Lua

Sign PDF using PAdES-Baseline-B

See more PDF Signatures Examples

PAdES-Baseline-B is the most basic, entry-level profile of the PDF Advanced Electronic Signatures (PAdES) standard.

It means:

• A PDF contains a CMS/PKCS#7 detached signature over the document’s byte range.
• /SubFilter must be ETSI.CAdES.detached.
• The signer’s X.509 certificate is included inside the signature.
• The signature uses recognized secure algorithms (e.g., SHA-256 with RSA/ECDSA).
• It proves document integrity (no changes since signing) and signer authenticity (certificate identifies who signed).
• It does not include time-stamps, revocation data (CRL/OCSP), or long-term validation information — those appear only in higher levels (PAdES-Baseline-T, -LT, -LTA).

In short: Baseline-B = a standard PDF digital signature that ensures integrity and origin, but without time or revocation guarantees.

Lua

local chilkat = require("chilkat")

local pdf = chilkat.Pdf.new()

-- Load a PDF to be signed.
local success = pdf:load_file("c:/someDir/my.pdf")
if not success then
    print(pdf.last_error_text)
    return
end

-- Options for signing are specified in JSON.
local json = chilkat.JsonObject.new()

json:update_string("subFilter", "/ETSI.CAdES.detached")
json:update_bool("signingCertificateV2", true)
json:update_bool("signingTime", true)
json:update_string("signingAlgorithm", "pkcs")
json:update_string("hashAlgorithm", "sha256")

-- -----------------------------------------------------------
-- The following JSON settings define the signature appearance.
json:update_int("page", 1)
json:update_string("appearance.y", "top")
json:update_string("appearance.x", "left")
json:update_string("appearance.fontScale", "10.0")
json:update_string("appearance.text[0]", "Digitally signed by: cert_cn")
json:update_string("appearance.text[1]", "current_dt")
json:update_string("appearance.text[2]", "Hello 123 ABC")

-- --------------------------------------------------------------
-- Load the signing certificate. (Use your own certificate.)
-- Note: There are other methods for using a certificate on an HSM (smartcard or token)
-- or from other sources, such as a cloud HSM, a Windows installed certificate,
-- or other file formats.
local cert = chilkat.Cert.new()
success = cert:load_pfx_file("c:/myPfxFiles/myPdfSigningCert.pfx", "pfxPassword")
if not success then
    print(cert.last_error_text)
    return
end

-- Once we have the certificate object, tell the PDF object to use it for signing
success = pdf:set_signing_cert(cert)
if not success then
    print(pdf.last_error_text)
    return
end

-- Sign the PDF, creating the output file.
local outFilePath = "c:/someDir/mySigned.pdf"
success = pdf:sign_pdf(json, outFilePath)
if not success then
    print(pdf.last_error_text)
    return
end

print("Success.")