Server signatures

A server signature is a digital signature performed with a private key located on the server, which therefore can be performed entirely on the backend (as opposed to web signatures which must necessarily involve at least one step performed on the frontend).

The way to implement server signatures depends on your programming language. Read one of the sections below accordingly:

.NET applications

The recommended way to implement server signatures on .NET applications is using the PKI SDK.

By importing the .pfx file of the certificate which will be used for signature to the operating system's certificate store, the certificate will be available when loading certificates from the OS store. See article Certificates with private key for more information on how to load certificates from the OS store, and article Signatures for information on how to perform signatures.

Other programming languages

The recommended way to implement server signatures on all other programming languages is using Rest PKI Core.

Your application sends the file and the certificate to Rest PKI Core, which prepares the signature and returns the hash to sign. Your application signs the hash with the certificate's private key, which never leaves your server, and Rest PKI Core completes the signature. See Two-step signatures, and start with Get started. The .NET samples project demonstrates this in PadesServerKeyRestCoreController.cs.

Applications already integrated with Rest PKI, a legacy product that still receives bug and security fixes, can follow its PAdES server key and CAdES server key samples; see the Rest PKI samples availability per project. To move one to Rest PKI Core, see Moving from Rest PKI to Rest PKI Core.