Delphi DLL

Sign PDF using PAdES-Baseline-B

See more PDF Signatures Examples

PAdES-Baseline-B is the most basic, entry-level profile of the PDF Advanced Electronic Signatures (PAdES) standard.

It means:

• A PDF contains a CMS/PKCS#7 detached signature over the document’s byte range.
• /SubFilter must be ETSI.CAdES.detached.
• The signer’s X.509 certificate is included inside the signature.
• The signature uses recognized secure algorithms (e.g., SHA-256 with RSA/ECDSA).
• It proves document integrity (no changes since signing) and signer authenticity (certificate identifies who signed).
• It does not include time-stamps, revocation data (CRL/OCSP), or long-term validation information — those appear only in higher levels (PAdES-Baseline-T, -LT, -LTA).

In short: Baseline-B = a standard PDF digital signature that ensures integrity and origin, but without time or revocation guarantees.

Delphi DLL

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Pdf, Cert, JsonObject;

...

procedure TForm1.Button1Click(Sender: TObject);
var
success: Boolean;
pdf: HCkPdf;
json: HCkJsonObject;
cert: HCkCert;
outFilePath: PWideChar;

begin
success := False;

pdf := CkPdf_Create();

// Load a PDF to be signed.
success := CkPdf_LoadFile(pdf,'c:/someDir/my.pdf');
if (success = False) then
  begin
    Memo1.Lines.Add(CkPdf__lastErrorText(pdf));
    Exit;
  end;

// Options for signing are specified in JSON.
json := CkJsonObject_Create();

CkJsonObject_UpdateString(json,'subFilter','/ETSI.CAdES.detached');
CkJsonObject_UpdateBool(json,'signingCertificateV2',True);
CkJsonObject_UpdateBool(json,'signingTime',True);
CkJsonObject_UpdateString(json,'signingAlgorithm','pkcs');
CkJsonObject_UpdateString(json,'hashAlgorithm','sha256');

// -----------------------------------------------------------
// The following JSON settings define the signature appearance.
CkJsonObject_UpdateInt(json,'page',1);
CkJsonObject_UpdateString(json,'appearance.y','top');
CkJsonObject_UpdateString(json,'appearance.x','left');
CkJsonObject_UpdateString(json,'appearance.fontScale','10.0');
CkJsonObject_UpdateString(json,'appearance.text[0]','Digitally signed by: cert_cn');
CkJsonObject_UpdateString(json,'appearance.text[1]','current_dt');
CkJsonObject_UpdateString(json,'appearance.text[2]','Hello 123 ABC');

// --------------------------------------------------------------
// Load the signing certificate. (Use your own certificate.)
// Note: There are other methods for using a certificate on an HSM (smartcard or token)
// or from other sources, such as a cloud HSM, a Windows installed certificate,
// or other file formats.
cert := CkCert_Create();
success := CkCert_LoadPfxFile(cert,'c:/myPfxFiles/myPdfSigningCert.pfx','pfxPassword');
if (success = False) then
  begin
    Memo1.Lines.Add(CkCert__lastErrorText(cert));
    Exit;
  end;

// Once we have the certificate object, tell the PDF object to use it for signing
success := CkPdf_SetSigningCert(pdf,cert);
if (success = False) then
  begin
    Memo1.Lines.Add(CkPdf__lastErrorText(pdf));
    Exit;
  end;

// Sign the PDF, creating the output file.
outFilePath := 'c:/someDir/mySigned.pdf';
success := CkPdf_SignPdf(pdf,json,outFilePath);
if (success = False) then
  begin
    Memo1.Lines.Add(CkPdf__lastErrorText(pdf));
    Exit;
  end;

Memo1.Lines.Add('Success.');

CkPdf_Dispose(pdf);
CkJsonObject_Dispose(json);
CkCert_Dispose(cert);

end;