Digital Signatures

Introduction

A digital signature is an authenticated and encrypted electronic stamp for digital information. It verifies that what has been signed originated from the signer and has not been changed.

In Excel you can add a digital signature in the following way:

Epplus Example

As of Epplus 8.0 You can also add a Digital Signature in Epplus via the workbook. To add a minimal digital signature you, much like when signing VBA must supply a X509Certificate2 with a private key to sign with.

In code, if your current user has valid certificates it can be as simple as:

using(var pck = new ExcelPackage())
{
    var wb = pck.Workbook;
    var ws = wb.Worksheets.Add("SomeWorksheet");
    
    X509Store store = new X509Store(StoreLocation.CurrentUser);
    store.Open(OpenFlags.ReadOnly);
    var cert = store.Certificates[0];    

    //Add a digital signature and sign it with the certificate
    var digitalSignature = wb.DigitialSignatures.AddSignature(cert);

    pck.SaveAs(@"C:\temp\DigitalSignatureSimple.xlsx");
}

In order to create the digital signature in the images above we can create it like this:

//The method to add a signature also includes optional parameters for the comments commitment type and reason for signing
//That represent the 'commitment type' and 'purpose for signing this document' fields from Excel.
var digitalSignature = wb.DigitialSignatures.AddSignature(cert, CommitmentType.CreatedAndApproved, "To demonstrate");

//You can also add signer details via the Details property.
//This represents the 'details' button in excel:
var details = digitalSignature.Details;

details.SignerRoleTitle = "Developer";
details.Address1 = "ExampleStreet 2";
details.Address2 = "Floor 2";
details.ZIPorPostalCode = "114 51";
details.City = "Stockholm";
details.CountryOrRegion = "Sweden";
details.StateOrProvince = "Stockholm";

pck.SaveAs(@"C:\temp\DigitalSignatureSimple.xlsx");

Keep in mind that the actual digital signature will be created when the workbook is saved, not before. Digital Signatures in Epplus has an IsValid property. It will only be valid after saving and when reading a signature.

Security concerning Hashing and DigestMethods

By default Excel and thus also Epplus uses the SHA1 hashing method for digital signatures. This hashing method has been considered unsafe for some time thus it is recommended to set a more secure hashing method using SetDigestMethod()

var digitalSignature = wb.DigitialSignatures.AddSignature(cert);
//Note: This sets the hashing method for all digital signatures in the package
digitalSignature.SetDigestMethod(DigitalSignatureHashAlgorithm.SHA512);

See also

Epplus also supports Digital Signature Lines. Which visualizes a digital signature on a worksheet.

We have made a samples that show multiple ways to create digital signatures in Epplus: See Sample 8.3-C# or Sample 8.3-VB