VEJA FUNCIONANDO

Veja o sgcSign em dois minutos

Assine código e documentos a partir do Delphi e do .NET: PAdES, XAdES, CAdES e Authenticode, com smart cards e HSMs.

DOIS FORMATOS, UM MOTOR

Biblioteca ou servidor — mesmo núcleo de assinatura

O sgcSign é distribuído em dois formatos complementares que compartilham o mesmo motor de assinatura, provedores de chaves e perfis por país. Escolha a biblioteca embarcada, o servidor centralizado, ou use ambos juntos.

Biblioteca de componentes sgcSign

Componentes Delphi / C++Builder / .NET prontos para uso que produzem assinaturas XAdES, PAdES, CAdES e ASiC diretamente dentro do seu aplicativo. Criptografia nativa CNG/BCrypt, sem DLLs externas, código-fonte completo incluído.

Recursos da biblioteca →

Servidor sgcSign

Daemon de assinatura remota auto-hospedado — REST API, admin web Bootstrap, instalador de serviço Windows. Adiciona assinatura Authenticode, ClickOnce, NuGet e VSIX além dos formatos de documento. Pipelines prontos para GitHub Actions, Azure DevOps, Jenkins, Docker e Helm.

Visão geral do servidor →

PADRÕES DE ASSINATURA

Todos os formatos ETSI, de B-B a B-LTA

Cobertura completa das quatro famílias de assinatura ETSI mais Microsoft Authenticode para binários PE. Todos os quatro níveis AdES suportados.

XAdES

ETSI EN 319 132 — XML Advanced Electronic Signatures

Enveloped, detached and enveloping signatures over XML. Levels B-B / B-T / B-LT / B-LTA. Polish, Spanish and German diacritics round-trip losslessly via WideString overloads on Delphi 7+.

PAdES

ETSI EN 319 142 — PDF Advanced Electronic Signatures

Embed assinatura digitals into PDF documents. Visible signature appearance with signer name, reason, location, contact info and configurable rectangle. Compatible with Adobe Acrobat.

CAdES

ETSI EN 319 122 — CMS/PKCS#7 Advanced Electronic Signatures

CMS/PKCS#7 binary signatures over any file or data stream. Detached and attached forms. BES, T and XL conformance levels.

ASiC-S / ASiC-E

ETSI EN 319 162 — Associated Signature Containers

Bundle one or more documents and the associated XAdES or CAdES signature into a single ZIP archive. Simple (one document) or Extended (manifest + multiple documents).

Authenticode + ClickOnce + NuGet + VSIX

Code signing — sgcSign Server

Sign Windows PE files (.exe, .dll, .sys, .ocx), ClickOnce manifests, NuGet packages and VSIX bundles. SHA-256 (default), SHA-384, SHA-512 and dual-signing for legacy compatibility.

10 KEY PROVIDERS

Local Files, Hardware Tokens, Cloud KMS

Every provider implements the same IsgcKeyProvider interface, so signers work with any key source without modification. Switch from a PFX file to AWS KMS by changing one component.

PFX / PKCS#12

TsgcPFXKeyProvider

Local password-protected PFX files. Native Windows CNG support; no OpenSSL DLL required.

PEM Files

TsgcPEMKeyProvider

PEM-encoded certificates and encrypted PKCS#8 private keys. Native PBES2 / PBKDF2 / AES-CBC decryption — no external library required.

Windows Certificate Store

TsgcWindowsCertStoreProvider

Local machine and current user certificate stores. Seamless integration with Windows PKI and Active Directory.

PKCS#11 Hardware Tokens

TsgcPKCS11Provider

Smart cards and HSMs over the standard PKCS#11 interface — SafeNet, YubiKey, Nitrokey and any vendor with a PKCS#11 driver.

Azure Trusted Signing

TsgcAzureTrustedSigningProvider

Microsoft's qualified signing service. OAuth2 client credentials, private keys never leave Azure. Distinct from Azure Key Vault.

AWS KMS

TsgcAWSKMSKeyProvider

AWS Key Management Service. Sign with keys held in AWS; the document hash is sent, the raw signature returns.

Google Cloud KMS

TsgcGCloudKMSKeyProvider

Google Cloud Key Management. Service-account authentication with keys hosted in Google Cloud.

HashiCorp Vault

TsgcHashiCorpVaultKeyProvider

Vault transit signing engine. Keys stay inside Vault; document hashes are sent over an authenticated REST API.

Certum SimplySign

TsgcCertumSimplySignProvider

Qualified Polish e-signature provider. Cloud-based remote signing for KSeF, ZUS and other Polish public-administration portals.

CSC v2 (Cloud Signature Consortium)

TsgcCSCKeyProvider

Generic CSC v2 client for remote QTSPs — Universign, D-Trust sign-me, A-Trust, FNMT Cl@ve Firma, Evrotrust, Intesi Group and more.

21 PRE-CONFIGURED COUNTRY PROFILES

European E-Invoicing & Employment Contracts

Each profile pre-tunes hash algorithm, canonicalization, signature level, timestamp and OCSP-revocation policy to match the target country's regulator. Switch jurisdiction with a one-line change.

E-Invoicing Profiles (12)

Profile	Country	System	Format	Level
`spVeriFactu`	Spain	VeriFactu (AEAT)	XAdES-EPES	B-B
`spTicketBAI`	Spain (Basque)	TicketBAI	XAdES-EPES	B-B
`spFacturaeB2B`	Spain	Facturae 3.x / FACe	XAdES-EPES	B-T
`spFatturaPA`	Italy	FatturaPA (SDI)	XAdES-BES	B-B
`spSAFTPT`	Portugal	SAF-T PT	RSA-SHA256	B-B
`spKSeF`	Poland	KSeF (Krajowy System e-Faktur)	XAdES	B-T
`spFacturX`	France / Germany	Factur-X / ZUGFeRD	XAdES	B-B
`spEFactura`	Romania	e-Factura (ANAF)	XAdES	B-T
`spNAVOnline`	Hungary	NAV Online	XML-DSig	B-B
`spFiskalizacija`	Croatia	Fiskalizacija	XML-DSig	B-B
`spPeppolBE` / `spPeppolBG`	EU (Belgium, Bulgaria)	Peppol UBL 2.x	XAdES	B-T
`spMyDATA`	Greece	myDATA (AADE)	XAdES	B-B

Portugal: além de assinar o próprio arquivo SAF-T (PT), o componente dedicado TsgcSAFTPTSigner produz a assinatura por fatura da Portaria 363/2010, a assinatura RSA-SHA1 cujos quatro caracteres nas posições 1, 11, 21 and 31 são impressos na fatura e incluídos no QR-code field Q.

TicketBAI: as variantes por província spTicketBAIAraba, spTicketBAIBizkaia e spTicketBAIGipuzkoa carregam, cada uma, o identificador oficial de política de assinatura e o digest SHA-256 da respectiva Hacienda provincial. spTicketBAI mapeia para o par Bizkaia para manter a compatibilidade com versões anteriores.

EU Employment-Contract Profiles (9)

eIDAS-compliant signatures for member-state labour-law requirements on employment contracts. Pre-tuned to the AdES / QES level, hash, canonicalization, timestamp and OCSP-revocation policy of each jurisdiction. Accepted by labour-administration verifiers.

Germany — `spEmploymentDE`

Level B-LT, QES required by § 126a BGB for written-form contracts (e.g. fixed-term > 24 months, post-contract non-compete).

Italy — `spEmploymentIT`

Level B-LT, FEQ qualified signature. CAdES (.p7m) widely used; XAdES accepted. INPS portals consume both.

Spain — `spEmploymentES`

Level B-T, AdES sufficient. SEPE / TGSS portals require FNMT or DNIe certificate; CRL via FNMT trust list.

France — `spEmploymentFR`

Level B-T, AdES OK. QES preferred for remote-signing flows under DSP2 / RGS.

Austria — `spEmploymentAT`

Level B-LT. QES via Handy-Signatur / ID Austria common.

Belgium — `spEmploymentBE`

Level B-LT. QES via eID card (BeID).

Portugal — `spEmploymentPT`

Level B-LT. QES via Cartão do Cidadão / Chave Móvel Digital.

Netherlands — `spEmploymentNL`

Level B-T. AdES generally accepted; QES for some HR portals (UWV).

Poland — `spEmploymentPL`

Level B-T. QES via Profil Zaufany or qualified certificate when contract goes to ZUS / PUE.

VALIDATION & TRUST

EU Trust List, ETSI Validation Reports & LTV

sgcSign verifies signatures the same way the EU verifies them — against the live LOTL, with a standardised XML report that labour courts and public administrations accept as legal proof.

Signature Verification with LTV

Full validation pipeline — digest checks, RSA/ECDSA signature verification, certificate-chain validation, OCSP revocation checking, embedded RevocationValues for Long-Term Validation, Id-based fragment lookup for SignedProperties.

EU Trust List (LOTL / EUTL)

TsgcEUTrustList parses the ETSI TS 119 612 List of Trusted Lists and ~31 per-Member-State Trusted Lists. Classify any X.509 certificate as eIDAS-qualified by looking up its issuing TSP service against the live EU registry.

Decodificador de certificado X.509 & OCSP

TsgcX509Certificate decodifica todos os campos que um decodificador online exibe: tamanho da chave, nomes de algoritmos, número de série em formato com dois-pontos e decimal, nomes distintos RFC 2253 / LDAP, políticas de certificado, identificadores de chave, impressões digitais SHA-1 / SHA-256 / MD5 e o pin SPKI SHA-256. Verifica criptograficamente o emissor de um certificado (RSA e ECDSA), obtém a CA emissora a partir da URL AIA caIssuers e executa uma verificação de revogação OCSP em tempo real via TsgcOCSPClient.CheckCertificateAuto.

ETSI TS 119 102-2 Validation Report

Standardised XML Validation Report (v1.2.1) produced for every verification — accepted by EU labour courts and public-administration verifiers as legal proof of signature validity.

RFC 3161 Timestamping

Built-in TsgcTSAClient for any RFC 3161 timestamp authority. Promotes signatures to XAdES-T, XAdES-LT and XAdES-LTA — verifiable long after the signing certificate has expired.

CODE EXAMPLES

From Local PFX to Cloud KMS — the Same API

Sign a VeriFactu Invoice with a Local PFX

Load certificate from PFX with password
VeriFactu profile auto-applied
One method call returns signed XML

SignVeriFactu.pas

// Sign Spanish VeriFactu invoice
var
  vKeyProvider: TsgcPFXKeyProvider;
  vSigner: TsgcDocumentSigner;
begin
  vKeyProvider := TsgcPFXKeyProvider.Create(nil);
  try
    vKeyProvider.FileName := 'certificate.pfx';
    vKeyProvider.Password := 'secret';
    vKeyProvider.LoadFromFile;

    vSigner := TsgcDocumentSigner.Create(nil);
    try
      vSigner.KeyProvider := vKeyProvider;
      vSigner.Profile := spVeriFactu;
      memoSigned.Text := vSigner.SignXML(memoXML.Text);
    finally
      vSigner.Free;
    end;
  finally
    vKeyProvider.Free;
  end;
end;

Authenticode-Sign an EXE with Azure Trusted Signing

No local PFX, no USB token
Private key stays in Azure
Microsoft-issued public-trust cert

SignWithAzure.pas

// Authenticode-sign with Azure Trusted Signing
var
  vKeyProvider: TsgcAzureTrustedSigningProvider;
  vSigner: TsgcAuthenticodeSigner;
begin
  vKeyProvider := TsgcAzureTrustedSigningProvider.Create(nil);
  vSigner := TsgcAuthenticodeSigner.Create(nil);
  try
    vKeyProvider.TenantId := '00000000-0000-0000-0000-000000000000';
    vKeyProvider.ClientId := '11111111-1111-1111-1111-111111111111';
    vKeyProvider.ClientSecret := 'my-client-secret';
    vKeyProvider.AccountName := 'my-trusted-signing-account';
    vKeyProvider.CertificateProfileName := 'public-trust';
    vKeyProvider.Endpoint := 'https://eus.codesigning.azure.net';
    vKeyProvider.Connect;

    vSigner.KeyProvider := vKeyProvider;
    vSigner.Level := alBES;   // alT additionally requires a TSAClient
    vSigner.SignFile('myapp.exe', 'myapp-signed.exe');
  finally
    vSigner.Free;
    vKeyProvider.Free;
  end;
end;

PAdES-LT — Visible Signature with Timestamp

Certificate from Windows store
RFC 3161 TSA promotes to PAdES-T
Visible signature with reason & location

SignPDFVisible.pas

// PAdES-T with visible signature appearance
var
  vKeyProvider: TsgcWindowsCertStoreProvider;
  vSigner: TsgcPAdESSigner;
  vTSA: TsgcTSAClient;
begin
  vKeyProvider := TsgcWindowsCertStoreProvider.Create(nil);
  vSigner := TsgcPAdESSigner.Create(nil);
  vTSA := TsgcTSAClient.Create(nil);
  try
    vKeyProvider.StoreName := 'MY';
    vKeyProvider.StoreLocation := cslCurrentUser;
    vKeyProvider.SelectCertificateBySubject('Acme Corp');

    vTSA.URL := 'https://freetsa.org/tsr';

    vSigner.KeyProvider := vKeyProvider;
    vSigner.TSAClient := vTSA;
    vSigner.Reason := 'Approved';
    vSigner.Location := 'Madrid, Spain';
    vSigner.VisibleSignature.Enabled := True;
    vSigner.SignPDFFile('contract.pdf', 'contract-signed.pdf');
  finally
    vTSA.Free;
    vSigner.Free;
    vKeyProvider.Free;
  end;
end;

SGCSIGN SERVER

Centralised Signing for Your Build Farm

Need centralised signing for your build pipeline? sgcSign Server wraps the same engine behind a REST API and Bootstrap web admin — Windows-service installer, ready-made GitHub Actions / Azure DevOps / Jenkins / Docker / Helm pipelines, multi-tenant project model, two-step approval workflow, SHA-256 hash-chained audit log, Prometheus metrics and HMAC-signed webhooks.

Authenticode, ClickOnce, NuGet, VSIX signing
REST API, web admin, Windows service installer
All features included by default

Learn more about sgcSign Server

github-actions.yml

name: Sign Release
on: [push]

jobs:
  sign:
    runs-on: windows-latest
    steps:
      - uses: esegece/sgcsign-action@v1
        with:
          server: https://sign.acme.local
          project: acme-release
          file: myapp.exe
          format: authenticode

MAIS DA ESEGECE

Outros Produtos da eSeGeCe

Combine o sgcSign com nossas outras bibliotecas de componentes para Delphi, C++ Builder e .NET.

sgcWebSockets

Componentes corporativos de WebSocket, HTTP/2, MQTT, AMQP, WebRTC e IA/LLM para Delphi, C++ Builder e .NET. Mais de 30 integrações de API incluídas.

Assine payloads WebSocket e MQTT de ponta a ponta com o mesmo motor XAdES / CAdES usado para documentos.

Saiba mais →

sgcHTML

Componentes HTML e UI server-side para Delphi, C++ Builder e .NET. Mais de 60 widgets construídos sobre Bootstrap 5 e htmx, sem front-end JavaScript para manter.

Dê ao seu fluxo de assinatura uma UI web sem uma stack de front-end separada.

Saiba mais →

sgcQUIC

Componentes cliente e servidor QUIC e HTTP/3 para Delphi, C++ Builder e .NET. Um complemento do sgcWebSockets Enterprise.

Envie requisições de assinatura e carimbo de tempo sobre HTTP/3 para handshakes TLS 1.3 mais rápidos em links de alta latência.

Saiba mais →

sgcWebRTC

Motor completo de mídia WebRTC para Delphi e C++ Builder: chamadas de áudio/vídeo, canais de dados e compartilhamento de tela. Um complemento do sgcWebSockets Enterprise.

Verifique a identidade de um signatário por uma chamada de vídeo ao vivo antes de liberar uma chave de assinatura.

Saiba mais →

sgcCrypto

Biblioteca de criptografia de uso geral para Delphi e C++ Builder: cifras simétricas e assimétricas, hashing e algoritmos pós-quânticos. Disponível gratuitamente a partir do sgcWebSockets Standard.

As mesmas primitivas de cifra e hashing sobre as quais o sgcSign constrói seus algoritmos de assinatura, disponíveis de forma autônoma.

Saiba mais →

sgcOpenAPI

Parser de OpenAPI 3.0 e gerador de SDK. Transforme qualquer especificação OpenAPI em um cliente Delphi fortemente tipado em segundos.

Assine requisições e respostas de API REST produzidas pelos SDKs gerados.

Saiba mais →

sgcBiometrics

Componentes nativos de Windows Hello, impressão digital e Windows Biometric Framework para Delphi e C++ Builder.

Desbloqueie chaves de assinatura com impressão digital ou Windows Hello antes de invocar o assinador.

Saiba mais →

sgcIndy

Componentes Indy TCP/IP atualizados com TLS moderno, suporte a IPv6 e HTTP/2 para Delphi 7 a 13.

Transporte confiável para o envio de assinaturas a TSAs, respondedores OCSP e endpoints verificadores da UE.

Saiba mais →

sgcAI

15 componentes de IA, LLM e MCP para Delphi e C++ Builder. Um único componente de chat alcança OpenAI, Anthropic, Gemini, DeepSeek, Ollama, Grok e Mistral. Produto independente, com o runtime do sgcWebSockets Core incluído.

Adicione um assistente ao fluxo de assinatura sem incluir toda a biblioteca sgcWebSockets.

Saiba mais →

sgcMQ

Componentes cliente de MQTT 3.1.1 e 5.0, AMQP 0.9.1, AMQP 1.0, Apache Kafka e STOMP para Delphi e C++ Builder. Produto independente, com o runtime do sgcWebSockets Core incluído.

Enfileire requisições de assinatura via MQTT, AMQP ou Kafka e assine-as conforme elas chegam.

Saiba mais →

sgcSocial

Clientes da WhatsApp Business Cloud API e do Telegram TDLib. Produto independente, com o runtime do sgcWebSockets Core incluído.

Entregue documentos assinados aos clientes pelo WhatsApp ou Telegram assim que forem selados.

Saiba mais →

sgcSign

Veja o sgcSign em dois minutos

Biblioteca ou servidor — mesmo núcleo de assinatura

Biblioteca de componentes sgcSign

Servidor sgcSign

Todos os formatos ETSI, de B-B a B-LTA

XAdES

PAdES

CAdES

ASiC-S / ASiC-E

Authenticode + ClickOnce + NuGet + VSIX

Local Files, Hardware Tokens, Cloud KMS

PFX / PKCS#12

PEM Files

Windows Certificate Store

PKCS#11 Hardware Tokens

Azure Trusted Signing

AWS KMS

Google Cloud KMS

HashiCorp Vault

Certum SimplySign

CSC v2 (Cloud Signature Consortium)

European E-Invoicing & Employment Contracts

E-Invoicing Profiles (12)

EU Employment-Contract Profiles (9)

Germany — spEmploymentDE

Italy — spEmploymentIT

Spain — spEmploymentES

France — spEmploymentFR

Austria — spEmploymentAT

Belgium — spEmploymentBE

Portugal — spEmploymentPT

Netherlands — spEmploymentNL

Poland — spEmploymentPL

EU Trust List, ETSI Validation Reports & LTV

Signature Verification with LTV

EU Trust List (LOTL / EUTL)

Decodificador de certificado X.509 & OCSP

ETSI TS 119 102-2 Validation Report

RFC 3161 Timestamping

From Local PFX to Cloud KMS — the Same API

Sign a VeriFactu Invoice with a Local PFX

Authenticode-Sign an EXE with Azure Trusted Signing

PAdES-LT — Visible Signature with Timestamp

Centralised Signing for Your Build Farm

Ship eIDAS-Compliant Signatures Today

Outros Produtos da eSeGeCe

sgcWebSockets

sgcHTML

sgcQUIC

sgcWebRTC

sgcCrypto

sgcOpenAPI

sgcBiometrics

sgcIndy

sgcAI

sgcMQ

sgcSocial

Germany — `spEmploymentDE`

Italy — `spEmploymentIT`

Spain — `spEmploymentES`

France — `spEmploymentFR`

Austria — `spEmploymentAT`

Belgium — `spEmploymentBE`

Portugal — `spEmploymentPT`

Netherlands — `spEmploymentNL`

Poland — `spEmploymentPL`