Overview
Contracts, invoices and approvals are only worth something when the recipient can trust them: that they come from the stated sender and haven't been changed on the way. Digital signatures provide this proof inside a PDF document, where it travels with the file and can be checked by anyone. TX Text Control .NET Server creates them on the server when it saves a document. Read on for the concepts behind signatures, the parts of TX Text Control that take part in signing and the workflows that combine them.
The steps from a hash to a verified signature, and a first signed PDF, are part of Digitally Sign a PDF in Getting Started.
What a Digital Signature Proves
A digital signature has two advantages over a document without one:
- Integrity. Any change to the document after signing makes the signature invalid, and validators report it.
- Authenticity. The certificate of the signature identifies the signer. Recipients trust it when a certificate authority (CA) that they trust issued the certificate; self-signed certificates are for tests and internal use.
A signature doesn't prove when a document was signed. For that, it needs a trusted timestamp, as RFC 3161 Timestamps explains.
Signatures and passwords protect different things. Encryption answers the question "Who can read this document?", a signature the question "Has this document been changed, and who signed it?":
| Encryption with a password | Digital signature | |
|---|---|---|
| Hides the content | Yes | No |
| Requires a password to open | Yes | No |
| Restricts actions | With permissions | No |
| Detects changes to the document | No | Yes |
| Verifies the signer | No | Yes |
A document can be encrypted without being signed and signed without being encrypted, and secure workflows often use both. Unlike a hash of the file stored in your own database, a signature is part of the document, so recipients and PDF readers can check it without access to your systems.
Electronic and Digital Signatures
The two terms are often mixed up, and TX Text Control handles both:
- An electronic signature is the image of a signature in a document: drawn with a mouse or finger, typed or uploaded. It isn't necessarily secured cryptographically. In the Document Viewer, users create electronic signatures in the signature boxes of a document, as Digital Signatures in Document Viewer describes.
- A digital signature combines the document with a certificate that identifies the signer and is secured cryptographically. TX Text Control applies it on the server.
In practice, the two are often combined: users sign a visible signature field electronically, and the server signs the field digitally with a certificate. A visible signature isn't required, though. A digital signature of the whole document has no visible representation in the document.
Legal frameworks such as eIDAS in the European Union and the ESIGN Act in the United States define levels of electronic signatures. PAdES introduces the levels and the parts of a signing process that your application provides.
What TX Text Control Signs
A digital signature is created when a document is saved as PDF or PDF/A. For all other formats, the signature settings have no meaning, so DOCX, RTF, HTML and TX Text Control files don't get a digital signature. Signature fields are saved with the TX Text Control format, DOCX and RTF as well, but a certificate is applied only when the document is saved as PDF.
There are two ways to sign:
- The whole document. One invisible signature covers the complete document, for example when a company certifies a generated contract or invoice. Signing PDF Documents describes it.
- Signature fields. Each named signature field gets its own certificate and shows a visible signature, for example when several parties sign. Signature Fields and Multiple Signatures describe them.
Signing PDF and PDF/A documents was introduced in version 17.0, signature fields in version 31.0. Both engines provide the same API: the Core engine signs on Windows and Linux, the Classic engine on Windows.
The Building Blocks
| Part | Role | Described in |
|---|---|---|
| DigitalSignature | Holds the certificate, the time server URL and, for signature fields, the field name | Certificate-Based Signatures |
| SaveSettings.DigitalSignature | Signs the whole document when it's saved | Signing PDF Documents |
| SaveSettings.SignatureFields, SignatureField, SignerData, SignatureImage | Sign named signature fields, with images and data about the signer | Signature Fields |
| Document Editor | Lets users insert and name signature fields | Signature Fields in Document Editor |
| Document Viewer, SignatureData | Collects electronic signatures from users; the viewer's controller posts the signed document to your endpoint | Digital Signatures in Document Viewer |
TXTextControl.PDF.Validation | Checks the integrity of the signatures of a PDF in code | Signature Validation |
Signing is usually a server-side task: the server is a safe place for the certificate with its private key, and the browser components never receive it.
Typical Workflows
- Generate and sign. A document is generated from a DOCX template, merged with data, exported as PDF and signed. When the content is confidential, it's also encrypted with a user password and restricted with permissions before it's delivered or archived.
- Collect signatures, then certify. Signature fields are placed in a template in the Document Editor or in code. Users sign them electronically in the Document Viewer, and the server applies a certificate to each field and saves the result, often as PDF/A. Starting from an editable DOCX template instead of a finished PDF keeps the document open for review until it's signed.
- Archive for the long term. Documents are signed with a certificate from a trusted CA and a trusted timestamp, archived without any modification and checked when they're received.
- Seal electronic invoices. The XML of an electronic invoice is embedded in a PDF/A-3 document, which is then signed and archived, so that changes to the pages or the XML are detectable.
The open-source e-signature application SignFabric shows a complete signing platform built with TX Text Control, with certificates from PFX files or Azure Key Vault, audit logging and validation. The blog article Introducing SignFabric describes it.
Next Steps
- Signing PDF Documents: sign generated documents on the server.
- Signature Fields: create and sign visible signature fields.
- Certificate-Based Signatures: load and manage signing certificates.
- Signature Validation: check signed documents.