esegece.sgcSign.Community 2026.9.0

esegece.sgcSign

Digital signature library for .NET. Sign and verify PDF, XML, CMS and Windows executables with the standard advanced-signature formats, drive a hardware or cloud key without leaving managed code, and emit the country e-invoicing profiles that tax authorities in Europe expect.

Pure managed, no native DLL. Target frameworks: netstandard2.0, net472, net6.0, net8.0, net9.0. netstandard2.0 reaches .NET Framework 4.6.2 and later, Mono and Xamarin; net472 is a dedicated build for the classic desktop framework.

Install

dotnet add package esegece.sgcSign

The free edition is esegece.sgcSign.Community.

Signature formats

Timestamping (RFC 3161) and revocation checking (OCSP and CRL, with an EU Trust List reader) are shared across every format, so a B-T or B-LTA signature is one property away.

Key providers

Every provider implements IsgcKeyProvider, so the signers do not care where the private key lives.

• PFX / PKCS#12 file, TsgcPFXKeyProvider
• PEM certificate + private key, TsgcPEMKeyProvider
• Windows certificate store, TsgcWindowsCertStoreProvider
• PKCS#11 hardware token or HSM, TsgcPKCS11Provider (Windows only)
• AWS KMS, TsgcAWSKMSKeyProvider
• Azure Trusted Signing, TsgcAzureTrustedSigningProvider
• Google Cloud KMS, TsgcGCloudKMSKeyProvider
• HashiCorp Vault, TsgcHashiCorpVaultKeyProvider
• Certum SimplySign, TsgcCertumSimplySignProvider
• CSC (Cloud Signature Consortium API), TsgcCSCKeyProvider

TsgcPKCS11Provider is a real Cryptoki implementation. It loads the PKCS#11 middleware library, resolves the entry points itself and drives C_Initialize, C_OpenSession, C_Login, C_FindObjects, C_SignInit and C_Sign. Two constraints follow from that. The loader is Win32 (LoadLibraryW and GetProcAddress), so the provider runs on Windows only, and it needs the vendor middleware DLL for your token. Set LibraryPath and PIN, plus SlotIndex or CertificateLabel when the slot or certificate has to be chosen explicitly. Failures are raised as EsgcPKCS11Error.

E-invoicing and fiscal profiles

Set one TsgcSignatureProfile value and the signer applies the hash, canonicalization, signature level, policy identifier and placement that the scheme requires:

VeriFactu, TicketBAI (plus the Araba, Bizkaia and Gipuzkoa variants), Facturae B2B, FatturaPA, SAF-T PT, KSeF (Poland, including batch, bulk and export helpers), Factur-X, e-Factura (Romania), NAV Online (Hungary), Fiskalizacija (Croatia), myDATA (Greece), Peppol BE and BG, eIDAS qualified, PAdES Basic / Basic-T / LTV / Document Archive, and the EU employment-document profiles for DE, IT, ES, FR, PL, AT, BE, PT and NL.

Quick start

using System;
using System.IO;
using esegece.sgcSign;

// 1. Load a signing key. Every provider is interchangeable from here on.
var key = new TsgcPFXKeyProvider();
key.FileName = @"C:\certs\signer.pfx";
key.Password = "secret";
key.LoadFromFile();
Console.WriteLine("Signing as: " + key.GetCertificateSubject());

// 2. Sign a PDF (PAdES).
var pdf = new TsgcPAdESSigner();
pdf.KeyProvider = key;
pdf.Reason = "Approved";
pdf.Location = "Madrid";
pdf.SignerName = "Jane Doe";
File.WriteAllBytes("signed.pdf", pdf.SignPDFBytes(File.ReadAllBytes("invoice.pdf")));

// 3. Sign XML (XAdES enveloped, B-B).
var xml = new TsgcXAdESSigner();
xml.KeyProvider = key;
xml.XAdESType = TsgcXAdESType.xtEnveloped;
xml.Profile.SignatureLevel = TsgcSignatureLevel.slBB;
xml.Profile.HashAlgorithm = TsgcHashAlgorithm.haSHA256;
xml.Profile.C14NMethod = TsgcC14NMethod.cmExcC14N;
string signedXML = xml.SignXML(File.ReadAllText("invoice.xml"));

// 4. Verify.
var verifier = new TsgcSignatureVerifier();
if (verifier.Verify(signedXML) == TsgcVerificationStatus.vsValid)
    Console.WriteLine("Signature is valid");

Add a timestamp (B-T)

var tsa = new TsgcTSAClient();
tsa.URL = "http://timestamp.digicert.com";

xml.TSAClient = tsa;
xml.Profile.SignatureLevel = TsgcSignatureLevel.slBT;
xml.Profile.IncludeTimestamp = true;

Sign to a country profile

TsgcDocumentSigner is the one-property front door: pick the profile and it configures the underlying XAdES signer for you.

var signer = new TsgcDocumentSigner();
signer.KeyProvider = key;
signer.Profile = TsgcSignatureProfile.spVeriFactu;
string signedInvoice = signer.SignXML(invoiceXML);

Sign a Windows executable

var authenticode = new TsgcAuthenticodeSigner();
authenticode.KeyProvider = key;
authenticode.Hash = TsgcAuthenticodeHashAlgorithm.ahSHA256;
authenticode.Description = "My Application";
authenticode.URL = "https://www.example.com";
authenticode.TSAClient = tsa;              // optional, produces an alT signature
authenticode.SignFile("app.exe", "app-signed.exe");

Demos

A zip of 36 runnable demos covers every signature format, every key provider and every e-invoicing profile: https://www.esegece.com/download/sgcSign_NET_Demos.zip

34 of them are Windows Forms apps targeting net8.0-windows and two are console samples targeting net8.0, so building and running the demos needs the .NET 8 SDK on Windows. That is a property of the demo projects, not of the library, which targets netstandard2.0 and up and is not Windows only.

Each demo consumes the library through a PackageReference, so extract the zip and run dotnet build. The Community and Registered package choice is switched in one place, demos\Directory.Build.props.

Editions

All editions ship the same feature set. They differ in licensing, not capability.

• Community (esegece.sgcSign.Community) is free for both commercial and non-commercial use by small teams: individuals and organizations under EUR 1M annual gross revenue and with no more than 5 developers. It shows a brief, non-blocking one-time startup notice. Organizations at or above either threshold need a paid licence.
• Registered (esegece.sgcSign) removes the notice and carries the commercial licence. Higher tiers add the C# source and priority support.

Only one of the two packages should be referenced at a time.

Links

• Product: https://www.esegece.com/products/sgcsign
• Quick start: https://www.esegece.com/products/sgcsign/quick-start/
• Demos: https://www.esegece.com/download/sgcSign_NET_Demos.zip
• Key providers: https://www.esegece.com/products/sgcsign/key-providers/
• Signature profiles: https://www.esegece.com/products/sgcsign/profiles/
• Pricing: https://www.esegece.com/products/sgcsign/pricing/
• Support: https://www.esegece.com

copyright © 2026 eSeGeCe