Signing pdf with external Signed Hash and certificate in c#?

Question

enter image description hereI have SignedHash and certificate to sign the pdf file. The Signedhash and Certificate both received through external services. How to embed SignedHash to the PDF and then verify it with certificate using C#?

// Here we are using Itextsharp

    public static void SignDoc(string inputFilePath, string outputFilePath)
            {
// Open pdf
                using (PdfReader reader = new PdfReader(inputFilePath))
                {
                    using (MemoryStream ms = new MemoryStream())
                    {     
//Code to add new sig appearance           
    BaseFont helvetica = BaseFont.CreateFont(BaseFont.HELVETICA, BaseFont.CP1250, BaseFont.EMBEDDED);
                        Font font = new Font(helvetica, 12, iTextSharp.text.Font.NORMAL);                 
                        PdfStamper stamper = PdfStamper.CreateSignature(reader, ms, '\0');                  
                        PdfSignatureAppearance sap = stamper.SignatureAppearance;
                        sap.Reason = "";
                        sap.Location = "";
                        sap.Contact = "";
                        sap.Layer2Font = font;
// Setting up Visible Sig
             sap.SetVisibleSignature(new iTextSharp.text.Rectangle(415, 100, 585, 40), 1, null);
                var dic = new PdfSignature(PdfName.ADOBE_PPKLITE, PdfName.ADBE_PKCS7_DETACHED);
                        dic.Reason = sap.Reason;
                        dic.Location = sap.Location;
                        dic.Contact = sap.Contact;
                        dic.Date = new PdfDate(sap.SignDate);
                        sap.CryptoDictionary = dic;
                        Dictionary<PdfName, int> exc = new Dictionary<PdfName, int>();
                        exc.Add(PdfName.CONTENTS, (int)(8192 * 2 + 2));
                        sap.PreClose(exc);
                        Stream data = sap.GetRangeStream();
                        //Extract the bytes that need to be signed
                        // Creating hash of pdf with signature appearance
                        byte[] hash = DigestAlgorithms.Digest(data, DigestAlgorithms.SHA256); 

// Calling third party digidenty service for Cert as well as SignHash
    var signedDocResp = SignUtility.GetSignHashAndCertificate(BitConverter.ToString(hash).Replace("-", "").ToLowerInvariant());
                        X509Certificate2 cert2 = new X509Certificate2(Encoding.Unicode.GetBytes(signedDocResp.Certificate));
                        var cert = new Org.BouncyCastle.X509.X509CertificateParser().ReadCertificate(cert2.GetRawCertData());
                        var chain = new List<Org.BouncyCastle.X509.X509Certificate>() { cert };
                       PdfPKCS7 sgn = new PdfPKCS7(null, chain, DigestAlgorithms.SHA256, false);
    byte[] sh = sgn.getAuthenticatedAttributeBytes(Encoding.Unicode.GetBytes(signedDocResp.SignedHash), null, null, CryptoStandard.CMS);
                        sgn.SetExternalDigest(Encoding.Unicode.GetBytes(signedDocResp.SignedHash), null, "RSA");
             byte[] encodedSig = sgn.GetEncodedPKCS7(sh, null, null, null, CryptoStandard.CMS);
                        byte[] paddedSig = new byte[8192];
                        encodedSig.CopyTo(paddedSig, 0);
                        PdfDictionary dic2 = new PdfDictionary();
                        dic2.Put(PdfName.CONTENTS, new PdfString(paddedSig).SetHexWriting(true));
                        sap.Close(dic2);
                        byte[] signed = ms.ToArray();              
                        File.WriteAllBytes(outputFilePath, signed);
                    }
                }
            }

Answer 1

There are multiple pdf libraries for C# (core or otherwise that can help you with that).

Example by IronPDF (paid for production/free for development)

// PM> Install-Package IronPdf
using IronPdf;
 
// Cryptographically sign an existing PDF in 1 line of code!
new IronPdf.Signing.PdfSignature("Iron.p12", "123456").SignPdfFile("any.pdf");
 
 
/***** Advanced example for more control *****/
 
// Step 1. Create a PDF
var Renderer = new IronPdf.ChromePdfRenderer();
using PdfDocument doc = Renderer.RenderHtmlAsPdf("<h1>Testing 2048 bit digital security</h1>");
 
// Step 2. Create a Signature.
// You may create a .pfx or .p12 PDF signing certificate using Adobe Acrobat Reader. 
// Read: https://helpx.adobe.com/acrobat/using/digital-ids.html
 
var signature = new IronPdf.Signing.PdfSignature("Iron.pfx", "123456");
 
// Step 3. Optional signing options and a handwritten signature graphic
signature.SigningContact = "support@ironsoftware.com";
signature.SigningLocation = "Chicago, USA";
signature.SigningReason = "To show how to sign a PDF";
signature.LoadSignatureImageFromFile("handwriting.png");
 
//Step 4. Sign the PDF with the PdfSignature. Multiple signing certificates may be used
doc.SignPdfWithDigitalSignature(signature);
 
//Step 4. The PDF is not signed until saved to file, steam or byte array.
doc.SaveAs("signed.pdf");

Example by iTextSharp (free) - Adding a Digital signature to a PDF with iTextSharp

More options here. All libraries that sign, also have a method to validate. Just check the documentation.