Complete feature catalog for the sgcSign digital signature suite — signature standards, key providers, country profiles, validation, EU Trust List integration and ETSI validation reports for Delphi 7 through Delphi 13 Florence, C++Builder and .NET.
sgcSign separates key management, signing operations and output formats. Mix any key provider with any signer; switch between local PFX and cloud KMS by changing one component.
Abstract certificate and private-key access behind a single interface. Local files, Windows Certificate Store, PKCS#11 hardware tokens, Azure / AWS / Google Cloud KMS, HashiCorp Vault, Certum SimplySign and CSC v2 remote QTSPs.
Specialised signers for each ETSI format: TsgcXAdESSigner, TsgcPAdESSigner, TsgcCAdESSigner, TsgcAuthenticodeSigner. Plus TsgcDocumentSigner — a unified high-level API that selects and configures the right signer from a country profile. TsgcSAFTPTSigner produces Portugal's Portaria 363/2010 invoice signature.
TsgcTSAClient (RFC 3161 timestamps), TsgcOCSPClient (revocation), TsgcSignatureVerifier (validation), TsgcX509Certificate (certificate decoder + issuer verification), TsgcEUTrustList (LOTL/EUTL), TsgcASiCContainer (ASiC-S/ASiC-E ZIP packaging).
Full ETSI signature-format coverage at all four AdES levels (B-B, B-T, B-LT, B-LTA), plus Microsoft Authenticode for code signing.
XML Advanced Electronic Signatures. Enveloped, detached and enveloping modes. B-B / B-T / B-LT / B-LTA levels. SignatureParentElement for envelope formats that pin signature placement (KSeF /v2/auth/xades-signature). Polish, Spanish and German diacritics via WideString overloads on Delphi 7+.
PDF Advanced Electronic Signatures. Embedded signatures inside PDF; visible signature appearance with signer name, reason, location, contact info and configurable rectangle. Compatible with Adobe Acrobat. PAdES-T, -LT levels via TSA + OCSP.
CMS/PKCS#7 binary signatures over any file or data stream. Detached and attached forms. CAdES-BES, CAdES-T (timestamped), CAdES-XL (long-term with revocation values).
Associated Signature Containers. ZIP-format archive bundling one or more documents with a XAdES or CAdES signature. Simple (apASiCS, single document) or Extended (apASiCE, manifest + multiple documents). The first ZIP entry is an uncompressed mimetype marker so verifiers detect the container in the first ~50 bytes.
Microsoft Authenticode for Windows PE files (.exe, .dll, .sys, .ocx, .cpl, .scr). SHA-1, SHA-256 (default), SHA-384 and SHA-512 hash algorithms. RFC 3161 timestamp tokens. Nested (dual) signatures for legacy + modern verifier compatibility. Available in sgcSign Server. Optional page hashes, the equivalent of signtool sign /ph, let Windows verify each 4 KB page of a kernel-mode driver (Memory integrity, HVCI).
All four ETSI conformance levels supported per format: B-B (basic), B-T (timestamp), B-LT (long-term, with revocation values), B-LTA (archival, with archive timestamp). Promote a signature from B-B to B-LT by adding a TSA client and OCSP responder.
Every provider implements IsgcKeyProvider. Switch between any of these key sources without changing your signing code.
| Component | Type | Use Case |
|---|---|---|
TsgcPFXKeyProvider |
Local file (PKCS#12) | Password-protected PFX/.p12 files. Native Windows CNG support on Windows, pure Pascal parsing on the other platforms. |
TsgcPEMKeyProvider |
Local file (PEM) | PEM certificates with encrypted PKCS#8 keys. Native PBES2 / PBKDF2 / AES-CBC decryption — no OpenSSL DLL required. |
TsgcWindowsCertStoreProvider |
Windows store | Local-machine and current-user stores. Active Directory and Group Policy integration. |
TsgcPKCS11Provider |
Hardware token | Smart cards and HSMs via PKCS#11 driver — SafeNet, YubiKey, Nitrokey, Thales, Utimaco, etc. |
TsgcAzureTrustedSigningProvider |
Cloud (Microsoft) | Azure Trusted Signing — Microsoft's qualified signing service. OAuth2 client credentials. Distinct from Azure Key Vault. |
TsgcAWSKMSKeyProvider |
Cloud (AWS) | AWS Key Management Service. Keys stay in AWS; only document hashes leave the network. |
TsgcGCloudKMSKeyProvider |
Cloud (Google) | Google Cloud Key Management. Service-account authentication. |
TsgcHashiCorpVaultKeyProvider |
Cloud (self-hosted) | HashiCorp Vault transit signing engine. Keys never leave the Vault cluster. |
TsgcCertumSimplySignProvider |
Remote QTSP | Certum SimplySign — qualified Polish e-signature provider. KSeF, ZUS, PUE compatible. |
TsgcCSCKeyProvider |
Remote QTSP (CSC v2) | Generic Cloud Signature Consortium v2 client — Universign, D-Trust sign-me, A-Trust, FNMT Cl@ve Firma, Evrotrust, Intesi Group and any QTSP exposing the CSC v2 API. |
Each profile pre-tunes hash algorithm, canonicalization, signature level, RFC 3161 timestamp policy and OCSP-revocation expectations to satisfy the target country's regulator. Switch jurisdiction with one line.
| Profile | Country | System | Format | Level |
|---|---|---|---|---|
spVeriFactu | Spain | VeriFactu (AEAT) | XAdES-EPES | B-B |
spTicketBAI | Spain (Basque) | TicketBAI | XAdES-EPES | B-B |
spFacturaeB2B | Spain | Facturae 3.x / FACe | XAdES-EPES | B-T |
spFatturaPA | Italy | FatturaPA (SDI) | XAdES-BES | B-B |
spSAFTPT | Portugal | SAF-T PT | RSA-SHA256 | B-B |
spKSeF | Poland | KSeF (Krajowy System e-Faktur) | XAdES | B-T |
spFacturX | France / Germany | Factur-X / ZUGFeRD | XAdES | B-B |
spEFactura | Romania | e-Factura (ANAF) | XAdES | B-T |
spNAVOnline | Hungary | NAV Online | XML-DSig | B-B |
spFiskalizacija | Croatia | Fiskalizacija | XML-DSig | B-B |
spPeppolBE | Belgium | Peppol UBL 2.0 | XAdES | B-T |
spPeppolBG | Bulgaria | Peppol UBL 2.1 | XAdES | B-T |
spMyDATA | Greece | myDATA (AADE) | XAdES | B-B |
Portugal: beyond signing the SAF-T (PT) file itself, the dedicated TsgcSAFTPTSigner component produces the Portaria 363/2010 per-invoice signature, the RSA-SHA1 signature whose four characters at positions 1, 11, 21 and 31 are printed on the invoice and carried in QR-code field Q.
TicketBAI: per-province variants spTicketBAIAraba, spTicketBAIBizkaia and spTicketBAIGipuzkoa each carry their provincial Hacienda's official signature-policy identifier and SHA-256 digest. spTicketBAI maps to the Bizkaia pair for backward compatibility.
Czech EET 2.0: sales registration (Elektronická evidence tržeb) is not a signature profile, it has a component of its own, TsgcEETClient. It signs each registered sale under WS-Security, posts it to the tax authority and reads back the acknowledgement code, the pok. Reporting starts on 1 January 2027. More about EET 2.0.
eIDAS-compliant signatures for member-state labour-law requirements (e.g. § 126a BGB in Germany, FEQ in Italy). Pre-tuned per jurisdiction; loaded into TsgcXAdESSigner via Profile.LoadProfile(spEmploymentXX).
| Profile | Country | Level | Hash | Timestamp | OCSP | Notes |
|---|---|---|---|---|---|---|
spEmploymentDE | Germany | B-LT | SHA-256 | Yes | Yes | QES required by § 126a BGB for written-form contracts. |
spEmploymentIT | Italy | B-LT | SHA-256 | Yes | Yes | FEQ qualified signature; INPS portals consume both XAdES and CAdES. |
spEmploymentES | Spain | B-T | SHA-256 | Yes | No | AdES sufficient. SEPE / TGSS portals require FNMT or DNIe. |
spEmploymentFR | France | B-T | SHA-256 | Yes | No | AdES OK; QES preferred for remote-signing under DSP2 / RGS. |
spEmploymentAT | Austria | B-LT | SHA-256 | Yes | Yes | QES via Handy-Signatur / ID Austria common. |
spEmploymentBE | Belgium | B-LT | SHA-256 | Yes | Yes | QES via eID card (BeID). |
spEmploymentPT | Portugal | B-LT | SHA-256 | Yes | Yes | QES via Cartão do Cidadão / Chave Móvel Digital. |
spEmploymentNL | Netherlands | B-T | SHA-256 | Yes | No | AdES generally accepted; QES for some HR portals (UWV). |
spEmploymentPL | Poland | B-T | SHA-256 | Yes | No | QES via Profil Zaufany or qualified cert when contract goes to ZUS / PUE. |
Full validation pipeline plus EU Trust List integration and the standardised ETSI TS 119 102-2 XML Validation Report — legal proof of signature validity accepted by EU labour courts and public-administration verifiers.
TsgcSignatureVerifier covers the full pipeline: digest checks, RSA / ECDSA signature verification, certificate-chain validation, OCSP revocation checking, embedded RevocationValues for Long-Term Validation, and Id-based fragment lookup for SignedProperties.
TsgcEUTrustList parses the ETSI TS 119 612 List of Trusted Lists and ~31 per-Member-State Trusted Lists. Classify any X.509 certificate as eIDAS-qualified by looking it up against the live EU registry. Offline-mode caching for air-gapped deployments.
Standardised XML Validation Report (v1.2.1) produced for every verification — the format accepted by EU labour courts and public-administration verifiers as legal proof of signature validity.
TsgcTSAClient connects to any RFC 3161 timestamp authority. Promotes signatures from B-B to B-T, B-LT and B-LTA — verifiable long after the signing certificate has expired.
TsgcOCSPClient performs RFC 6960 Online Certificate Status Protocol checks. Real-time revocation, with the OCSP response embedded in B-LT signatures so the document remains verifiable when the responder is later offline.
TsgcX509Certificate exposes every field an online decoder shows: key size, algorithm names, serial (colon and decimal), RFC 2253 / LDAP distinguished names, certificate policies, key identifiers, SHA-1 / SHA-256 / MD5 thumbprints and the SubjectPublicKeyInfo SHA-256 pin. It verifies the issuer signature cryptographically (RSA and ECDSA), resolves the CA from the AIA caIssuers URL, and runs an automatic OCSP check via CheckCertificateAuto.
Inclusive C14N (xml-c14n11) and Exclusive C14N (xml-exc-c14n) for consistent XML signature processing. Each country profile selects the canonicalization expected by its regulator.
Windows CNG / BCrypt cryptography on Windows, a pure Pascal engine on Linux64, macOS, iOS and Android. No OpenSSL DLL required. Native PBES2 / PBKDF2 / AES-CBC for encrypted PKCS#8 PEM. WinHTTP for network operations on Windows, the Delphi RTL HTTP client elsewhere.
Supports every Delphi compiler from Delphi 7 to RAD Studio 13, plus C++Builder. Modern units guarded for legacy compatibility (e.g. TsgcASiCContainer requires D2010+ generics; gracefully compiles as empty unit on D7).
Mirror C# port for .NET Framework 2.0–4.8, .NET Core, .NET 5–10 and .NET Standard. Same Tsgc* class names; same API surface as the Delphi library.
Complete source included with every license. Inspect, customise, audit and extend. Component class names registered for design-time IDE integration.
All X.509 / CRL / OCSP / TSA timestamps stored as UTC TDateTime values, matching RFC 5280, RFC 3161 and RFC 6960. Local-time conversion via *Local properties on each component.
Free binary redistribution. Sign as many documents as you like with no per-document fees and no per-deployment licenses.
spFatturaPA for Italy, spKSeF for Poland
// Sign Spanish VeriFactu invoice
var
vKeyProvider: TsgcPFXKeyProvider;
vSigner: TsgcDocumentSigner;
begin
vKeyProvider := TsgcPFXKeyProvider.Create(nil);
try
vKeyProvider.FileName := 'certificate.pfx';
vKeyProvider.Password := 'secret';
vKeyProvider.LoadFromFile;
vSigner := TsgcDocumentSigner.Create(nil);
try
vSigner.KeyProvider := vKeyProvider;
vSigner.Profile := spVeriFactu;
memoSigned.Text := vSigner.SignXML(memoXML.Text);
finally
vSigner.Free;
end;
finally
vKeyProvider.Free;
end;
end;// Authenticode-sign with Azure Trusted Signing
var
vKeyProvider: TsgcAzureTrustedSigningProvider;
vSigner: TsgcAuthenticodeSigner;
begin
vKeyProvider := TsgcAzureTrustedSigningProvider.Create(nil);
vSigner := TsgcAuthenticodeSigner.Create(nil);
try
vKeyProvider.TenantId := '00000000-0000-0000-0000-000000000000';
vKeyProvider.ClientId := '11111111-1111-1111-1111-111111111111';
vKeyProvider.ClientSecret := 'my-client-secret';
vKeyProvider.AccountName := 'my-trusted-signing-account';
vKeyProvider.CertificateProfileName := 'public-trust';
vKeyProvider.Endpoint := 'https://eus.codesigning.azure.net';
vKeyProvider.Connect;
vSigner.KeyProvider := vKeyProvider;
vSigner.Level := alBES; // alT additionally requires a TSAClient
vSigner.SignFile('myapp.exe', 'myapp-signed.exe');
finally
vSigner.Free;
vKeyProvider.Free;
end;
end;// PAdES-T with visible signature appearance
var
vKeyProvider: TsgcWindowsCertStoreProvider;
vSigner: TsgcPAdESSigner;
vTSA: TsgcTSAClient;
begin
vKeyProvider := TsgcWindowsCertStoreProvider.Create(nil);
vSigner := TsgcPAdESSigner.Create(nil);
vTSA := TsgcTSAClient.Create(nil);
try
vKeyProvider.StoreName := 'MY';
vKeyProvider.StoreLocation := cslCurrentUser;
vKeyProvider.SelectCertificateBySubject('Acme Corp');
vTSA.URL := 'https://freetsa.org/tsr';
vSigner.KeyProvider := vKeyProvider;
vSigner.TSAClient := vTSA;
vSigner.Reason := 'Approved';
vSigner.Location := 'Madrid, Spain';
vSigner.VisibleSignature.Enabled := True;
vSigner.SignPDFFile('contract.pdf', 'contract-signed.pdf');
finally
vTSA.Free;
vSigner.Free;
vKeyProvider.Free;
end;
end;Security, signing control and operations in sgcSign Server. The registered and trial builds include every feature; the last column shows what the Community Edition offers.
| Feature | What It Does | Community Edition |
|---|---|---|
| Two-factor sign-in | TOTP codes from any authenticator app plus 10 single-use recovery codes. admin.require_2fa makes it mandatory for every console user, and an administrator can reset a lost second factor. |
Yes |
| OpenID Connect sign-in | Console sign-in through Microsoft Entra ID, Okta, Keycloak, Google or any standard provider, with PKCE. Users link an external identity to their account, and account requests can optionally wait for an administrator's approval. | Yes |
| Console hardening | Security headers and a strict Content Security Policy on every response, a configurable password policy, temporary passwords replaced at the first sign-in, and sessions that end when the role or rights behind them change. | Yes |
| Secrets encrypted at rest | Provider passwords, PINs, cloud credentials and webhook secrets stored with AES-256-GCM under a machine-bound master key. --protect-secrets encrypts an existing configuration in place. |
Yes |
| Enforced approvals | Approval required per provider or per project, checked by the server on every signing path, raw digest signing for signtool /dlib included. Each approval signs once. |
No |
| API key lifecycle | Regenerate with an overlap window of up to 7 days, editable expiry, key owners, a list of allowed providers per key, and self-service keys for operators with api_keys.self_service. A key can also start its validity at first use: it is valid for N days counted from its first authenticated call, with a required activate-before date so an unused key never stays valid forever. Sub-keys work only once their parent key is activated, activation is recorded in the audit log as apikey.activate, and Community caps both values at 30 days. |
One active key, expiry up to 30 days |
| PKCS#11 PIN retry guard | Stops logging in to a token after max_pin_attempts incorrect PINs and never spends the final try unless allow_final_pin_try is set, so a wrong PIN never locks a hardware token. |
No (no PKCS#11 provider) |
| Default timestamp servers | A server-wide list of RFC 3161 timestamp servers tried in order with automatic fallback, per-provider tsa_urls, and no_timestamp to skip the timestamp on one request. |
Yes |
sgcsign timestamp |
Adds an RFC 3161 timestamp to a file that is already Authenticode signed, trying each --tsa server in turn. |
Yes |
--page-hashes |
Authenticode: adds one hash per 4 KB page of the image, the equivalent of signtool sign /ph, used by kernel-mode drivers with Memory integrity (HVCI). |
Yes |
| Encrypted scheduled backups | One AES-256-GCM archive with the configuration, the database, the master key and the key and certificate files, written on a schedule or from the console. --archive restore restores it or moves the server to a new machine. |
Yes |
| Certificate expiry monitoring | Daily check of the signing and TLS certificates with warnings at 30, 14, 7 and 1 days on the dashboard, the cert.expiring webhook, email and a Prometheus metric. |
Dashboard and email only |
| Email notifications | Email for lockouts, two-factor and password changes, failed backups and expiring certificates, over SMTP with STARTTLS or implicit TLS. On Windows no OpenSSL libraries are needed. | Yes |
| Windows installer | sgcSignServer_Setup.exe installs the Windows service, creates the first administrator, opens the firewall port and sets up TLS with a self-signed certificate or an existing PFX file. |
No, Community runs from the zip with start.bat (plain HTTP) |
| CLI saved profiles | sgcsign config keeps settings in named profiles and sgcsign auth set-key stores the API key, in the Delphi CLI and the .NET tool esegece.sgcsign.cli. |
Yes |