PHPackages                             tecnickcom/tc-lib-pdf-sign - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [PDF & Document Generation](/categories/documents)
4. /
5. tecnickcom/tc-lib-pdf-sign

ActiveLibrary[PDF & Document Generation](/categories/documents)

tecnickcom/tc-lib-pdf-sign
==========================

PHP library to create and embed digital signatures (PKCS#7 / CAdES / PAdES) in PDF documents

1.1.4(2w ago)051.6k↑300.9%1[1 issues](https://github.com/tecnickcom/tc-lib-pdf-sign/issues)3LGPL-3.0-or-laterPHPPHP >=8.2CI passing

Since Jul 16Pushed 2w agoCompare

[ Source](https://github.com/tecnickcom/tc-lib-pdf-sign)[ Packagist](https://packagist.org/packages/tecnickcom/tc-lib-pdf-sign)[ Docs](https://tcpdf.org)[ GitHub Sponsors](https://github.com/sponsors/tecnickcom)[ RSS](/packages/tecnickcom-tc-lib-pdf-sign/feed)WikiDiscussions main Synced 1w ago

READMEChangelogDependencies (4)Versions (7)Used By (3)

tc-lib-pdf-sign
===============

[](#tc-lib-pdf-sign)

> Digital signature primitives for PDF documents (PKCS#7, CAdES, PAdES).

[![Latest Stable Version](https://camo.githubusercontent.com/fb0bfea4b1211a6bf56b7d88c44dbb367af519bb76805e057704010ba133709e/68747470733a2f2f706f7365722e707567782e6f72672f7465636e69636b636f6d2f74632d6c69622d7064662d7369676e2f76657273696f6e)](https://packagist.org/packages/tecnickcom/tc-lib-pdf-sign)[![Build](https://github.com/tecnickcom/tc-lib-pdf-sign/actions/workflows/check.yml/badge.svg)](https://github.com/tecnickcom/tc-lib-pdf-sign/actions/workflows/check.yml)[![Coverage](https://camo.githubusercontent.com/0041aba64bc4f628afe6d46e9fc8554e1c25b63ca5928715af236fda32a3b36c/68747470733a2f2f636f6465636f762e696f2f67682f7465636e69636b636f6d2f74632d6c69622d7064662d7369676e2f67726170682f62616467652e7376673f746f6b656e3d5076314d4e4833583376)](https://codecov.io/gh/tecnickcom/tc-lib-pdf-sign)[![License](https://camo.githubusercontent.com/cd631a1d64004875d1cc5280f57031d4da0761effd2b653109ffdc2f6462e6a6/68747470733a2f2f706f7365722e707567782e6f72672f7465636e69636b636f6d2f74632d6c69622d7064662d7369676e2f6c6963656e7365)](https://packagist.org/packages/tecnickcom/tc-lib-pdf-sign)[![Downloads](https://camo.githubusercontent.com/c2dbf00d3827b301b7ec13f2e3f1b46660ef55f9b5ee7705221d6b5f1401602f/68747470733a2f2f706f7365722e707567782e6f72672f7465636e69636b636f6d2f74632d6c69622d7064662d7369676e2f646f776e6c6f616473)](https://packagist.org/packages/tecnickcom/tc-lib-pdf-sign)

[![Sponsor on GitHub](https://camo.githubusercontent.com/dd89cb32d6e7ff9dbb0fa7ce84923567358b220feb9198b3720beabc3153da6a/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f73706f6e736f722d6769746875622d4541344141412e7376673f6c6f676f3d67697468756273706f6e736f7273266c6f676f436f6c6f723d7768697465)](https://github.com/sponsors/tecnickcom)

> 💖 Part of the [tc-lib-pdf / TCPDF](https://github.com/tecnickcom/tc-lib-pdf) ecosystem (100M+ installs). [Sponsor its maintenance →](https://github.com/sponsors/tecnickcom)

---

Overview
--------

[](#overview)

`tc-lib-pdf-sign` provides the cryptographic building blocks and PDF signature objects used by `tc-lib-pdf` to produce signed PDF documents. The crypto and the PDF object generation live here, while the host library keeps the ByteRange placement, the incremental update writer, and the public facade.

The package assembles CMS/CAdES signatures natively in pure PHP (via a small DER ASN.1 codec), so it can embed the ESS `signing-certificate-v2` attribute that `openssl_pkcs7_sign()` cannot add. This is what lifts a plain PKCS#7 signature to a PAdES baseline signature.

**Namespace**`\Com\Tecnick\Pdf\Sign`**Author**Nicola Asuni **License**[GNU LGPL v3](https://www.gnu.org/copyleft/lesser.html) - see [LICENSE](LICENSE)**API docs****Packagist**---

Features
--------

[](#features)

Signature profiles (each level builds on the previous one):

Profile/SubFilterWhat it provides**Legacy**`adbe.pkcs7.detached`ISO 32000-1 detached CMS (now carrying the ESS `signing-certificate-v2` attribute).**PAdES B-B**`ETSI.CAdES.detached`CAdES-based CMS with `content-type`, `message-digest`, and `signing-certificate-v2` signed attributes.**PAdES B-T**`ETSI.CAdES.detached`B-B plus an RFC 3161 signature timestamp embedded as the `id-aa-signatureTimeStampToken` unsigned attribute.**PAdES B-LT**`ETSI.CAdES.detached`B-T plus a Document Security Store (`/DSS`, `/VRI`) with certificate, OCSP, and CRL validation material.**PAdES B-LTA**`ETSI.CAdES.detached` + `ETSI.RFC3161`B-LT plus a `/Type /DocTimeStamp` archive timestamp for long-term archival.- RSA and ECDSA signing keys, with SHA-256, SHA-384, or SHA-512 digests.
- Both the local (private key) and the external/remote (HSM) signing workflows are supported through the `tc-lib-pdf` facade, which builds on these primitives.
- The PAdES baseline output has been validated against the [EU DSS](https://ec.europa.eu/digital-building-blocks/sites/display/DIGITAL/Digital+Signature+Service+-++DSS) reference validator (B-B, B-T, B-LT, B-LTA all report the expected baseline level).

---

Components
----------

[](#components)

ComponentResponsibility`Config`Immutable signature configuration (profile, digest algorithm, certification level) with `/SubFilter` derivation.`Signer`Orchestration entry point: builds the detached CAdES CMS and collects the LTV material, tying the pieces below together.`Cms\Builder`Native detached CAdES-BES `SignedData` builder (signs the DER signed attributes with `openssl_sign()`).`Cms\Asn1`Minimal DER ASN.1 encoder/decoder for CMS, RFC 3161, and OCSP structures.`Timestamp\Client` / `Timestamp\Config`RFC 3161 timestamp request/response codec.`Ocsp\Client`RFC 6960 OCSP request builder and response fetcher.`Ltv\ValidationMaterial`DSS material collection: certificate dedup, AIA/CRL-DP URL extraction, OCSP/CRL retrieval.`Output\Signature`The `/Sig` value dictionary, including the `/ByteRange` and `/Contents` placeholders.`Output\Widget`Signature and empty-field widget annotations.`Output\Dss`DSS/VRI object emitter.`Output\DocTimeStamp`The `/Type /DocTimeStamp` value object (B-LTA).`Output\PdfString`Shared PDF string-token encoder.`Exception`Library exception type.### Design

[](#design)

The codecs are pure and perform no file or network access. HTTP transports (TSA, OCSP, CRL) and key loading are injected by the host as callables, so the consuming application owns networking and SSRF protection. This keeps the package deterministic and testable, and lets the host reuse its existing HTTP stack and URL allow-list.

---

Requirements
------------

[](#requirements)

- PHP 8.2 or later
- Extensions: `hash`, `openssl`
- Composer

---

Installation
------------

[](#installation)

```
composer require tecnickcom/tc-lib-pdf-sign
```

This package is normally pulled in transitively by `tc-lib-pdf`; install it directly only when you need the low-level primitives on their own.

---

Usage
-----

[](#usage)

For signing PDF documents, use the `tc-lib-pdf` fluent `signature()` facade, which drives this package end to end:

```
$pdf->signature()->configure([
    'profile'          => 'pades-b-t',   // legacy | pades-b-b | pades-b-t | pades-b-lt | pades-b-lta
    'digest_algorithm' => 'sha256',      // sha256 | sha384 | sha512
    'signcert'         => 'file:///path/to/cert.pem',
    'privkey'          => 'file:///path/to/key.pem',
    'password'         => '',
]);
```

See the full guide in [`tc-lib-pdf/doc/DIGITAL_SIGNATURES.md`](https://github.com/tecnickcom/tc-lib-pdf/blob/main/doc/DIGITAL_SIGNATURES.md) and the runnable `E007`/`E008`/`E009`/`E081` signature examples in `tc-lib-pdf`.

### Low-level: building a detached CMS

[](#low-level-building-a-detached-cms)

`Cms\Builder` produces a detached CAdES-BES CMS over arbitrary bytes (the host supplies the ByteRange-covered content). It is the core of PAdES B-B:

```