-
Classes
- AcroForm
- ActionBase
- ActionFieldsBase
- ActionGoTo
- ActionGoToR
- ActionHide
- ActionImportData
- ActionJavaScript
- ActionJavaScriptMap
- ActionLaunch
- ActionLaunchWinAttrs
- ActionNamed
- ActionResetForm
- ActionSound
- ActionSubmitForm
- ActionUnknown
- ActionUri
- AnnotationBase
- AnnotationCollection
- AnnotationPagesCollection
- AppearanceStream
- AppearanceStreams
- AssociatedFiles
- Attr
- AttrClsRevision
- AttrClsRevisionCollection
- AttrCollection
- AttrRevision
- AttrRevisionCollection
- BilevelBitmap
- Bitmap
- BmpContext
- Border
- BorderEffect
- Brush
- ButtonAppearance
- CaretAnnotation
- CheckBoxField
- ChoiceField
- CircleAnnotation
- ClassMap
- ComboBoxField
- CombTextField
- ContentItemLink
- ContentItemLinkCollection
- DefaultAppearance
- Destination
- DestinationBase
- DestinationFit
- DestinationFitB
- DestinationFitBh
- DestinationFitBv
- DestinationFitH
- DestinationFitR
- DestinationFitV
- DestinationRef
- DestinationUnknown
- DestinationXyz
- DocAction
- DocumentDestinations
- DocumentInfo
- DocumentSecurityStore
- DrawingContext
- DsPdf
- DsPdfConfig
- EmbeddedFileStream
- Field
- FieldCollection
- FieldWidgetCollection
- FileAttachmentAnnotation
- FileInfo
- FileSpecification
- FileSpecificationMap
- Font
- FontCollection
- FontHandler
- FontHandlerCollection
- Format
- FormXObject
- FreeTextAnnotation
- GraphicsPath
- GrayscaleBitmap
- HatchBrush
- IccProfile
- Image
- ImageBrush
- InkAnnotation
- Layout
- LineAnnotation
- LinearGradientBrush
- LinkAnnotation
- ListBoxField
- MarkInfo
- MarkupAnnotation
- McidContentItemLink
- McrContentItemLink
- Metadata
- Model3DAnnotation
- Model3DStream
- Model3DView
- Model3DViewCollection
- Namespace
- NamespaceCollection
- ObjectBase
- ObjectManager
- ObjrContentItemLink
- OutlineNode
- OutlineNodeCollection
- OutputIntent
- OutputIntentCollection
- PageLabelingRange
- PageLabelingRangeMap
- PdfCidFont
- PdfCidFontType0
- PdfCidFontType2
- PdfCidFontUnknown
- PdfCMapTable
- PdfContext
- PdfDocument
- PdfFont
- PdfFontDescriptor
- PdfFontSimple
- PdfFontTrueType
- PdfFontType0
- PdfFontType1
- PdfFontType3
- PdfImageHandler
- PdfImageHandlerCollection
- PdfPage
- PdfPageCollection
- PdfSignature
- Pen
- Pkcs7Signer
- Pkcs7SignerBase
- PolygonAnnotation
- PolygonAnnotationBase
- PolyLineAnnotation
- PopupAnnotation
- PushButtonField
- RadialGradientBrush
- RadioButtonField
- RContentItemLink
- RedactAnnotation
- RichMediaAnnotation
- RoleMap
- Security
- SecurityHandlerBase
- SignatureField
- SolidBrush
- SoundAnnotation
- SoundObject
- SplitOptions
- SquareAnnotation
- StampAnnotation
- StandardSecurityHandler
- StandardSecurityHandlerRev2
- StandardSecurityHandlerRev3
- StandardSecurityHandlerRev4
- StandardSecurityHandlerRev5
- StandardSecurityHandlerRev6
- StructElement
- StructElementCollection
- StructTreeItem
- StructTreeItemCollection
- StructTreeRoot
- SvgContext
- SvgDocument
- TextAnnotation
- TextField
- TextMarkupAnnotation
- TimeStamper
- TimeStampProvider
- Transform
- UnknownAnnotation
- UnknownSecurityHandler
- WatermarkAnnotation
- WidgetAnnotation
- Enumerations
- Functions
- Interfaces
- README
- Index
- TypeAliases
- Variables
Pkcs7Signer
Class: Pkcs7Signer
The implementation of Pkcs7SignerBase, generates a detached PKCS#7 signature using:
- a private key provided in PEM format
- a corresponding certificate chain in PEM format
The first certificate in the chain must be the end-entity (signing) certificate, followed by any intermediate certificates required to build a trust chain.
The private key is used to produce the signature value, while the certificate chain is embedded into the resulting signature container.
Remarks
This class provides a built-in signing implementation. For custom signing scenarios (e.g., remote signing with external services such as HSM or cloud key providers), extend Pkcs7SignerBase.
Extends
Constructors
Constructor
new Pkcs7Signer(): Pkcs7Signer;
Creates a new Pkcs7SignerBase.
Returns
Pkcs7Signer
Inherited from
Accessors
certificateChainPem
Get Signature
get certificateChainPem(): string[];
Gets the certificate chain to embed into the PKCS#7 (CMS) signature.
The chain may contain only the signer's (end-entity) certificate or a full chain including intermediate CA certificates and the root CA certificate.
Providing more certificates increases the likelihood that verifiers can successfully build and validate the trust chain without fetching missing certificates from external sources.
Remarks
When multiple certificates are provided, they should be ordered from the end-entity (signer) certificate up to the root CA certificate.
Returns
string[]
Set Signature
set certificateChainPem(value): void;
Sets the certificate chain to embed into the PKCS#7 (CMS) signature.
The chain may contain only the signer's (end-entity) certificate or a full chain including intermediate CA certificates and the root CA certificate.
Providing more certificates increases the likelihood that verifiers can successfully build and validate the trust chain without fetching missing certificates from external sources.
Remarks
When multiple certificates are provided, they should be ordered from the end-entity (signer) certificate up to the root CA certificate.
Parameters
value
string[]
Returns
void
contactInfo
Get Signature
get contactInfo(): string;
Gets the information provided by the signer to enable a recipient to contact the signer to verify the signature (for example, a phone number).
Returns
string
Set Signature
set contactInfo(value): void;
Sets the information provided by the signer to enable a recipient to contact the signer to verify the signature (for example, a phone number).
Parameters
value
string
Returns
void
Inherited from
crls
Get Signature
get crls(): (string | ArrayBuffer)[];
Gets the collection of certificate revocation lists (CRLs) to use. Items in this collection may be of the following types: ArrayBuffer An encoded CRL list. string The URL of a CRL (e.g. http://crl.cacert.org/revoke.crl).
Returns
(string | ArrayBuffer)[]
Set Signature
set crls(value): void;
Sets the collection of certificate revocation lists (CRLs) to use. Items in this collection may be of the following types: ArrayBuffer An encoded CRL list. string The URL of a CRL (e.g. http://crl.cacert.org/revoke.crl).
Parameters
value
(string | ArrayBuffer)[]
Returns
void
Inherited from
documentAccessPermissions
Get Signature
get documentAccessPermissions(): AccessPermissions;
Gets the information provided by the signer to enable a recipient to contact the signer to verify the signature (for example, a phone number).
Returns
Set Signature
set documentAccessPermissions(value): void;
Sets the information provided by the signer to enable a recipient to contact the signer to verify the signature (for example, a phone number).
Parameters
value
Returns
void
Inherited from
Pkcs7SignerBase.documentAccessPermissions
externalResourcesOptions
Get Signature
get externalResourcesOptions(): ExternalResourcesOptions;
Gets configuration options used to retrieve external X.509-related resources.
These options control how resources such as CRLs, OCSP responses, and TSA data are resolved and fetched, including URL rewriting, custom network handling, and request lifecycle hooks.
Returns
The current external resources configuration, or undefined
if default behavior is used.
Set Signature
set externalResourcesOptions(value): void;
Sets configuration options used to retrieve external X.509-related resources.
This allows customizing how external resources are accessed, for example:
- routing requests through a backend proxy to avoid CORS issues
- providing a custom loader implementation
- handling request/response lifecycle events (logging, caching, etc.)
Parameters
value
The external resources configuration to apply,
or undefined to use the default behavior.
Returns
void
Inherited from
Pkcs7SignerBase.externalResourcesOptions
format
Get Signature
get format(): Pkcs7SignatureFormat;
Gets or sets the PKCS#7 signature format.
Returns
Inherited from
hashAlgorithmOID
Get Signature
get hashAlgorithmOID(): HashAlgorithm;
Gets the object identifier (OID) of hash algorithm used to generate the signature. Note! If format Pkcs7SignatureFormat#adbe_pkcs7_sha1 then this property is ignored and always SHA-1 used.
See
OID.HashAlgorithms
Example
const signer.hashAlgorithm = OID.HashAlgorithms.SHA512;
Returns
Set Signature
set hashAlgorithmOID(value): void;
Sets the object identifier (OID) of hash algorithm used to generate the signature. Note! If format Pkcs7SignatureFormat#adbe_pkcs7_sha1 then this property is ignored and always SHA-1 used.
See
OID.HashAlgorithms
Example
const signer.hashAlgorithm = OID.HashAlgorithms.SHA512;
Parameters
value
Returns
void
includeOcsp
Get Signature
get includeOcsp(): boolean;
Gets a value indicating whether to include OCSP information into the signature.
Returns
boolean
Set Signature
set includeOcsp(value): void;
Sets a value indicating whether to include OCSP information into the signature.
Parameters
value
boolean
Returns
void
Inherited from
location
Get Signature
get location(): string;
Gets the CPU host name or physical location of the signing.
Returns
string
Set Signature
set location(value): void;
Sets the CPU host name or physical location of the signing.
Parameters
value
string
Returns
void
Inherited from
privateKeyPem
Get Signature
get privateKeyPem(): string;
Gets the private key used to generate the digital signature for the PDF document.
The private key must correspond to the public key contained in the signer's certificate included in the PKCS#7 (CMS) signature.
Remarks
The key is expected to be provided in PEM format (e.g., PKCS#8 PEM). It should be handled securely and never exposed or persisted in an unprotected form.
Returns
string
Set Signature
set privateKeyPem(value): void;
Sets the private key used to generate the digital signature for the PDF document.
The private key must correspond to the public key contained in the signer's certificate included in the PKCS#7 (CMS) signature.
Remarks
The key is expected to be provided in PEM format (e.g., PKCS#8 PEM). It should be handled securely and never exposed or persisted in an unprotected form.
Parameters
value
string
Returns
void
reason
Get Signature
get reason(): string;
Gets the reason for the signing, such as "I agree...".
Returns
string
Set Signature
set reason(value): void;
Sets the reason for the signing, such as "I agree...".
Parameters
value
string
Returns
void
Inherited from
signatureAppearance
Get Signature
get signatureAppearance(): SignatureAppearance;
Gets a SignatureAppearance object defining the visual appearance of the generated signature. By default this property is initialized with a default instance of the SignatureAppearance class. If null, the appearance streams of the signature field's widget are left as is (not regenerated during signing).
Returns
Set Signature
set signatureAppearance(value): void;
Sets a SignatureAppearance object defining the visual appearance of the generated signature. By default this property is initialized with a default instance of the SignatureAppearance class. If null, the appearance streams of the signature field's widget are left as is (not regenerated during signing).
Parameters
value
Returns
void
Inherited from
Pkcs7SignerBase.signatureAppearance
signatureField
Get Signature
get signatureField(): Field;
Gets an AcroForm field used to store a digital signature. If SignatureField.Widget is not null, a visual appearance will be generated based on values of the properties signingDateTime, location etc.
Returns
Set Signature
set signatureField(value): void;
Sets an AcroForm field used to store a digital signature. If SignatureField.Widget is not null, a visual appearance will be generated based on values of the properties signingDateTime, location etc.
Parameters
value
Returns
void
Inherited from
Pkcs7SignerBase.signatureField
signerName
Get Signature
get signerName(): string;
Gets the name of the person or authority signing the document. NOTE: This value is used only if it is not possible to extract the name from the signature, for example from the certificate of the signer. By default this property is initialized with: process.env.USER || process.env.USERNAME.
Returns
string
Set Signature
set signerName(value): void;
Sets the name of the person or authority signing the document. NOTE: This value is used only if it is not possible to extract the name from the signature, for example from the certificate of the signer. By default this property is initialized with: process.env.USER || process.env.USERNAME.
Parameters
value
string
Returns
void
Inherited from
signingDateTime
Get Signature
get signingDateTime(): PdfDateTime;
Gets the time of signing. NOTE: This value is used only if the time of signing is not available in the signature. For example, a time stamp can be embedded in a PKCS#7 binary data object. By default this property is initialized with the current date and time.
Returns
Set Signature
set signingDateTime(value): void;
Sets the time of signing. NOTE: This value is used only if the time of signing is not available in the signature. For example, a time stamp can be embedded in a PKCS#7 binary data object. By default this property is initialized with the current date and time.
Parameters
value
Returns
void
Inherited from
Pkcs7SignerBase.signingDateTime
timeStampProvider
Get Signature
get timeStampProvider(): TimeStampProviderBase;
Gets the TimeStampProviderBase object that is used to generate the time-stamp token included in the digital signature of the document.
Returns
Set Signature
set timeStampProvider(value): void;
Sets the TimeStampProviderBase object that is used to generate the time-stamp token included in the digital signature of the document.
Parameters
value
Returns
void
Inherited from
Pkcs7SignerBase.timeStampProvider
Methods
buildSignatureContainer()
buildSignatureContainer(docHash, signParams): Promise<Uint8Array<ArrayBufferLike>>;
Builds a PKCS#7 (CMS) signature container for the specified document byte ranges.
This method implements the third stage of the signing process. It constructs a complete detached signature container by:
- Building the set of signed attributes (e.g. content type, message digest, revocation information, and optional CAdES attributes).
- Generating the signature value.
- Assembling the PKCS#7 SignedData structure, including:
- digest algorithms
- content info
- certificate chain
- signer info
- Optionally embedding CRLs, OCSP responses, and a timestamp token.
The resulting container can be embedded into a PDF signature field.
Parameters
docHash
Uint8Array
The document hash used to calculate signature
signParams
Parameters produced by Pkcs7SignerBase.getSignParams, including certificate chain, revocation data, and additional signing configuration.
Returns
Promise<Uint8Array<ArrayBufferLike>>
A DER-encoded PKCS#7 (CMS) signature container as a Uint8Array.
Throws
May throw if signature generation fails or if the timestamp provider (when configured) fails to produce a valid timestamp token.
Inherited from
Pkcs7SignerBase.buildSignatureContainer
getSignParams()
getSignParams(): Promise<SignParams>;
Prepares parameters required for the first stage of the signing process.
This method performs validation, initializes signing-related data, and collects all inputs required for building the final signature container. It corresponds to the "preparation stage" of signing.
Returns
Promise<SignParams>
A SignParams object containing:
- certificate chain
- CRLs and OCSP responses (if available)
- additional parameters required for signature generation
Throws
If the configured signature format is invalid or unsupported.