Download P7S Signer (P7M and CAdES eIDAS Format) (Free 30-Day Trial)
P7S Signer (P7M and CAdES eIDAS Format) is a Windows application that digitally signs files of any type (PDF, Word, images, XML, archives) with X.509 certificates. It creates CAdES signatures (ETSI EN 319 122-1, baseline levels B-B, B-T, B-LT and B-LTA) and PKCS#7 / CMS signatures, saved in P7S, P7M or CMS files. CAdES is the format used for advanced and qualified electronic signatures under the eIDAS Regulation (EU) No 910/2014. You can sign a single file or a complete folder of files in one operation, from the program window or automatically from the command line, without purchasing any additional software.
Lifetime license from 29 EUR – Free 30-day trial – 60 day money back guarantee. See prices and buy.
eIDAS-Compliant CAdES Signatures, QSCD and Qualified Certificates
The signatures created by P7S Signer follow the CAdES baseline profiles of ETSI EN 319 122-1, the standard for advanced electronic signatures on any kind of file in the European Union. They can be verified with the validation tool of the European Commission (DSS – eSignature validation) and with other eIDAS-compliant validators. The validator reports the signature format, the signer’s certificate, the time of the signature or of the time stamp, the revocation status and, based on the EU Trusted Lists, whether the certificate is qualified and whether its private key is stored on a qualified signature creation device (QSCD).
Qualified certificates and QSCD – P7S Signer signs with qualified certificates whose private key is stored on a QSCD, such as a smart card or a USB token (for example SafeNet eToken). The private key never leaves the device: the signature is created inside it. A signature created with a qualified certificate on a QSCD is a qualified electronic signature (QES). According to Article 25 of the eIDAS Regulation, a qualified electronic signature has the equivalent legal effect of a handwritten signature and is recognised in all the Member States of the European Union. Qualified certificates for electronic seals, stored on a QSCD, are used in the same way.
The qualification level of a signature is given by the certificate and by the device, not by the software. P7S Signer creates the signature in the format that the validators expect. For a qualified electronic signature, use a qualified certificate on a QSCD issued by a qualified trust service provider. Advanced electronic signatures can be created with any valid X.509 certificate, including certificates stored in the Windows certificate store or in PFX files.
Benefits:
– Support for qualified certificates on QSCD, smart card, USB token, eToken, DSC, HSM (PKCS#11)
– Support for eIDAS digital certificates (EU Regulation 910/2014)
– CAdES-B-B, CAdES-B-T, CAdES-B-LT and CAdES-B-LTA (ETSI EN 319 122-1)
– Signatures that can be verified with the European Commission validator
– P7S, P7M and CMS files, attached or detached signatures, files of any type
– RFC 3161 time stamping and long-term validation (OCSP and CRL)
– SHA-256, SHA-384, SHA-512 support
– RSA and Elliptic Curve (ECDSA) certificates
– Bulk signing of folders and automatic signing from the command line
– Bypass smart card/USB token PIN for automatic signing
– P7S Viewer included
Features
CAdES Standard – P7S Signer creates CAdES baseline signatures at four levels. Choose the level that matches the requirements of the system that receives your files:
| Signature format | What it contains | Typical use |
| CAdES-B-B (basic) | The signature, the signer’s certificate and the signing time | Contracts, invoices and files exchanged between organizations |
| CAdES-B-T | B-B plus a trusted time stamp | When the exact time of the signature must be proven |
| CAdES-B-LT (long term) | B-T plus the certificates and the revocation data (OCSP or CRL) | Files that must remain verifiable after the certificate expires |
| CAdES-B-LTA (long term archival) | B-LT plus an archive time stamp | Archives that must remain provable for many years |
For the systems that still require them, the older PKCS#7 / CMS format and the legacy CAdES-C and CAdES-X Long formats are also available.
P7S, P7M and Detached Signatures – The signed file has the extension .p7s, .p7m or .cms (PKCS#7 / CMS, RFC 5652) and can be opened by any software that reads these standards. By default the signed file contains the document and its signature. You can also save the signature in a separate file (detached signature), and the original file is not changed.
Certificates, Smart Cards, USB Tokens and HSM – P7S Signer is completely PKI neutral and will work with PKI components from any vendor (this includes CAs, certificates, CRLs, smartcards, etc.). You can sign with a certificate from the Windows certificate store (smart card and USB token certificates are added to the store by the driver of the token), with a PFX/P12 file, or directly through the PKCS#11 interface of a token, smart card or HSM, with a test button that checks the device before signing. The program shows the certificate provider, so you can see if the private key is stored on a device. RSA and Elliptic Curve (ECDSA) certificates are supported. P7S Signer refuses to sign with an expired certificate, or with a certificate that is not valid yet, before any file is processed.
Bypass the Smart Card PIN – For automatic signing you can save the PIN of the smart card, of the USB token or of the PKCS#11 device. It is stored encrypted and it belongs to the selected certificate. If the device rejects the PIN, P7S Signer stops using it, so the token is not locked by repeated wrong attempts.
Time Stamping – CAdES-B-T, CAdES-B-LT and CAdES-B-LTA signatures include a RFC 3161 time stamp, issued by a time stamp authority (TSA). The time stamp proves that the signature existed at a given moment and that the file was not changed after that moment. You can configure the TSA address, the authentication, the policy and the use of a nonce. Only a hash is sent to the TSA: your file does not leave your computer.
We provide eIDAS Qualified Timestamps issued by a Qualified Trust Service Provider (QTSP) listed in the European Union Trusted Lists (EUTL) under the eIDAS Regulation. If you need eIDAS Qualified Timestamps with full legal effect across the EU, visit our dedicated website (https://qtsa.eu).
Long-Term Validation – The CAdES-B-LT and CAdES-B-LTA formats embed the certificates and the revocation data (OCSP responses and CRLs) of the signer, so the signature can be verified even after the signer’s certificate expires or is revoked and the servers of the issuer are no longer available.
SHA-256, SHA-384, SHA-512 Algorithms – P7S Signer can digitally sign files using the SHA-256, SHA-384 or SHA-512 hash algorithms. The hash algorithm of the signature and of the time stamp request are configurable.
Bulk and Automatic Signing – Select an input folder and an output folder and P7S Signer signs all the files of the folder, with a progress indicator. The same operation can run without user intervention from the command line, from a script or from the Windows Task Scheduler. Different signature configurations (certificate, format, time stamp) can be saved in files and used for different folders. The program returns a result code (0 for success), so the process can be monitored.
P7S Viewer included – The setup installs P7S Viewer together with P7S Signer. It opens a signed file and shows the signers, the signature format, the signing date, the certificate status, the time stamp and the long-term validation data. It also tells you if the file was modified after it was signed, and it gives you back the original file. P7S Viewer can also extract the original files from a whole folder of signed files.
Built on the eIDAS Signature Library – P7S Signer uses the same Signature Library (SignLib) that is available to developers. You can test a signature format, a hash algorithm or a certificate in the program and then create the same signatures from your own application in C#, VB.NET or Windows PowerShell. See P7S/P7M/CAdES Digital Signature in Visual Studio with C# and P7S/P7M/CAdES Digital Signature in PowerShell.
Where P7S Signer Is Used
– Contracts, invoices, reports and any other file that must be signed and sent by e-mail
– Files exchanged with public administration and other systems that require P7S or P7M signatures
– Archives of signed files that must remain verifiable in the long term
– Bulk signing of large numbers of corporate files
Before you start, check the signature format and the file extension required by the receiving system (for example CAdES-B-B or CAdES-B-LT, P7M or P7S), and choose the same options in P7S Signer.
Frequently Asked Questions
Does P7S Signer create qualified electronic signatures?
P7S Signer creates CAdES signatures. When you sign with a qualified certificate whose private key is stored on a QSCD (a smart card or a USB token), the result is a qualified electronic signature (QES) in the sense of the eIDAS Regulation. With any other valid certificate the result is an advanced electronic signature.
How can I check the signatures?
Open the signed file with P7S Viewer, included in the product. For a validation according to the eIDAS rules, use the validation tool of the European Commission (DSS) or another eIDAS-compliant validator.
What is the difference between P7S and P7M?
Both extensions contain a PKCS#7 / CMS signature in the same format. The extension you choose depends on the system that receives the file. In P7S Signer you can choose P7S, P7M or CMS, and you can save the signature in a separate file.
Can I sign with a smart card, a USB token or an HSM?
Yes. Select the certificate of the device from the Windows certificate store, or use the PKCS#11 library of the device. If you wish, save the PIN for automatic signing.
Can I sign many files automatically?
Yes. Select an input folder and an output folder, or start P7S Signer from the command line with the source, the destination and an optional configuration file.
Are my files sent to a server?
No. The files are signed on your computer. An Internet connection is used only for the time stamp (a hash is sent to the time stamp server) and for the revocation data of the long-term formats.
Which hash algorithms are supported?
SHA-256, SHA-384 and SHA-512. SHA-1 can still be selected for older systems, with a warning.
P7S Signer (P7M and CAdES eIDAS Format) Requirements:
– A digital certificate (eIDAS qualified digital certificates, QSCD are supported)
– Microsoft .NET Framework 4.6.2 or higher
– Windows 10 or later (including Windows 11 and Windows Server 2025)
Licensing:
The license for P7S Signer (P7M and CAdES eIDAS Format) is a lifetime license. There is no additional cost like monthly / annual fees or fees per use. When a new version is released you can continue using your purchased version as usual.
The technical support and updates are free for 12 months after purchase. If you need help with our software, please contact us to receive prompt assistance from our technical support team. We offer free before-and-after purchase technical support for our programs. Technical support is provided by email only. Email response time is usually less than 24 hours.
60 Day Money Back Guarantee – If you are not pleased with our software for any reason, you are entitled to our 60 day no hassle, no questions asked, money back guarantee.
Buy P7S Signer
| License type | Price (€) | Buy with PayPal | Buy with credit card |
| Single License (for 1 computer) |
29 EUR Lifetime License |
 |
|
| Company License (for 10 computers) |
90 EUR Lifetime License |
|
|
| Technical Support | The technical support is free for 12 months after purchase | ||
If you like to pay by Bank Wire Transfer, please fill this form.
Download P7S Signer (P7M and CAdES eIDAS Format) (Free 30-Day Trial)
(latest version: 10.3)
Useful links: