device provides a library (a .dll file) and the program asks the device, through that library, to sign. PDF Signer Server can use a device in this way directly, without the Windows store. This is useful for HSMs and for computers where the middleware of the device does not copy the certificate in the Windows store.

In the certificate window select PKCS#11 interface and fill in:

6.4 Select the digital certificate for creating signatures

To digitally sign a document, a digital certificate must be selected first. Click Select the Digital Certificate... (or Tools → Select the Digital Certificate...). The certificate can be in the Windows store, in a PFX file or on a PKCS#11 device.

Option A: a certificate installed in Windows

Certificates installed on the computer, or stored on a USB token or smart card that Windows knows, appear in Windows Certificate Store.

1. Select Windows Certificate Store.
2. In Certificate Store choose Current User (the usual case) or Local Machine (certificates installed for the whole computer).
3. Pick your certificate from the list. Each line shows the name of the owner and the expiry date; a certificate that declares itself qualified is marked (qualified certificate), and an expired one is marked EXPIRED. The issuer is written in Certificate Information, under the list. Show displays the full certificate.
4. If your token was inserted after the window was opened, click Refresh: the list is read again from Windows and your selection is kept.
5. If the certificate is on a smart card and you want to avoid the PIN window, tick Smart Card PIN and type the PIN. This is possible only for a certificate on a token or a smart card (section 6.2).
6. Click OK.

The list shows only the certificates that can create signatures: they have a private key, they are not meant only for encrypting and they are not certificates of a web server. The most suitable certificate is the first one: a valid one, a qualified one, one with the non-repudiation usage, the one that expires last. When no certificate was selected before, this one is selected for you. The expired certificates (and those that are not valid yet) are at the end of the list, so that you see why they cannot be used: when you select one, the program warns you, and OK does not accept it.

Option B: a PFX file

Some certificates are delivered as a file with the extension .pfx (or .p12), protected by a password.

1. Select PFX digital certificate file.
2. Click ... and pick your .pfx file (or type its path).
3. Type the PFX file password. When you leave the box, the Certificate Information box shows the certificate, so you can check that you picked the right file; the Show button next to the password displays the certificate.
4. Click OK.

Option C: a PKCS#11 device

Select PKCS#11 interface and fill in the library, the slot, the PIN and the certificate file as described in section 6.3.

Certificate Information

In the middle of the window, Certificate Information summarizes the selected certificate: to whom and by whom it was issued, until when it is valid, and the provider of its private key. The same summary is shown under the certificate button of the main window. Both RSA and ECDSA (elliptic curve) certificates are supported.

Revocation data maximum size

At the bottom of the window, Revocation data maximum size (1024 kilobytes by default) limits the validation data (CRL, lists of cancelled certificates) that the long-term signatures (PAdES-B-LT and PAdES-B-LTA) store in the document. Keep the default value.

7. eIDAS electronic signatures, seals, time stamps and signature formats

PDF Signer Server creates the signatures that the European Union uses for electronic signatures on PDF documents: PAdES signatures (ETSI EN 319 142-1). This section explains how they relate to the eIDAS Regulation (EU) No 910/2014, what you need to obtain a qualified electronic signature or a qualified electronic seal, why a qualified time stamp is useful, which format to choose, and how to check the result with the tools of the European Union.

7.1 The levels of electronic signatures in the eIDAS Regulation

The same rules apply to electronic seals. A seal is the signature of a legal entity (a company, an institution), created with a certificate for electronic seals. A qualified electronic seal enjoys the presumption of integrity of the data and of correctness of the origin of the data (Article 35). A seal is the natural choice for documents that a company issues automatically, such as invoices, and PDF Signer Server signs with a seal certificate in the same way as with a signature certificate.

A qualified electronic time stamp, issued by a qualified time stamping service, enjoys the presumption of the accuracy of the date and the time it indicates and of the integrity of the data to which they are bound (Article 41). Section 7.5 explains how to use it.

7.2 What you need for a qualified signature or seal

The level of a signature is given by the certificate and by the device that holds its private key, not by the software. PDF Signer Server creates the signature in the PAdES format that the validators expect, and it works with all the kinds of certificates:

When the selected certificate declares itself as a qualified certificate, PDF Signer Server writes (qualified certificate) after its name, in the certificate window. This mark is only an indication that is read from the certificate: the qualified status itself is given by the EU Trusted Lists (see section 7.4).

7.3 Signature formats

The format decides how much information is stored inside the signature. If you are not sure, keep the first one. The four PAdES-B formats are the baseline profiles of ETSI EN 319 142-1, the formats recognised for advanced and qualified signatures. All of them are in the single list Signature Format of the main window:

The letters B, T, LT and LTA come from the standard: Basic, Time-stamp, Long Term and Long Term Archival.

7.4 The EU Trusted Lists and the validation of the signature

The EU Trusted Lists are the lists published by the Member States with the qualified trust service providers and their services (browse them here). The programs that validate signatures read them to decide whether a certificate is qualified and whether its key was on a QSCD.

Adobe Reader uses the European Union Trusted Lists too: a signature made with a certificate of a provider that is listed there is shown as valid, without any setting, and a qualified signature is marked as such:

For a certificate that is not in the Trusted Lists (for instance a certificate of your company, or a test certificate) Adobe Reader reports the validity as unknown, until its user trusts the certificate (section 15).

Validate the signature with the European validator

The European Commission publishes an open validation tool, DSS (Digital Signature Service, part of the eSignature building block), that checks signatures according to the eIDAS rules. You can use it to confirm that a document signed with PDF Signer Server carries a correct PAdES signature and to see its level:

1. Open the validation page. Go to ec.europa.eu/digital-building-blocks/DSS/webapp-demo/validation.
2. Select the signed document. Choose the signed PDF document.
3. Validate. Keep the default validation policy and start the validation. Read the Simple Report; the Detailed Report and the Diagnostic data explain every check.

The report shows, for each signature:

• the signature format, for example PAdES-BASELINE-B, -T, -LT or -LTA;
• the signer and the certificate chain;
• the signing time or the time of the time stamp;
• the indication of the validation (passed, failed or indeterminate);
• the qualification of the signature. The validator reads the EU Trusted Lists and tells you whether the certificate is qualified and whether its key was on a QSCD. A qualified signature is reported as a qualified electronic signature (QESig); a qualified seal as a qualified electronic seal (QESeal).

Do not upload documents with private content to a public service. For confidential documents use a validation tool installed on your own computer, or the Adobe Reader.

7.5 Qualified time stamps: qtsa.eu

A time stamp proves that the document existed at a given moment and was not changed since. A qualified time stamp is issued by a qualified trust service provider that is listed in the EU Trusted Lists, and it enjoys, in all the Member States, the presumption of the accuracy of the date and the time (Article 41 of the eIDAS Regulation). Together with a qualified signature or seal it proves both who signed the document and when, with the legal effects described in section 7.1.

PDF Signer Server can use any time stamp server that follows the RFC 3161 standard, so the product works with certificates, seals and time stamps that are qualified. To add a qualified time stamp to your signatures:

1. Get the access data. The provider of the qualified time stamps gives you the address of the server and, usually, a user name and a password.
2. Open the time stamp settings. Select a format that uses a time stamp (PAdES-B-T, PAdES-B-LT or PAdES-B-LTA) and click Time Stamping Settings... (section 8).
3. Type the address and the access data. Write the address in Time Stamp Server URL; tick Time Stamp Server requires authentication and type the user name and the password in their own boxes, not in the address.
4. Test the server. Click Test the Server. The program asks for a time stamp with the values of the window and shows who issued it. If the time stamp declares itself as a qualified one, the message says (qualified time stamp).
5. Sign. From now on every signature gets a time stamp from the server you set, also in the automatic signing.

8. Time stamp settings

A time stamp is issued by a Time Stamp Authority (TSA), an independent service. It proves that your signature existed at a given moment and cannot be back-dated. It is used by PAdES-B-T, -LT, -LTA and by the PKCS#7 formats with time stamp. Open the window with Time Stamping Settings... (also in the Tools menu); the button is available only when the selected format uses a time stamp.

9. The appearance of the signature

When Visible signature box is ticked, the signature is drawn on the page: by default in the upper right corner of the first page, with the name of the signer, the reason, the place and the date. Click Signature Appearance... to change it.

10. Reason, certification and encryption

Signing reason and location

In the main window, Signing reason offers five usual reasons: I am the author of this document, I have reviewed this document, I am approving this document, I attest to the accuracy and authenticity of this document and I agree to specified portions of this document. You can also type your own reason. Signing location is the place where you sign, for example the name of your city. Both are optional. They are saved in the signature and appear in the signature properties of the PDF reader; they appear in the signature box too, if the options Reason and Location are ticked in the appearance window (section 9). The same reason and location are used for all the documents signed in one operation.

Certify the documents

When you certify a document, you indicate that you are its author and that you approve of its content. You also set which changes are still allowed for the document to remain certified. According to the PDF standard, a certifying signature must be the first signature of a document, and a document can have only one: use Certify only for documents that are not signed yet. PDF readers show a certifying signature with a blue ribbon in the signature panel.

Tick Certify in the main window and choose the level:

Encrypt the signed documents

If you want to protect the signed documents, for instance to prevent the copying of their content, you can encrypt them. Tick Encrypt document: the encryption window opens (it opens by itself when no password is set yet), and the documents are signed and encrypted in the same operation, so the signature stays valid. If you close the window without a password, the option is unticked.

At least one of the two passwords is required, and they must be different (with the same password, the recipients could remove the restrictions). The open password is asked by the PDF reader when the document is opened; the restrictions are shown in the security settings of the document.

11. Protected, damaged and already signed documents

Documents protected with a password

Some PDF documents are protected with a password. To sign such a document, tick Owner password of encrypted PDFs in the main window and type the password. It must be the owner password (the permissions password): signing changes the document, and only the owner password allows it. The password that only opens the document is not enough. The signed document keeps the protection of the original: the same passwords, the same restrictions and the same encryption.

If the password is missing or wrong, PDF Signer Server does not sign the document and explains why:

• The PDF document is protected with a password and it cannot be opened: the password is not set or it is not correct. Enter the owner password of the document in 'Owner password of encrypted PDFs'.
• The PDF document is protected and it can be signed only with its owner password (the password of the document permissions), not with the password that only opens it. Enter the owner password in 'Owner password of encrypted PDFs'.

The password of the main window is used for all the documents you sign in the same operation. When you sign a folder of documents that have different passwords, the documents with another password are not signed: they are listed at the end of the operation and, in the automatic signing, they are moved to the error folder (section 13.2). Sign them separately, or with another configuration (section 17).

Documents that are already signed

You can sign a document that already has signatures. The new signature is added after the existing ones, which remain valid. Do not use Certify for such a document: a certifying signature must be the first one (section 10).

Documents with a damaged structure

Some PDF documents have a damaged internal structure (a wrong table of the positions of the objects, for example after a faulty export or download). The PDF readers repair such a document silently when they open it, and you do not notice anything. A document like this cannot be signed by simply adding a signature at the end, so PDF Signer Server rebuilds it before signing:

• A damaged document that has no signature is rebuilt and signed, without any question. The content of the pages does not change, and a protected document keeps its passwords and permissions.
• A damaged document that is already signed can be signed only after the rebuild, and the rebuild makes the existing signatures invalid. PDF Signer Server asks you first and explains it. The default answer is No.

When a folder is signed from the window, the question is asked for each such document, and a document for which you answer No is listed among the errors at the end. When nobody can answer the question — in the automatic signing (section 13) and in the command line (section 18) — these documents are not signed: with the automatic signing they go to the error folder, and the command line returns the result code 1.

12. Signing all the documents of a folder

To sign all the PDF documents of a folder at once, select A folder with PDF documents.

1. Under Source choose the folder with your documents (or drag the folder onto the window). The status bar shows how many PDF documents it contains.
2. Under Destination choose another folder, which must exist. Every PDF document of the source folder is signed and saved in the destination folder with the same name: invoice-001.pdf remains invoice-001.pdf. The source and the destination must be different folders, otherwise the originals would be overwritten. Only the documents of the folder itself are signed, not those of its subfolders.
3. Click Apply Digital Signature. While it works, the bottom bar shows the progress and a Cancel button, which stops the operation after the current document. When it finishes you see how many documents were signed.

A problem with one document does not stop the others. At the end the message lists the documents that failed and why (the first ten). If the PIN of your smart card is rejected, the operation stops at once, so the card is not locked by repeated wrong attempts.

13. Automatic signing: watching a folder

The Folder Automation group turns PDF Signer Server into a signing station. You choose a source folder, where the documents arrive (from your accounting program, from a scanner, from your colleagues), and a destination folder, where the signed documents are saved. The program looks in the source folder at the interval you set and signs every PDF document it finds, without anybody clicking anything.

13.1 Set up the automatic signing

1. Choose the folders. Select A folder with PDF documents, and choose the Source folder and the Destination folder. Both must exist and they must be different folders (section 12).
2. Choose the certificate and the options. Select the certificate, the signature format, the appearance and the other options as for any signing. Because nobody will be there to answer questions, use a certificate that does not need any interaction: a PFX file, a certificate whose smart card PIN is saved (section 6.2), or a PKCS#11 device (section 6.3). The smart card or the token must stay connected.
3. Set the additional actions. Tick Perform additional actions after signature operation, click Configure Actions... and choose the backup folder, the error folder and whether the originals are deleted. This step is important: read section 13.2 first.
4. Switch the checking on. Tick Check the source folder for new files on every and set the interval in seconds (from 1 to 9999; 60 is the original value).
5. Leave the program running. The status bar shows when the next check will be made. You can minimize the window.

What the program does at every check

• The first check is made when the interval has passed after you switch the checking on. To sign at once, click Apply Digital Signature.
• If the source folder contains no PDF documents, the status bar says No files to process on: and the time.
• Otherwise every PDF document of the folder is signed and saved in the destination folder, and then delivered and archived as you chose (section 14, section 13.2). While the program works, the controls of the window are locked.
• The status bar tells the result, for example 3 of 4 files signed on: the date and the time, and (1 errors, see the error log) if some documents failed.
• No message windows are shown for the problems of the documents: they are written in the error log (section 17.1), and the documents are moved to the error folder if you set one.
• To stop the automatic signing, untick Check the source folder for new files, or close the program.

13.2 Additional actions: archive, errors, delete

Tick Perform additional actions after signature operation and click Configure Actions... to open the Actions window. The actions work in the folder mode (the button is not available for a single document), also when you click Apply Digital Signature yourself, and in the command line.

The two folders must exist: the window checks them when you click OK. Restore Defaults empties the settings of this window.

The recommended combination for a station that works every day:

The order of the work for one document is: the document is signed and saved in the destination folder; it is sent by e-mail and uploaded to the FTP server, if you set these options; then it is copied to the backup folder and deleted from the source folder. A problem of the e-mail or of the FTP does not undo the signing: the signed document stays in the destination folder, the problem is written in the error log, and the original is archived and deleted as usual.

14. Delivery of the signed files: e-mail and FTP

PDF Signer Server can send every signed document by e-mail, and upload it to an FTP server. Tick Send by email and/or Upload to an FTP server in the group Delivery of the Signed Files, and click the button next to each of them to set the details. The delivery works for a single document and for the documents of a folder, with the automatic signing and with the command line too (section 18).

14.1 Sending the signed documents by e-mail

You need an outgoing mail (SMTP) server that your computer can reach, and its settings: ask your system administrator or your mail provider. Each signed document is sent as an attachment of its own message.

When you click OK, the program checks the values (for example Email Server cannot be empty., From Address format is invalid., The email body file does not exist.) and tells you what to correct.

14.2 A different recipient for every document: the CSV file

Choose An email address related to the document name when the documents of one operation go to different persons, for example one invoice for each customer. The recipient is found in a CSV file (a plain text file with the values separated by commas), by the name of the document.

Click Generate CSV File Header and save the file: it contains a header line and some example lines, which you replace with your own lines. A file for three customers looks like this:

FileNamePrefix,EmailAddress,Comments
"invoice-001","northwind@example.com","invoice-001.pdf goes to Northwind"
"invoice-002","contoso@example.com","invoice-002.pdf goes to Contoso"
"invoice-","accounting@example.com","all the other invoices"

• The first line is a header and it is not used. Keep it.
• The first column is the name of the document, or only its beginning: a line applies to every document whose name starts with this text (the capital letters do not matter). invoice-001 applies to invoice-001.pdf and to invoice-0010.pdf too; write invoice-001.pdf to apply only to that document.
• The second column is the address of the recipient. The third column is only a comment for you.
• The lines are read from the top and the first line that fits is used. Write the specific lines first and the general lines (like invoice-) last.
• Save the file as a plain text (CSV) file; a Microsoft Excel file (.xls, .xlsx) cannot be used: in Excel choose Save As and the CSV format.

When you select the file, the program tells you how many lines it found, and it checks the addresses. With this file, the documents of the folder are sent like this:

14.3 Uploading the signed documents to an FTP server

After a document is signed it can also be uploaded to an FTP account. If you use both options, the document is sent by e-mail first and then uploaded.

If the delivery fails

The signing and the delivery are separate steps: when the e-mail or the FTP fails, the document is signed anyway and the signed file stays in the destination folder. For a single document, a message tells you what failed:

For a folder, the errors are listed in the final message and written in the error log. The window shows, for a folder signed without errors, a message like the following:

15. Checking a signed document

In PDF Signer Server: Document Properties

Open File → Document Properties.... If a document is selected in the Source box, it is shown; otherwise the program asks you to select one. The window shows the number of pages, the size of the page and, for each signature of the document (choose it from the list; the ... button next to the list shows the certificate of the signer): the reason and the place of the signature, the hash algorithm, the integrity of the signature, the date and the time stamp server.

For a document that is protected with a password, tick Owner password of encrypted PDFs in the main window and type the password before you open the properties.

In Adobe Reader

Open the signed document in Adobe Reader and look at the bar above the document and at the Signatures panel. For a certificate that is not in the lists that Adobe trusts, for example the certificate of your company or a test certificate, Adobe says that the validity is unknown:

This is not an error of the signature or of PDF Signer Server: Adobe uses its own lists of trusted authorities. A signature made with a qualified certificate, or with a certificate of an authority that Adobe trusts, is shown as valid without any setting. For the other certificates, the person who receives the document can tell Adobe that it trusts the certificate:

1. Open the Signature Properties and click Show Certificate....
2. Select the topmost certificate of the chain, open the Trust tab and click Add to Trusted Identities....
3. Tick all the boxes, click OK, and open the document again.

The steps for the different versions of Adobe Reader, the time stamps and the revocation checks are described in the guide Validating Digital Signatures in Adobe.

With the European validator

To check the level of the signature (advanced or qualified), use the validation tool of the European Commission, described in section 7.4.

16. Creating a test certificate

If you do not have a certificate yet and only want to try the program, PDF Signer Server can create a self-signed one. Open Tools → Create a self-signed Certificate... (or click the same button in the certificate window).

1. Choose where to save it: On Microsoft Certificate Store (the certificate is installed for your Windows account) or On a password protected PKCS#12 PFX file (you will be asked for the file name and a password).
2. Type Issued to (the name, required) and, if you wish, the organization, the title, the unit, the e-mail address and the country code (two letters, for example US).
3. Choose the Validity period (3, 5 or 10 years, default 3 years), the Key Algorithm (RSA 2048, 3072 or 4096 bits, or ECDSA with the curves P-256, P-384 or P-521; default RSA 2048) and the Hash Algorithm (SHA256, SHA384 or SHA512; default SHA256). The defaults are fine.
4. Keep Set as current digital certificate ticked to use it right away, then click OK and confirm the question that explains what a self-signed certificate is.

17. Saving your settings, and the logs

The program remembers your choices (certificate, signature format, appearance, time stamp server, encryption, e-mail, FTP, folders, actions...) the next time you start it. You can also keep several sets of settings in files — for example one for each customer or each department:

• File → Save Configuration (Ctrl+S) saves the current settings now. They are also saved when you close the program.
• File → Save Configuration As... saves the current settings in an XML file you name.
• File → Load Configuration... loads them again.
• Restore Defaults (the button of the main window and the command of the Tools menu) returns everything to the original values: the selected certificate, the appearance of the signature, the time stamp server, the e-mail, the FTP and the actions too. The program asks you to confirm first.

The settings are kept in the file configuration.xml, in the folder %APPDATA%\Secure Soft\PDF Signer Server\5.0 of your Windows account. A saved configuration file is also what the command line uses to sign documents automatically.

17.1 The logs

PDF Signer Server writes everything it does in two text files, in the same folder as the configuration, %APPDATA%\Secure Soft\PDF Signer Server\5.0:

• log.txt — every document that was signed, sent by e-mail, uploaded, archived, moved to the error folder or deleted;
• errorlog.txt — the errors, with the reason.

To read them, use Tools → Show Application Log... and Show Application Error Log...: they open in your text editor. Every line starts with the date and the time (in the format of your Windows settings), followed by the message. The command line writes in the same files. An example of log.txt:

10/8/2026 7:37:04 PM:The file C:\Demo\Server\Inbox\broken.pdf cannot be processed and was saved on the error folder C:\Demo\Server\Errors. Error message: PDF header signature not found.
10/8/2026 7:37:04 PM:The source file C:\Demo\Server\Inbox\broken.pdf was deleted
10/8/2026 7:37:04 PM:The file C:\Demo\Server\Inbox\invoice-001.pdf was signed and the resulting signed file is C:\Demo\Server\Signed\invoice-001.pdf
10/8/2026 7:37:04 PM:The file C:\Demo\Server\Inbox\invoice-001.pdf was saved as backup to the folder C:\Demo\Server\Archive
10/8/2026 7:37:04 PM:The source file C:\Demo\Server\Inbox\invoice-001.pdf was deleted

and of errorlog.txt, for the same operation:

10/8/2026 7:37:04 PM:The file C:\Demo\Server\Inbox\broken.pdf cannot be signed. Error message: PDF header signature not found.

The delivery adds lines like The file C:\Demo\Server\Signed\invoice-001.pdf was sent by email to the email address: northwind@example.com and The file C:\Demo\Server\Signed\invoice-001.pdf was uploaded to the FTP server ftp.example.com/invoices.

18. Automatic signatures from the command line

PDF Signer Server can also sign without showing its window, for example from a scheduled task, from a script or from another program. Nobody has to click anything: the program reads the settings from a configuration file, signs and closes.

By default, PDF Signer Server is installed in the folder C:\Program Files (x86)\Secure Soft\PDF Signer Server (on a 32-bit Windows: C:\Program Files\Secure Soft\PDF Signer Server) and the program file is PDF Server.exe.

Command line parameters

"PDF Server.exe" <source file> <destination file> [<configuration file>]
"PDF Server.exe" <source folder> <destination folder> [<configuration file>]

• source folder: all the PDF documents of the folder are signed, with the same names, in the destination folder. The destination folder must exist.
• configuration file: an XML file saved with File → Save Configuration As.... When it is not given, the current configuration of your Windows account is used.
• A fourth parameter, used by earlier versions of the program, is ignored.
• Do not end a path written between quotes with a backslash: write "C:\Folder", not "C:\Folder\". Windows would read the last backslash and quote as one character and the parameters would be mixed up.
• An error on one document of a folder does not stop the other documents.
• If the configuration sets the e-mail and the FTP upload (section 14), every signed document is sent and uploaded, for a document and for a folder. With a CSV file of recipients, the file is checked before anything is signed.
• For a folder, the additional actions of the configuration (backup folder, error folder, delete the originals, section 13.2) are applied; for a single document they are not.

Sign one document

c:\Program Files (x86)\Secure Soft\PDF Signer Server>"PDF Server.exe" C:\Demo\Server\Inbox\invoice-001.pdf C:\Demo\Server\Signed\invoice-001.pdf
The file was digitally signed successfully.

Sign a folder

c:\Program Files (x86)\Secure Soft\PDF Signer Server>"PDF Server.exe" C:\Demo\Server\Inbox C:\Demo\Server\Signed
The PDF documents of the source folder were digitally signed successfully. Number of signed documents: 3

Custom configuration

In some cases you need a different signature configuration (for example a different certificate, signature format or appearance, or different actions) for different documents or folders. To save a specific configuration, open the window, set everything you want, and go to File → Save Configuration As... Save the configuration in a file. Later you can use that file in the command line to apply a different configuration:

"PDF Server.exe" C:\Demo\Server\Inbox C:\Demo\Server\Signed C:\Demo\Server\server.config

With a configuration that has a backup folder, an error folder and the deletion of the originals, and a folder that contains a document that is not a valid PDF, the result is:

Operation finished with errors. Signed files: 2 of 3. Last error: PDF header signature not found. File name: broken.pdf

The two documents that are valid are signed in the destination folder and archived, and the third one is moved to the error folder.

When the delivery fails, the document is signed anyway, the message tells what failed and the result code is 1:

The file was digitally signed successfully, but:
invoice-001.pdf: the file was not sent by email: Failure sending mail.

Result codes

The messages are written in the command window. Examples:

Command line options: PDF Server.exe <source file | folder> <destination file | folder> [<XML configuration file>]      (code 2)
The source file or folder does not exist.                       (code 2)
The destination folder does not exist.                         (code 2)
The destination cannot be the same as the source.               (code 2)
The configuration file does not exist.                        (code 2)
The configuration file contains values that are not valid (C:\Demo\Server\invalid.config):
SignatureFormat: 'PAdES-BB' is not valid (valid values: PAdES-B, PAdES-T, PAdES-LT, PAdES-LTA, PKCS7, PKCS7-T, PKCS7-LTV).    (code 2)
The configuration file cannot be read: it is damaged, or it is not a PDF Signer Server configuration file (C:\Demo\Server\notxml.config). ...    (code 2)
An encrypted document cannot be signed with the PAdES-B-LT - long term validation signature format: ... Select the PAdES-B-T signature format, or do not encrypt the document.    (code 2)
Operation finished with errors. Signed files: 2 of 3. Last error: ...    (code 1)

PDF Signer Server is a Windows application, so the command prompt does not wait for it. To wait and read the result code:

cmd:         start "" /wait "PDF Server.exe" C:\Demo\Server\Inbox C:\Demo\Server\Signed C:\Demo\Server\server.config
             echo %errorlevel%

PowerShell:  (Start-Process "PDF Server.exe" -ArgumentList '"C:\Demo\Server\Inbox" "C:\Demo\Server\Signed" "C:\Demo\Server\server.config"' -Wait -PassThru).ExitCode

Every signed document, and every error, is also written in the log files (section 17.1).

19. The Signature Library behind PDF Signer Server

PDF Signer Server is an application built on the Signature Library (SignLib), a library for .NET that creates and verifies digital signatures: PDF (PAdES), CAdES / PKCS#7, XML (XAdES), Office and more. The signing that PDF Signer Server does is available to your own programs and scripts through the library:

• Library page: https://www.signfiles.com/signature-library/
• Download (library, samples and PowerShell scripts): https://www.signfiles.com/sdk/SignatureLibrary.zip
• Code samples: sign a PDF document, automatic signature (bypass the PIN), PowerShell

The library works with Windows PowerShell, C#, VB.NET and ASP.NET, and it supports certificates from PFX files, from the Windows store and from smart cards, USB tokens and HSMs.

From the window to the code

PDF signatures are created with the class SignLib.Pdf.PdfSignature. The table shows what each setting of PDF Signer Server is in the library.

The library can do more than the window: an explicit signature policy, the signing of an existing empty signature field, a document time stamp without a signature, and the deferred signing with an external signer (HSM, cloud). Section 21 shows the main cases.

20. Digitally sign PDF documents using Windows PowerShell

The main functions of PDF Signer Server are available in the SignLib library, which you can download from this link: https://www.signfiles.com/sdk/SignatureLibrary.zip

To digitally sign a PDF document using Windows PowerShell, simply download the library above and inspect the Signature Library\PowerShell Scripts folder. The script below creates a test PFX certificate on the fly, signs the document in the PAdES-B-B format (SHA256) and verifies the result.

The script

Save it as signPdf.ps1, in the same folder with SignLib.dll and iTextSharp-4.1.6.dll.

#digitally sign a PDF document with a PFX certificate created on the fly (PAdES-B-B, SHA256) and verify the result
#the script can be configured to use an existing PFX file or a certificate loaded from the Windows certificate store (smart card certificate)

if ($args.Length -eq 0)
{
    echo "Usage: signPdf.ps1 <unsigned file> <signed file>"
}
else
{
    #SignLib.dll and iTextSharp-4.1.6.dll must be in the same folder as the script
    $DllPath = Join-Path $PSScriptRoot 'SignLib.dll'
    [System.Reflection.Assembly]::LoadFrom($DllPath) | Out-Null

    #create a PFX digital certificate
    $generator = new-object -typeName SignLib.Certificates.X509CertificateGenerator("serial number")
    $pFXFilePassword = "tempP@ssword"
    $generator.Subject = "CN=Your Certificate, E=useremail@email.com, O=Organization"
    $generator.Extensions.AddKeyUsage([SignLib.Certificates.CertificateKeyUsage]::DigitalSignature)
    $generator.Extensions.AddEnhancedKeyUsage([SignLib.Certificates.CertificateEnhancedKeyUsage]::DocumentSigning)

    echo "Create the certificate..."
    $certificate = $generator.GenerateCertificate($pFXFilePassword)

    #digitally sign the PDF document (PAdES-B-B, SHA256)
    $sign = new-object -typeName SignLib.Pdf.PdfSignature("serial number")
    $sign.LoadPdfDocument($args[0])
    $sign.DigitalSignatureCertificate = [SignLib.Certificates.DigitalCertificate]::LoadCertificate($certificate, $pFXFilePassword)
    $sign.SignatureStandard = [SignLib.Pdf.PdfSignatureStandard]::Pades

    $sign.SigningReason = "I approve this document"
    $sign.SigningLocation = "Accounting department"
    $sign.SignaturePage = 1
    $sign.SignaturePosition = [SignLib.Pdf.SignaturePosition]::TopRight

    echo "Perform the digital signature..."
    [System.IO.File]::WriteAllBytes($args[1], $sign.ApplyDigitalSignature())

    #verify the signature
    $verify = new-object -typeName SignLib.Pdf.PdfSignature("serial number")
    $verify.LoadPdfDocument($args[1])
    echo ("Signatures: " + $verify.DocumentProperties.DigitalSignatures.Count)
    echo ("Valid: " + $verify.DocumentProperties.DigitalSignatures[0].SignatureIsValid)
}

How to run it

How to run the Windows PowerShell script from the command line:

powershell -executionPolicy bypass -file d:\signPdf.ps1 d:\invoice.pdf d:\invoice-signed.pdf

The result in the window:

Create the certificate...
Perform the digital signature...
Signatures: 1
Valid: True

21. Digitally sign PDF documents using C# or VB.NET

The main functions of PDF Signer Server are available in the SignLib library (download). To digitally sign a PDF document using C# or VB.NET, download the library, add a reference to SignLib.dll in your project, make sure that iTextSharp-4.1.6.dll, delivered with it, is in the same folder as your program, and inspect the sample projects of the package and the code samples: sign a PDF document, automatic signature, PowerShell.

PDF documents are signed with the class PdfSignature (namespace SignLib.Pdf). It creates PAdES and PKCS#7 signatures, with or without a time stamp and long-term validation data, visible or invisible, and it reads the signatures of a document (DocumentProperties.DigitalSignatures). All the examples below use these namespaces. Every example was run with the library to check the result.

using System;
using System.Collections.Generic;   // List<int>
using System.IO;
using System.Security.Cryptography.X509Certificates;
using SignLib;                 // HashAlgorithm
using SignLib.Certificates;    // DigitalCertificate
using SignLib.Pdf;             // PdfSignature, SignaturePosition, PdfSignatureStandard...

21.1 Sign a document and verify the signature

The smallest program: load a certificate from a PFX file, sign, save the signed document and verify it. The signature format is PAdES-B-B (PdfSignatureStandard.Pades) and the hash is SHA256, like the defaults of PDF Signer Server. ApplyDigitalSignature returns the bytes of the signed document: you choose where to save it. The PdfSignature object that verifies is a new one, loaded with the signed document.

// "serial number" is the serial number of the library
PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Invoices\invoice-001.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

ps.SignatureStandard = PdfSignatureStandard.Pades;      // PAdES-B-B
ps.HashAlgorithm = HashAlgorithm.SHA256;
ps.SigningReason = "I am approving this document";
ps.SigningLocation = "Springfield";
ps.SignaturePage = int.MaxValue;                        // the last page
ps.SignaturePosition = SignaturePosition.BottomRight;

// apply the digital signature: the original document is not changed
byte[] signed = ps.ApplyDigitalSignature();
File.WriteAllBytes(@"C:\Demo\Signed\invoice-001-code.pdf", signed);

// verify the signature
PdfSignature check = new PdfSignature("serial number");
check.LoadPdfDocument(@"C:\Demo\Signed\invoice-001-code.pdf");

Console.WriteLine("Pages: " + check.DocumentProperties.NumberOfPages + ", signatures: " + check.DocumentProperties.DigitalSignatures.Count);
foreach (PdfSignatureInfo info in check.DocumentProperties.DigitalSignatures)
{
    Console.WriteLine("Signer: " + info.SignatureCertificate.GetNameInfo(X509NameType.SimpleName, false));
    Console.WriteLine("Hash: " + info.HashAlgorithm);
    Console.WriteLine("Reason: " + info.SigningReason + ", location: " + info.SigningLocation);
    Console.WriteLine("Valid: " + info.SignatureIsValid);
    Console.WriteLine("Time: " + info.SignatureTime);
    Console.WriteLine("Time stamped: " + info.SignatureIsTimestamped);
}

The result:

Pages: 1, signatures: 1
Signer: Elaine Smith
Hash: SHA256
Reason: I am approving this document, location: Springfield
Valid: True
Time: 10/8/2026 7:04:42 PM
Time stamped: False

(X509NameType is in the namespace System.Security.Cryptography.X509Certificates.) The same example in VB.NET:

Imports System
Imports System.IO
Imports System.Security.Cryptography.X509Certificates
Imports SignLib
Imports SignLib.Certificates
Imports SignLib.Pdf

Module Module1
    Sub Main()
        ' "serial number" is the serial number of the library
        Dim ps As New PdfSignature("serial number")
        ps.LoadPdfDocument("C:\Demo\Invoices\invoice-001.pdf")
        ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate("C:\Demo\elaine.pfx", "123456")
        ps.SignatureStandard = PdfSignatureStandard.Pades
        ps.HashAlgorithm = HashAlgorithm.SHA256
        ps.SigningReason = "I am approving this document"
        ps.SigningLocation = "Springfield"
        ps.SignaturePosition = SignaturePosition.BottomRight

        'apply the digital signature and save the signed file
        File.WriteAllBytes("C:\Demo\Signed\invoice-001-vb.pdf", ps.ApplyDigitalSignature())

        Dim check As New PdfSignature("serial number")
        check.LoadPdfDocument("C:\Demo\Signed\invoice-001-vb.pdf")
        Console.WriteLine("Signatures: " & check.DocumentProperties.DigitalSignatures.Count)
        For Each info As PdfSignatureInfo In check.DocumentProperties.DigitalSignatures
            Console.WriteLine("Valid: " & info.SignatureIsValid)
        Next
    End Sub
End Module

21.2 Signature formats, time stamp and long term validation

The format is chosen with SignatureStandard, and the signature is time stamped (PAdES-B-T) when you set the address of a time stamp server (section 8):

A signature with time stamp (PAdES-B-T), and its verification:

PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Invoices\invoice-002.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

ps.SignatureStandard = PdfSignatureStandard.Pades;      // PAdES-B-T: PAdES-B-B plus a time stamp
ps.TimeStamping.ServerUrl = new Uri("https://ca.signfiles.com/TSAServer.aspx");
ps.TimeStamping.UseNonce = true;                        // a random number that protects the request
ps.TimeStamping.HashAlgorithm = HashAlgorithm.SHA256;   // the hash of the time stamp request
// ps.TimeStamping.UserName = "user"; ps.TimeStamping.Password = "password";   // only if the server requires them

File.WriteAllBytes(@"C:\Demo\Signed\invoice-002-code-t.pdf", ps.ApplyDigitalSignature());

PdfSignature check = new PdfSignature("serial number");
check.LoadPdfDocument(@"C:\Demo\Signed\invoice-002-code-t.pdf");
PdfSignatureInfo info = check.DocumentProperties.DigitalSignatures[0];
Console.WriteLine("Time stamped: " + info.SignatureIsTimestamped);
Console.WriteLine("Time stamp authority: " + info.TimestampInfo.TsaCertificate.GetNameInfo(X509NameType.SimpleName, false));
Console.WriteLine("Time stamp altered: " + info.TimestampInfo.IsTimestampAltered);

The result:

Time stamped: True
Time stamp authority: Free TSA Server
Time stamp altered: False

For long term validation, set SignatureStandard to PdfSignatureStandard.PadesLT; the signing adds the certificates and the revocation data of the signer to the document. PdfSignatureStandard.PadesLTA adds, in addition, the document time stamp. The time stamp server can be the server of a qualified time stamp authority (section 7.5).

PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Invoices\invoice-003.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

ps.SignatureStandard = PdfSignatureStandard.PadesLT;    // PAdES-B-LT (PdfSignatureStandard.PadesLTA for PAdES-B-LTA)
ps.TimeStamping.ServerUrl = new Uri("https://ca.signfiles.com/TSAServer.aspx");

File.WriteAllBytes(@"C:\Demo\Signed\invoice-003-code-lt.pdf", ps.ApplyDigitalSignature());
Console.WriteLine("Signed: " + new FileInfo(@"C:\Demo\Signed\invoice-003-code-lt.pdf").Length + " bytes");

21.3 A certificate from the Windows store or a smart card

When the certificate is in the Windows store (for instance, a qualified certificate on a smart card, section 6.2), load it with a search criterion. No window is shown, so the code can run without a user.

PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Invoices\invoice-001.pdf");

// the first certificate of the current user whose common name (CN) is "Elaine Smith"
// true = only the valid certificates (issued by a trusted authority); false = any certificate, also a self-signed test one
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(false, DigitalCertificateSearchCriteria.CommonNameCN, "Elaine Smith");

// only for a certificate on a smart card or on a token: the PIN, to avoid the PIN window. It applies to the next
// signature, made on this thread (a software certificate, like this one, does not use a PIN)
// DigitalCertificate.SmartCardPin = "1234";

File.WriteAllBytes(@"C:\Demo\Signed\invoice-001-code-store.pdf", ps.ApplyDigitalSignature());
Console.WriteLine("Signed with the certificate: " + ps.DigitalSignatureCertificate.Subject);

Other search criteria are the other fields of the subject (OrganizationO, EmailE...), the thumbprint and the serial number of the certificate. To let the user choose the certificate in a Windows window, call DigitalCertificate.LoadCertificate() without parameters.

21.4 Sign all the documents of a folder

Create the PdfSignature object once, and load and sign each document of the folder. For a smart card, set the PIN before every signature. A document that fails must not stop the others.

PdfSignature ps = new PdfSignature("serial number");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");
ps.SignatureStandard = PdfSignatureStandard.Pades;

foreach (string file in Directory.GetFiles(sourceFolder, "*.pdf"))
{
    try
    {
        // DigitalCertificate.SmartCardPin = "1234";      // for a smart card: before each signature
        ps.LoadPdfDocument(file);
        File.WriteAllBytes(Path.Combine(destinationFolder, Path.GetFileNameWithoutExtension(file) + "-code-folder.pdf"), ps.ApplyDigitalSignature());
        Console.WriteLine("Signed: " + Path.GetFileName(file));
    }
    catch (Exception ex)
    {
        // an error on a file does not stop the other files
        Console.WriteLine("Error: " + file + ": " + ex.Message);
    }
}

21.5 The appearance of the signature

PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Invoices\invoice-001.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

ps.VisibleSignature = true;                                               // false = invisible signature
ps.SignaturePages = new List<int> { 1, int.MaxValue };                    // the pages of the signature (int.MaxValue = the last page)
ps.SignatureAdvancedPosition = new System.Drawing.Rectangle(300, 40, 220, 70);   // x, y (from the bottom left corner), width, height
ps.FontName = "Helvetica";
ps.SignatureText = "Digitally signed by Elaine Smith";                      // your own text, instead of the default text

File.WriteAllBytes(@"C:\Demo\Signed\invoice-001-code-appearance.pdf", ps.ApplyDigitalSignature());
Console.WriteLine("Signed: appearance on the pages of the list");

The signature box can also contain an image (SignatureImage, SignatureImageType) and uses the font of your choice (FontName for the standard fonts, FontFile for a font file).

21.6 Certify and encrypt

A certifying signature (the first signature of a document) and the encryption of the signed document, with an open password and a permissions password:

PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Invoices\invoice-002.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

// a certifying signature: only the author, and only on a document that is not signed yet
ps.CertifySignature = CertifyMethod.NoChangesAllowed;

File.WriteAllBytes(@"C:\Demo\Signed\invoice-002-code-certified.pdf", ps.ApplyDigitalSignature());

PdfSignature check = new PdfSignature("serial number");
check.LoadPdfDocument(@"C:\Demo\Signed\invoice-002-code-certified.pdf");
Console.WriteLine("Certification level: " + check.DocumentProperties.CertificationLevel);

PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Invoices\invoice-001.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

ps.Encryption.EncryptionMethod = PdfEncryptionMethod.PasswordSecurity;
ps.Encryption.EncryptionAlgorithm = PdfEncryptionAlgorithm.EnhancedEncryption128BitAES;
ps.Encryption.OwnerPassword = "permissions-password";       // to change the restrictions
ps.Encryption.UserPassword = "open-password";              // to open the document (optional)
ps.Encryption.DocumentRestrictions = PdfDocumentRestrictions.AllowPrinting;     // what the recipients can do

File.WriteAllBytes(@"C:\Demo\Signed\invoice-001-code-encrypted.pdf", ps.ApplyDigitalSignature());
Console.WriteLine("Signed and encrypted");

The encrypted document cannot be signed with PadesLT or PadesLTA: the library stops with the error PdfReader not opened with owner password.

21.7 Protected and damaged documents

A document protected with a password is signed with its owner password, which must be set before the document is loaded:

PdfSignature ps = new PdfSignature("serial number");

// a protected document is signed with its owner password (the permissions password): set it before loading the document
ps.DocumentProperties.Password = "permissions-password";
ps.LoadPdfDocument(@"C:\Demo\Signed\invoice-001-code-encrypted.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

try
{
    File.WriteAllBytes(@"C:\Demo\Signed\invoice-001-code-encrypted-2.pdf", ps.ApplyDigitalSignature());
    Console.WriteLine("Signed a protected document");
}
catch (Exception ex)
{
    Console.WriteLine("Not signed: " + ex.Message);
}

A damaged document (its structure had to be repaired when it was loaded, DocumentProperties.IsDamaged) is rebuilt before signing. If it already has signatures, the rebuild makes them invalid, so the library signs it only when you allow it with RebuildDamagedSignedDocument:

PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Check\invoice-damaged.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

Console.WriteLine("Damaged: " + ps.DocumentProperties.IsDamaged + ", signatures: " + ps.DocumentProperties.DigitalSignatures.Count);

// a damaged document that is already signed is rebuilt only when you allow it: the existing signatures become invalid
try
{
    ps.ApplyDigitalSignature();
}
catch (InvalidOperationException ex)
{
    Console.WriteLine("Not signed: " + ex.Message);
    ps.RebuildDamagedSignedDocument = true;
    File.WriteAllBytes(@"C:\Demo\Check\invoice-damaged-rebuilt.pdf", ps.ApplyDigitalSignature());
    Console.WriteLine("Signed after the rebuild");
}

The result:

Damaged: True, signatures: 1
Not signed: The PDF document is damaged (its structure has errors that were repaired when it was loaded) and it is already signed. A damaged document cannot be signed incrementally: it must be rebuilt, which makes the existing signatures invalid. Set RebuildDamagedSignedDocument to true to sign it anyway.
Signed after the rebuild

21.8 Good to know

22. Problems and solutions

The messages of the program are written here as the program shows them.

Installation, registration and certificates

Signing

Folder automation, e-mail and FTP

Checking the signatures and the library

23. Glossary

24. Warning and disclaimer, trademarks

Every effort has been made to make this manual as complete and accurate as possible, but no warranty or fitness is implied. The information provided is on an “as is” basis. The author shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this manual. The information about the eIDAS Regulation is a simplified explanation and it is not legal advice.

.NET, Windows, PowerShell, SmartScreen and Visual Studio are trademarks of Microsoft Corporation. Adobe and Adobe Reader are trademarks of Adobe Inc. All other trademarks are the property of their respective owners.