Table of Contents

Class PdfSigner

Namespace
LMKit.Document.Pdf
Assembly
LM-Kit.NET.dll

Digitally signs PDF documents. Signing appends an incremental revision, so the original bytes survive verbatim and existing signatures keep verifying: signing an already-signed document simply adds the next signature.

public static class PdfSigner
Inheritance
PdfSigner
Inherited Members

Examples

using LMKit.Document.Pdf;

var options = new PdfSigningOptions
{
    Certificate = certificateWithPrivateKey,
    Reason = "Approved",
};

PdfSigner.Sign("contract.pdf", "contract-signed.pdf", options);

Remarks

One-call signing takes an X509Certificate2 whose private key may live anywhere the BCL reaches: a PFX file, the OS certificate store, or hardware-backed storage. For keys this process must never touch, BeginSign(byte[], PdfSigningOptions, CancellationToken) prepares the document and an external service produces the CMS container.

Verify results with PdfSignatureValidator.

Methods

AddDocumentTimestamp(byte[], PdfTimestampOptions, CancellationToken)

Appends an RFC 3161 document timestamp (subfilter ETSI.RFC3161): an authority attests the entire current document, existing signatures included. The revision is incremental, so those signatures keep verifying.

AddDocumentTimestampAsync(byte[], PdfTimestampOptions, CancellationToken)

Appends an RFC 3161 document timestamp (subfilter ETSI.RFC3161): an authority attests the entire current document, existing signatures included. The revision is incremental, so those signatures keep verifying.

BeginSign(byte[], PdfSigningOptions, CancellationToken)

Prepares a signing pass without producing the signature: the returned session carries the incremental revision with its placeholder, the byte ranges, and the digest an external signer must attest. Complete it with Complete(byte[]).

BeginSignAsync(byte[], PdfSigningOptions, CancellationToken)

Prepares a signing pass without producing the signature: the returned session carries the incremental revision with its placeholder, the byte ranges, and the digest an external signer must attest. Complete it with Complete(byte[]).

ExtendLtv(byte[], PdfLtvOptions, CancellationToken)

Embeds long-term validation material into the document security store (/DSS) as an incremental revision: the certificates and CRLs the signatures carry, plus anything supplied through options. A document extended this way validates fully offline. Existing signatures keep verifying.

ExtendLtvAsync(byte[], PdfLtvOptions, CancellationToken)

Embeds long-term validation material into the document security store (/DSS) as an incremental revision: the certificates and CRLs the signatures carry, plus anything supplied through options. A document extended this way validates fully offline. Existing signatures keep verifying.

Sign(byte[], PdfSigningOptions, CancellationToken)

Signs a PDF and returns the signed document.

Sign(byte[], byte[], string, PdfSigningOptions, CancellationToken)

Signs a PDF with a PKCS#12 (PFX) bundle handled entirely by the managed engine: no operating-system key store is touched, which makes this the path for the browser (where platform crypto is unavailable) and for hosts that must not import keys. The bundle's extra certificates are embedded as the chain.

Sign(string, string, PdfSigningOptions, CancellationToken)

Signs a PDF file and writes the signed document.

SignAsync(byte[], PdfSigningOptions, CancellationToken)

Signs a PDF and returns the signed document.

SignAsync(byte[], byte[], string, PdfSigningOptions, CancellationToken)

Signs a PDF with a PKCS#12 (PFX) bundle handled entirely by the managed engine: no operating-system key store is touched, which makes this the path for the browser (where platform crypto is unavailable) and for hosts that must not import keys. The bundle's extra certificates are embedded as the chain.

SignAsync(string, string, PdfSigningOptions, CancellationToken)

Signs a PDF file and writes the signed document.

Share