Verify CAdES (P7M, P7S) Digital Signatures in C#

This C# sample verifies the CAdES signatures of a P7M file (the signed file is included) and of a detached P7S file (the signed file is separate), lists the signers and the time-stamps, and extracts the original document from the P7M file.

How it works

• The signatures are verified when the CadesVerify object is created: from the .p7m file, or from the .p7s signature and the original file.
• Signatures lists every signature (a file can have co-signatures), with the certificate, the hash algorithm, the signing time and the time-stamp.
• UnsignedDocument and DocumentName give the signed file included in a .p7m file.

C# code

/// <summary>
/// Verifies a .p7m file (the signed file is included in the signature) and extracts the signed file.
/// </summary>
static void VerifyP7m(string p7mFile, string extractedFile)
{
    // The signature is verified when the CadesVerify object is created.
    CadesVerify cadesVerify = new CadesVerify(p7mFile, LibrarySerialNumber);

    PrintCadesSignatures(cadesVerify);

    // The original (unsigned) file included in the .p7m file.
    Console.WriteLine("Name of the signed file: " + cadesVerify.DocumentName);
    File.WriteAllBytes(extractedFile, cadesVerify.UnsignedDocument);

    Console.WriteLine("Done CAdES signature verification." + Environment.NewLine);
}

/// <summary>
/// Verifies a detached .p7s file against the original file.
/// </summary>
static void VerifyDetachedP7s(string p7sFile, string originalFile)
{
    // The detached signature and the original file are needed to verify the signature.
    CadesVerify cadesVerify = new CadesVerify(File.ReadAllBytes(p7sFile), File.ReadAllBytes(originalFile), LibrarySerialNumber);

    PrintCadesSignatures(cadesVerify);

    Console.WriteLine("Done detached CAdES signature verification." + Environment.NewLine);
}

/// <summary>
/// Displays the signatures verified by a CadesVerify object.
/// </summary>
static void PrintCadesSignatures(CadesVerify cadesVerify)
{
    Console.WriteLine("Signature standard: " + cadesVerify.SignatureStandard);
    Console.WriteLine("Number of signatures: " + cadesVerify.Signatures.Count);
    Console.WriteLine();

    // The signed file can contain several signatures (co-signatures).
    foreach (CadesSignatureInfo signatureInfo in cadesVerify.Signatures)
    {
        Console.WriteLine("Hash algorithm: " + signatureInfo.HashAlgorithm.FriendlyName);
        Console.WriteLine("Signature certificate information:");

        // The signing certificate is null when the signature does not contain it.
        if (signatureInfo.SignatureCertificate != null)
            PrintCertificateInformation(signatureInfo.SignatureCertificate);
        else
            Console.WriteLine("The signature does not contain the signing certificate.");


        // SignatureIsValid verifies only the integrity of the signature (the signed file was not changed). It does
        // not verify the certificate chain or the revocation status of the signing certificate.
        Console.WriteLine("Signature is valid: " + signatureInfo.SignatureIsValid);
        Console.WriteLine("Signature time (computer time of the signer): " + signatureInfo.SignatureTime.ToLocalTime());
        Console.WriteLine("Signature is time-stamped: " + signatureInfo.SignatureIsTimestamped);

        if (signatureInfo.SignatureIsTimestamped)
        {
            Console.WriteLine("Time-stamp hash algorithm: " + signatureInfo.TimestampInfo.HashAlgorithm.FriendlyName);
            Console.WriteLine("Time-stamp is altered: " + signatureInfo.TimestampInfo.IsTimestampAltered);
            Console.WriteLine("Time-stamp serial number: " + signatureInfo.TimestampInfo.SerialNumber);
            Console.WriteLine("Time-stamping authority certificate: " + signatureInfo.TimestampInfo.TsaCertificate.Subject);
        }

        Console.WriteLine();
    }
}

SignatureIsValid verifies the integrity of the signature (the signed file was not changed). To check the signing certificate (validity, CRL and OCSP) see Verify a digital certificate. From PowerShell, the script verifySignature.ps1 of the download verifies PDF, P7M, P7S, XML, Office and ASiC-E files:

powershell -ExecutionPolicy Bypass -File verifySignature.ps1 contract.pdf.p7s -OriginalFile contract.pdf -CheckRevocation

Frequently asked questions