Egov.MServices.DataSigning 10.0.1

Egov.MServices.DataSigning

A .NET library that signs PDF documents through a remote HSM (Hardware Security Module) SOAP service. It is built for ASP.NET Core 10.0+ applications and integrates with the eGov platform's shared certificate configuration.

Table of Contents

• Features
• Prerequisites
• Installation
• Configuration
• Usage
• Health Checks
• Disabling Signing
• Contributing
• Code of Conduct
• AI Assistance
• License

Features

• PDF signing via a remote HSM service over SOAP
• Mutual TLS with client certificate and intermediate certificate chain support
• A no-op signer for local development and test environments
• Built-in ASP.NET Core health check
• Async-first API design

Prerequisites

• .NET 10.0 SDK or later
• Network access to the HSM signing endpoint
• A client certificate (.pfx) authorized by the HSM service

Installation

dotnet add package Egov.MServices.DataSigning

Configuration

Add a PdfSigner section to appsettings.json:

{
  "PdfSigner": {
    "Disabled": false,
    "EndpointAddress": "https://hsm.example.gov.md/SigningService.svc",
    "SignerEntity": "My Institution",
    "SignerIdentity": "1002600000000",
    "ClientCertificatePath": "certs/client.pfx",
    "ClientCertificatePassword": "<password>"
  }
}

Store the certificate password in a secret store (user secrets, Key Vault, or environment variables) rather than in appsettings.json.

Usage

Registering the signer

using Egov.MServices.DataSigning;

builder.Services.AddPdfSigner(builder.Configuration.GetSection("PdfSigner"));

Or configure in code:

builder.Services.AddPdfSigner(options =>
{
    options.EndpointAddress = "https://hsm.example.gov.md/SigningService.svc";
    options.SignerEntity = "My Institution";
});

Signing a document

public class ReportService(IPdfSigner signer)
{
    public async Task<byte[]> SignAsync(byte[] pdf)
    {
        if (!signer.Enabled)
        {
            return pdf;
        }

        return await signer.Sign(pdf);
    }
}

Health Checks

builder.Services.AddHealthChecks()
    .AddPdfSignerHealthCheck();

The check is registered under the name PdfSigner.

Disabling Signing

For local development and integration tests where no HSM is reachable, register the no-op signer:

builder.Services.AddNoopPdfSigner();

Alternatively, set PdfSigner:Disabled to true — IPdfSigner.Enabled then reports false and documents pass through unsigned.

Contributing

See CONTRIBUTING.md.

Code of Conduct

See CODE_OF_CONDUCT.md.

AI Assistance

See AGENTS.md for guidance aimed at AI coding assistants.

License

Distributed under the MIT License. See LICENSE.