(PowerShell) Sign PDF in PAdES (ETSI EN 319 142) standard

See more PDF Signatures Examples

Chilkat can sign PDF's to satisfy any of the different PDF signing levels, such as:

PAdES-Baseline: This is the basic level of PAdES compliance. It specifies the minimum requirements for creating an advanced electronic signature in a PDF document. PAdES-Baseline signatures typically include the signature itself, signer's identity information, and certificate validation data.

PAdES-B: PAdES-B is an extension of PAdES-Baseline that adds support for time-stamping the signature. Time-stamping ensures that the signature remains valid even after the expiration of the signer's certificate.

PAdES-LTV (Long-Term Validation), PAdES-LTA: PAdES-LTV adds additional features to ensure the long-term validity and integrity of signatures. It includes mechanisms for embedding validation-related information, such as certificate revocation status and validation policies, directly into the PDF document. This allows the signature to be validated even if the signer's certificate has expired or been revoked.

PAdES-T: PAdES-T is similar to PAdES-B, but it requires the use of a secure time-stamp from a trusted time-stamping authority. This provides additional assurance of the signature's time validity.

PAdES-C: PAdES-C adds support for multiple signers to sign the same PDF document sequentially or concurrently.

PAdES-X: PAdES-X is an extension of PAdES-Baseline that adds support for the use of external signature policies. External signature policies define additional requirements and constraints for creating and validating signatures.

Chilkat .NET Downloads Chilkat .NET Assemblies

Add-Type -Path "C:\chilkat\ChilkatDotNet47-9.5.0-x64\ChilkatDotNet47.dll"

$pdf = New-Object Chilkat.Pdf

# Load a PDF to be signed.
$success = $pdf.LoadFile("c:/someDir/my.pdf")
if ($success -eq $false) {
    $($pdf.LastErrorText)
    exit
}

# Options for signing are specified in JSON.
$json = New-Object Chilkat.JsonObject

# ---------------------------------------------------------------------
# The JSON signing attributes are what controls the level of 
# PAdES signature produced (i.e. PAdES-LTV, PAdES-B-LTA, etc)
# 
# The best way to know what attributes to provide, and the values for
# for each attribute, is to find an already signed PDF that meets your 
# requirements, and pass it to Chilkat's online tool at Generate PDF Signing Code
# The online tool will analyze the signed PDF and will generate code with the
# JSON signing attributes that will produce a signed PDF with the same features.
$json.UpdateString("subFilter","/ETSI.CAdES.detached")
$json.UpdateBool("signingCertificateV2",$true)
$json.UpdateString("signingAlgorithm","pkcs")
$json.UpdateString("hashAlgorithm","sha256")

# -----------------------------------------------------------
# The following JSON settings define the signature appearance.
$json.UpdateInt("page",1)
$json.UpdateString("appearance.y","top")
$json.UpdateString("appearance.x","left")
$json.UpdateString("appearance.fontScale","10.0")
$json.UpdateString("appearance.text[0]","Digitally signed by: cert_cn")
$json.UpdateString("appearance.text[1]","current_dt")
$json.UpdateString("appearance.text[2]","Hello 123 ABC")

# --------------------------------------------------------------
# Load the signing certificate. (Use your own certificate.)
# Note: There are other methods for using a certificate on an HSM (smartcard or token)
# or from other sources, such as a cloud HSM, a Windows installed certificate,
# or other file formats.
$cert = New-Object Chilkat.Cert
$success = $cert.LoadPfxFile("c:/myPfxFiles/myPdfSigningCert.pfx","pfxPassword")
if ($success -eq $false) {
    $($cert.LastErrorText)
    exit
}

# Once we have the certificate object, tell the PDF object to use it for signing
$success = $pdf.SetSigningCert($cert)
if ($success -eq $false) {
    $($pdf.LastErrorText)
    exit
}

# Sign the PDF, creating the output file.
$outFilePath = "c:/someDir/mySigned.pdf"
$success = $pdf.SignPdf($json,$outFilePath)
if ($success -eq $false) {
    $($pdf.LastErrorText)
    exit
}

$("Success.")