External Signing
By default the signature is happening completely on the NextGen device, but there is also an option for moving the digital signature to a external server. Therefor the device firmware was extended to break the signing process and provide with a new event the final document hash which needs to be signed. A customer application can collect this final document hash and sign it directly or forward it to a external signature server. The advantage is that the external signature server can store personal certificates or Adobe approved certificates (green tick).
The external signing support was added with Firmware Version 1.4.16, you can check/download the device firmware on the info page of your nextgen device.
Firmware
There are 2 new Event and Config Settings for the external Signing Feature:
Config Settings for the External Signing
{
"type": "SerializeConfig",
"externalSignature": {
"enableExternalSignature": true,
"externalSignatureUrl": "",
"externalSignatureTimeout": "5000"
}
}Parameter | Description |
|---|---|
enableExternalSignature | With enableExternalSignature = true you enable the external signing feature, the pad will pause after the FinalDocHash is created and waits until the signed PKCS7 container is forwarded to the device or the timeout is reached. |
externalSignatureUrl | The externalSignatureUrl can be used when you want to test the external signing directly with the webgui of the pad. |
externalSignatureTimeout | Timeout in ms for how long the device waits for the signed PKCS7 container. |
Event "ExternalDigitalSigningEvent" is raised when the pad created the FinalDocHash, the pad stops at this point with hourclass until the signed PCKS7 Container is set or the Timeout is reached. The FinalDocHash is part of the Event values
// Sample for a ExternalDigitalSigning Event
{
"type": "ExternalDigitalSigningEvent",
"id": "1771580193097913412-8987",
"timeStamp": "2026-02-20 09:13:44",
"fieldPage": 0,
"fieldName": "",
"fieldHash": "5oplSSnLXemOPnLqyl3viHVuCmv5yXh1rtOVbp+RTjs="
}
The HASH needs to be send to the signing-server were a PKCS7 Signature Container is created and returns
The PKCS7 Container needs to set with new event (v1/events/acknowledge). Here the part of the sample where you see the JSON structure
// 2. Acknowledgment happens OUTSIDE the try/catch (or in a finally)
// This ensures it runs even if the 'Signer failed' error was thrown
try {
const ackPayload = {
type: event.type,
id: http://event.id ,
timeStamp: event.timeStamp,
fieldPage: event.fieldPage,
fieldName: event.fieldName,
fieldHash: event.fieldHash,
pkcs7Container: signatureBase64 // Will be actual data or ""
};
const ackRes = await fetch('/api/acknowledge', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Session-Id': currentSessionId
},
body: JSON.stringify(ackPayload)
});
....}
// Bridge to acknowledge and complete the signing process
app.post('/api/acknowledge', async (req, res) => {
try {
const response = await axios.post(`${TARGET_HOST}/v1/events/acknowledge`, req.body, {
headers: {
'Session-Id': req.headers['session-id'],
'Content-Type': 'application/json'
}
});
res.json(response.data);
} catch (err) {
const status = err.response ? err.response.status : 500;
res.status(status).json({ error: 'Acknowledgment failed', detail: err.message });
}
}); The Pad will insert the PKCS7 Container into the PDF Document and you can continue with more signatures or download of the document.
Sample:
The developer created a sample website, this will require Node js to execute (https://nodejs.org/en )
https://www.stepoverinfo.net/download.php?file=signServerBridge.zip
After install of Node-JS you can run it with the console by using C:\...\signServerBridge node app.js
But first you need to change the target address of your pad inside the config.js file (line 24: const TARGET_HOST = 'http://ngane-2';).
The sample page will run under http://localhost:3000/
You need to initialize a new session
Select a PDF/XML file and upload it
Sign the PDF and Confirm with OK on the Pad
The site will wait for the Event "ExternalDigitalSigningEvent" and will forward the Hash to the signingservice
When the signing service returns the PKCS7 Container the site will forward it to the pad
PDFService as signature-server
PDF-Service 6.0.1 (Windows)
(Linux version will be avalible soon)
Setup of the Signing Server:
The SigningServer is a extention of our PDFServer which is part of our nativeAPI. It contains the logic for working with PDF documents (Rendering, Signing...)
Signing Server is using http (50054) and https (50055)
Under Windows you need to place the signing certificate under "C:\ProgramData\StepOver\signservice\...". It´s possible to use different certificates, for example signer specific certs. For the Sample Application we using "testuser", therefor you need to create "C:\ProgramData\StepOver\signservice\testuser" and copy this files there:
Later you can set a different user with your own certificate, but first you should use our test certificate as we know this will work.
The Service is installed to C:\Program Files\StepOver\PdfService and is started by default with windows (or after the installation). You can also stop the service and start with console "C:\Program Files\StepOver\PdfService\bin\PdfService.bat" .
For the start just use the PDFService as local component on your developer system, later you can set up the PDFService on your webserver or another server.