Click or drag to resize
Pdf Library for .NET

PdfPkcs11Signer Class

Signs with a private key held by a PKCS#11 device - a hardware security module (HSM), a smart card or a USB token - through the device vendor's PKCS#11 library.
Inheritance Hierarchy
SystemObject
  SelectPdf.UniversalPdfPkcs11Signer

Namespace: SelectPdf.Universal
Assembly: SelectPdf.Universal (in SelectPdf.Universal.dll) Version: 26.5
Syntax
Copy
public sealed class PdfPkcs11Signer : IPdfExternalSigner, 
	IDisposable

The PdfPkcs11Signer type exposes the following members.

Constructors
 NameDescription
Public methodPdfPkcs11Signer(String, String, String, String) Creates a signer for a key on a PKCS#11 token, reading its certificate from the token.
Public methodPdfPkcs11Signer(String, String, String, String, IListByte) Creates a signer for a key on a PKCS#11 token, with certificates given by the caller - for a token that holds the key but not its certificate or chain.
Top
Properties
 NameDescription
Public propertyCertificates Gets the certificates embedded in the signature, each DER-encoded: the signing certificate first, then the certificates of its issuers.
Top
Methods
 NameDescription
Public methodDispose Closes the session on the token (the token logs out when its last session closes) and unloads the vendor library when no other signer uses it.
Public methodSign Signs the request with the key on the token.
Top
Remarks

The signer loads the vendor library, opens a session on the token with the given label, logs in with the PIN and finds the private key with the given label. The signing certificate is read from the token (the certificate with the key's identifier) unless the certificates are given, and the issuer certificates are completed from the token, the system stores and the issuers' download locations. The session stays open until the signer is disposed, so one signer can sign any number of documents.

RSA keys (PKCS#1 v1.5) and ECDSA keys are supported. A key that requires the PIN for every signature (a qualified signature card, for example) is given the PIN again for each signature.

The vendor library must match the process: a 64-bit application needs the vendor's 64-bit library. Common locations: C:\Windows\System32\eTPKCS11.dll (SafeNet), /usr/lib/softhsm/libsofthsm2.so (SoftHSM), /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so (OpenSC).

Example
Copy
using (var signer = new PdfPkcs11Signer(
    @"C:\Windows\System32\eTPKCS11.dll", "1234", "My Token", "Signing key"))
{
    PdfSecurityManager manager = new PdfSecurityManager();
    manager.Load("contract.pdf");
    manager.Sign(signer, "Signature1");
    manager.Save("contract-signed.pdf");
}
See Also