Introduction

SigningHub allows you to add electronic seals in a workflow. Electronic Seal (eSeal), Advanced Electronic Seal (AdESeal), and Qualified Electronic Seal (QESeal) are the levels of assurance available for an electronic seal. Adding electronic seals will consume signatures quota of your (document owner's) account. Adding an electronic seal is subject to your SigningHub license, service plan configuration and the assigned enterprise user role.

How it works?

1. Enable the "Electronic Seals" module in your SigningHub license.

2. Allow the electronic seals module against the role of administrator, in SigningHub Admin.

3. To perform electronic seal signing, you must configure a connector, in SigningHub Admin.

4. Configure an electronic seal profile, in SigningHub Admin.

5. Configure an electronic seal against your service plan, in SigningHub Admin.

6. Configure the electronic seal against an enterprise user role, in SigningHub Web.

7. Create an electronic seal for your enterprise, in SigningHub Web.

8. Once an electronic seal has been created for your enterprise, you can add this electronic seal to a workflow.

9. Add an electronic seal field to your document.

10. Signing of an electronic seal.

Enable "Electronic Seals" in your SigningHub License

The Electronic Seals feature is available through the license, if the "ELECTRONIC_SEALS" module is enabled in the license. When "ELECTRONIC_SEALS" module is enabled, it will consume the quota of "Signatures". Contact the SigningHub support and request them to enable this module in your license.

Configure the Role of Administrator in SigninHub Admin

Make the following configurations against the administrator role.

1. From the Details screen, allow the "Electronic Seal Profiles" module for this role.

Configure a Connector in SigningHub Admin

Configure a connector, as shown below, for ADSS Electronic Seal or CSC Electronic Seal, respectively.

ADSS Electronic Seal Connector

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "ADSS Server" as the "Provider".
2. In the "Details" section, fill in the required fields.

CSC Electronic Seal Connector

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "CSC Electronic Seal" as the "Provider".
2. In the "Details" section, fill in the required fields.

Configure an Electronic Seal Profile in SigningHub Admin

Configure an electronic seal profile, as shown below, for ADSS Electronic Seal or CSC Electronic Seal, respectively.

ADSS Electronic Seal Profile

Make the following configurations to an electronic seal profile in SigningHub Admin:

1. Select the ADSS Server connector created earlier, and fill in the required fields:

CSC Electronic Seal Profile

Make the following configurations to an electronic seal profile in SigningHub Admin:

1. Select the CSC Connector created earlier, and fill in the required fields:

Configure an Electronic Seal against your Service Plan in SigningHub Admin

Configure an electronic seal against your service plan, as shown below, for ADSS Electronic Seal or CSC Electronic Seal, respectively.

ADSS Electronic Seal Signing Server

Make the following configurations to a service plan in SigningHub Admin:

1. From the "Basic Information" section, select and add the "Electronic Seals" feature to service plan.
2. From the "Signatures" section, add the electronic seal signing server.

CSC Electronic Seal Signing Server

Make the following configurations to a service plan in SigningHub Admin:

1. From the "Basic Information" section, select and add the "Electronic Seals" feature to service plan.
2. From the "Signatures" section, add the electronic seal signing server.

Configure the Electronic Seal against an Enterprise Role in SigningHub Web

Make the following configurations against an enterprise role:

1. From the "Enterprise Configuration", allow the "Electronic Seals" against this user role.

Create an Electronic Seal in SigningHub Web

Configure an electronic seal, as shown below, for ADSS Electronic Seal or CSC Electronic Seal, respectively.

ADSS Electronic Seal

Make the following configurations to an electronic seal in SigningHub Web:

1. From the "Basic Information" section, select the signing server, and fill in the required fields.

CSC Electronic Seal

Make the following configurations to an electronic seal in SigningHub Web:

1. From the "Basic Information" section, select the signing server, and fill in the required fields.

Add an Electronic Seal to a Workflow in SigningHub Web

After you have added all the documents in a workflow package, follow the below-mentioned steps to add an electronic seal:

1. Click "Add an electronic seal".
2. From the "Select Electronic Seal" drop down, select the electronic seal that you want to add. Only the electronic seals available for use, based on the document owner's user role, will be displayed in this drop down.

Add an Electronic Seal field to a Workflow in SigningHub Web

Follow the below-mentioned steps to add an electronic seal field in a workflow:

1. Select the document from the information panel's 'Pages' tab, on which an electronic seal is required.

2. Select the electronic seal from the information panel's 'Recipeints' tab, for whom you want to add an electronic seal field.

3. Click the "Electronic Seal" field, and drop it on the document.

Electronic Seal Signing in SigningHub Web

After sharing the document, when it is the turn of the electronic seal to be applied, the electronic seal is automatically signed using the configured settings. An electronic seal is signed without any user interaction. An on-screen notification is sent to the document owner when an electronic seal is signed. If for any reason the electronic seal signing fails, the system sends an email to the electronic seal owner and the electronic seal will have to be signed manually.

To check the electronic seal signature verification details:

1. Click on the electronic seal signatures.

2. Click verification in the information panel.

Introduction

SigningHub allows its users to sign Word documents (having the .docx format) containing a signature line. The documents are allowed to retain their original format and are not converted to .pdf. This requires the configuration of a signing profile and a verification profile in ADSS. Configuration of a connector, a signing profile, a verification profile, and a service plan in SigningHub Admin. Once the configurations have been made, create a workflow with a Word document, and share the workflow. After sharing the workflow, sign the document via either SigningHub API or SigningHub Web.

XAdES-X-L (XAdES-X with Long-term Validation Data)

XAdES-X-L, short for "XAdES-X with Long-term Validation Data," is an advanced electronic signature format supported by SigningHub. This signature format aligns with ETSI standards, specifically tailored to meet European requirements for qualified electronic signatures. XAdES-X-L extends the capabilities of XAdES-X signatures by incorporating Long-term Validation Data. This ensures the long-term integrity and availability of validation data associated with the signature.

How it works?

1. Configure a signing profile as a prerequisite, in ADSS.

2. Configure a verification profile, in ADSS.

3. Configure a connector, in SigningHub Admin.

4. Configure a signing profile, in SigningHub Admin.

5. Configure a verification profile, in SigningHub Admin.

6. Add the signing profile and verification profile to the service plan.

7. Create a workflow with a Word document, and share the workflow.

8. Once you've shared the workflow, sign the document via either SigningHub API or SigningHub Web.

Configure a Singing Profile in ADSS

For Word document signing a signing profile is configured in ADSS Signing Service.

To configure a signing profile for signing a Word document, follow these steps:

1. In the "Select Signature Type" section, check "PKCS#1" and copy the Profile ID because it would be used in SigningHub Admin. Then click the "Next" button.
2. In the "Advanced Settings" tab, enable the "Hash Signing Settings", and click the "Save" button.

Configure a Verification Profile in ADSS

For signature verification, a verification profile is configured in ADSS Verification Service.

To configure a verification profile, follow these steps:

1. Copy the Profile ID because it would be used in SigningHub Admin.
2. SigningHub creates the PKCS#1 signature for using the signing service. In the "Signature Settings" tab, make the following changes:

Configure a Connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "ADSS Server" as the "Provider".
2. In the "Details" section, fill in the required fields.

Configure a Signing Profile in SigningHub Admin

Make the following configurations to a signing profile in SigningHub Admin:

1. Paste the earlier copied Profile ID, while creating a Signing Profile in the ADSS, in the highlighted field below:

Configure a Verification Profile in SigningHub Admin

Make the following configurations to a verification profile in SigningHub Admin:

1. Paste the earlier copied Profile ID, while creating a Verification Profile in the ADSS, in the highlighted field below:

Add Signing Profile and Verification Profile to a Service Plan

Make the following configurations to a service plan in SigningHub Admin:

1. Select and add the earlier configured Signing Profile and Verification Profile, in a service plan in SigningHub Admin, as shown below:

SigningHub API Configurations

Make the following configurations to SigningHub API:

1. Get the authentication token of a user using SigningHub API.

2. Add a document package from SigningHub API.

3. Upload the document via stream/base with document extension .docx. Set the "x-convert-document" to false.

4. Share the workflow.

Signing via SigningHub API

To sign the document via SigningHub API:

1. Sign the workflow.

2. In case of bulk signing, use the below API.

Signing via SigningHub Web

To sign the document via SigningHub Web, follow the below-mentioned steps:

1. Open SigningHub Web and open the Word document through the document listing. Click on the signature field and then click "Sign".
2. After signing the document, you can view "Signature Verification" for details.

Introduction

SigningHub allows its users to sign documents in XML format and supports ETSI XAdES signature in Enveloped mode. XAdES stands for “XML Advanced Electronic Signatures” and is a set of standards published by ETSI to support European requirements for qualified electronic signatures. SigningHub supports these ETSI XAdES signatures formats:

XAdES Baseline Signatures (ETSI EN 319 132-1):

• XAdES-B-LTA (Signature providing Long Term Availability and Integrity of Validation Data): In case of XAdES-B-LTA; XAdES-B-B, XAdES-B-T and XAdES-B-LT are being created first. XAdES-B-LTA is created by adding ArchiveTimeStamp in above mentioned signatures.

How it works?

1. Configure a signing profile as a prerequisite, in ADSS.

2. Configure a verification profile, in ADSS.

3. To perform XML signing, you must configure a connector, in SigningHub Admin.

4. Configure a signing profile, in SigningHub Admin.

5. Configure a verification profile, in SigningHub Admin.

6. Add the signing profile and verification profile to the service plan

7. Create a workflow with an XML document, upload an XSLT style sheet, and share the workflow

8. Once you've shared the workflow, log in to your SigningHub Web account and sign the document.

Configure a Singing Profile in ADSS

For XML signing a signing profile is configured in ADSS Signing Service.

To configure the signing profile for XML signature follow these steps:

1. In the "Select Signature Type" section, check "PKCS#1" and copy the Profile ID because it would be used in SigningHub Admin. Then click the "Next" button.
2. In the "Advanced Settings" tab, keep all check boxes unselected and click the "Save" button.

Configure a Verification Profile in ADSS

For XML signature verification, a verification profile is configured in ADSS Verification Service.

To configure verification profile for XML signature follow these steps:

1. Copy the Profile ID because it would be used in SigningHub Admin.
2. SigningHub creates the PKCS#1 signature for using signing service and further XAdES Signature enhancement is done via verification service.

   1. By default, SigningHub produces XAdES-B-LTA signature. For XAdES Baseline Signatures, in the "Signature Settings" tab, make the following changes:
   2. SigningHub will perform a XAdES Extended signature for backward compatibility with ADSS Server version 6.9 or lesser. For XAdES Extended Signatures, in the "Signature Settings" tab, make the following changes:

Configure a Connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "ADSS Server" as the "Provider".

1. In the "Details" section, fill in the required fields.

Configure a Signing Profile in SigningHub Admin

Make the following configurations to a signing profile in SigningHub Admin:

1. Paste the earlier copied Profile ID, while creating a Signing Profile in the ADSS, in the highlighted field below:

Configure a Verification Profile in SigningHub Admin

Make the following configurations to a verification profile in SigningHub Admin:

1. Paste the earlier copied Profile ID, while creating a Verification Profile in the ADSS, in the highlighted field below:

Add Signing Profile and Verification Profile to a Service Plan

Make the following configurations to a service plan in SigningHub Admin:

1. Select and add the earlier configured Signing Profile and Verification Profile, in a service plan in SigningHub Admin, as shown below:

SigningHub API Configurations

Make the following configurations to SigningHub API:

1. Get the authentication token of a user using SigningHub API.

2. Add a document package from SigningHub API.

3. Upload the document via stream/base with document extension .xml. Set the "x-convert-document" to false. To upload an XSLT Style sheet to transform an XML document into an HTML formatted PDF document on SigningHub viewer, the following API will be executed against the same document ID and name, as uploaded in the above step.

4. Add Collaborator(s) as per requirement.

5. Add Digital Signature Field. For XML Signing only one (Digital Signature) can be added for a collaborator per document. A field would be added on the last page on the bottom right corner.

6. Share the workflow.

SigningHub Web Signing

To sign the document, follow the below-mentioned steps:

1. Open SigningHub Web and open the XML document through the document listing. click on the signature field and then click "SIGN".
2. In case of signing an XML document, optionally you may also specify "Commitment Type Indication". SigningHub populates the pre-defined value of this field from your Personal Signing Details. When specified they will become a permanent part of your XML signature.

   When signing an XML file, the different Commitment Type Indications that can be selected are:

   • Proof of origin: indicates that the signer recognizes to have created, approved, and sent the signed data object.

   • Proof of receipt: indicates that the signer recognizes to have received the content of the signed data object.

   • Proof of delivery: indicates that the TSP providing that indication has delivered a signed data object in a local store accessible to the recipient of the signed data object.

   • Proof of sender: indicates that the entity providing that indication has sent the signed data object (but not necessarily created it).

   • Proof of approval: indicates that the signer has approved the content of the signed data object.

   • Proof of creation: indicates that the signer has created the signed data object (but not necessarily approved, nor sent it).
3. After signing the document, you can view "Signature Verification" for details.

Introduction

SigningHub supports performing server-side signing with eID Easy. eID Easy provides a simple API for Qualified Electronic Signature methods as well as for strong customer authentication for Remote Signing Service Providers that do not support the CSC interface.

How it works?

1. To perform eID Easy signing, you must configure an eID Easy connector, in SigningHub Admin.

2. Configure the connector in a signing profile, in SigningHub Admin.

3. Configure a signing profile using the connector, in SigningHub Admin.

4. Add Signing Server to your enterprise user role that you want to use for eID Easy signing.

5. Allow the Qualified Electronic Signature (QES) level of assurance against the user role.

6. Open a document having a Qualified Electronic Signature field and sign the document using the eID Easy Signing Server.

Configure a Connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "eID Easy" as the "Provider".

1. In the "Details" section, fill in the required fields.

Configure a Signing Profile in SigningHub Admin

1. Select the eID Easy Connector created earlier, in the highlighted field below:

Add Signing Profile to a Service Plan in SigningHub Admin

Make the following configurations to a service plan in SigningHub Admin:

1. In the "Signature" section of the service plan, select and add the earlier configured signing profile, as shown below:

Add Signing Server to a User Role in SigningHub Web

Make the following configurations to a user role in SigningHub Web:

1. Against your user role, in the "Signing Server Preferences" tab, add the signing server.

Allow the QES Level of Assurance against a User Role in SigningHub Web

Make the following configurations to a user role in SigningHub Web:

1. Against your user role, in the "Document Settings" tab, add the Qualified Electronic Signature (QES) level of assurance.

eID Easy Signing

To perform eID Easy signatures, follow the below-mentioned steps:

1. From the document listing, open a the document having a Qualified Electronic Signature field that you want to sign.

2. Click on the signature field and click "Sign".

3. Select the eID Easy Signing Server.
4. Upon clicking the "Sign" button, the eId widget will appear. It will show signing methods based on the country configured in the user's personal settings. Select a signing method to proceed with.
5. Based on the selected signing method, complete the authorization process. Once the authorization is complete the document will be signed.
6. After the authorization is complete, the eID Easy API uses a webhook to send the signing certificate details to SigningHub which is used to fetch the "Signed by" information. The webhook URL, "[Web_URL]/v4/custom-cades-digest-webhook", is configured against the "Custom CAdES digest webhook" property in the eID Easy.

7. After signing the document, you can view "Signature Verification".

Signatures are cryptographic codes embedded into the document, to prove the identity of the actual signer of a document and whether or not the document has changed since signing. In SigningHub, each user signs with their own PKI signing key so that each signature uniquely identifies the signing entity. To perform signatures having AES, QES or AATL as the level of assurance applied to the signature field, you must have a SigningHub account.

Add your Signature

1. .

2. Click the "Go to field" button, the cursor will start blinking the signature field assigned to you.
3. Single-click and select the "Sign" option or double-click the Signature field.

   1. SigningHub will prompt you to (if it is configured for you).

   2. The Signing servers dialogue box window will appear and display multiple signing servers which can be selected, based on the level of assurance set by the document owner on that signature field and the level of assurance that is configured in your role.

   3. Signing servers are based on service plan configurations, and will display the signing server for server-side and client-side signing both.

   4. Select one of the signing servers to perform the signature.
   5. Select a visible signature type (i.e., Text, Hand-Drawn, Image) that you wish to use in your signature. In case of uploading a signature image, the white colour in the image background will be auto-converted to transparent.

   6. For Text-based signature type, the name of the recipient will be auto-filled and cannot be changed if it's restricted from enterprise roles signature appearance settings.

   7. Select a desired Signing Capacity for your signature (if it is configured for you to sign in different positions in your organisation). The options available in the "Signing Capacity" drop-down list are those that are allowed in your enterprise user role. All signing capacities will group together based on the level of assurance.

   8. Choose a desired appearance for your signature. The options being populated in the "Signature Appearance Design" field are the allowed appearances to your enterprise user role. You can also see this list in your personal Signature Appearance. The signature appearance will be auto-filled and cannot be changed if it's restricted from enterprise roles signature settings to use a specific appearance for the selected Signing Server.

   9. Click on the SIGN NOW button to proceed with signing.
   10. Upon clicking the SIGN NOW button, either no dialogue box window appears (if No Authentication is set for the selected signing capacity), or a dialogue window appears depending upon the authentications that are configured for the selected signing capacity under enterprise roles>signing servers>authentications.

   11. In case the user has selected the eID Easy Signing Server:

       • Upon clicking the "SIGN" button, the eId widget will appear. It will show signing methods based on the country configured in the user's personal settings. Select a signing method to proceed with.

       • Based on the selected signing method, complete the authorization process. Once the authorization is complete the document will be signed.
       • After the authorization is complete, the eID Easy API uses a webhook to send the signing certificate details to SigningHub which is used to fetch the "Signed by" information. The webhook URL, "[Web_URL]/eid-easy/certificate-detail/webhook", is configured against the "Custom CAdES digest webhook" property in the eID Easy.

   12. In case of signing of XML document, optionally you may also specify "Commitment Type Indication". SigningHub populates values of this field in editable mode from your Personal Signing Details. When specified they will become a permanent part of your XML signature.
   13. In case of an invisible signature, there will be no appearance preferences on the "Sign" dialogue box. Just click the "SIGN" button to proceed to the authentication method.

   14. Based on your Signature Settings, the authentication method may change.

   15. Optionally, you may also specify "Signing Reason", "Contact Information" and "Location". SigningHub populates values of these fields in editable mode from your Personal Signing Details. When specified they will become a permanent part of your PDF signature.
4. Click the "OK" button, if there is an authentication, a dialogue box window appears. In case of 'No Authentication', no further dialog window appears, once you click on the SIGN NOW button.

   1. The document is now signed, and your signature will be displayed in the same area of your document as per the selected signature appearance.

   2. The document status will be changed from "Pending" to "Signed".

   3. The system will notify the respective document owner about your signing through an email.

   4. An intimation email will also be sent from the document owner to the next configured recipient (if any), with the request to respond to the document workflow accordingly. The recipient can then follow the document link from the email to collaborate in the workflow.

   5. If CSP Provisioning is allowed in your service plan, then your certificate will be automatically registered in the CSP Service against your (user) ID which was created at the time of login.

   6. If Remote Authorized Signing (RAS) is allowed in your role, then your certificate will be auto-registered in the SAM service against your (user) ID which was created at the time of login.

   7. If CSP Provisioning is allowed in your service plan and Remote Authorised Signing (RAS) is allowed in your role, then your certificate will be auto-registered in the SAM and CSP services against your (user) ID which was created at the time of login.

5. In case authentication via OTP is required, the user can have the option to choose to receive OTP via Text Message or Email depending on the service plan. Once OTP is received, enter it in the text field. In case OTP is not received you may select the option to resend it. You can also choose another method for OTP by selecting 'Switch Method'.

6. In case authentication via Time-based One-Time Password is required, the user will be able to sign the document after they have entered the Time-based One-Time Password. Whenever the recipient tries to sign this document they will be prompted to enter the Time-based One-Time Password from the authenticator app configured on their mobile device. In case the recipient has not configured two-factor authentication (2FA), upon trying to sign a document that requires Time time-based One-Time Password, an email will be sent to their email address to configure two-factor authentication (2FA). The document will be signed only upon providing the correct Time-based One-Time Password.

7. Click the "Ok" button.

In case the "Automatically proceed with workflow upon completion of mandatory actions by signer" option is turned off in your enterprise user role, then the "Close" button will be displayed to conclude the signing process.

Client-side (Local) Signing using T1C or ADSS (Go>Sign Desktop)

When a signing server is configured in your Signature Settings for locally held keys and you select that signing server, the signing certificate residing in your local keystore or inside the crypto device (token/smartcard) will be used. In other words, the signing activity is performed locally on your machine. For this, ensure the Go>Sign Desktop app is installed and running on your system as a back-end utility. However, if Trust1Connector (T1C) is configured as a signing server to perform local signing, then make sure the T1C app is installed on your local machine and the related HSM is attached to it while signing. Also, you should have full rights to the Trust1Connector service running on your machine. SigningHub will prompt you if any of the above-mentioned prerequisites are missing. At the time of local signing, your browser will interact with Go>Sign Desktop or T1C app to complete your signing process. The app is capable of accessing your keys and certificates via MSCAPI and PKCS#11 on the Windows platform. When you click the signature field to sign a document, the signing server dialogue box will appear. Select the signing server that you have configured to perform client-side signing and click the NEXT button:

1. If your signing key is inside a crypto device, attach the device and specify your device pin.

2. If your signing certificate is inside your local key store and protection has been enabled for it, then select the required certificate from the list and provide your certificate password.

3. Click the "SIGN NOW" button. The document is signed.

Local Signing through the Microsoft Edge browser

If you are using the Microsoft Edge browser for local signing, then you need to perform an additional configuration on your machine to run Go>Sign Desktop, i.e.:

1. Close the Microsoft Edge browser if already launched.

2. Launch the command prompt by using "Run as administrator".

3. Run this command: CheckNetIsolation.exe LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe

4. Launch the Microsoft Edge browser and run your application again to test Go>Sign Desktop.

Server Side Signing using eID, ADSS or CSC

When a signing server is configured in your Signature Settings for server-held keys and you select that signing server, the signing certificate residing on the server will be used. In other words, the signing activity is performed on the server but not on your machine. Signing Servers that appear on the signing dialogue box are subject to your service plan and user's role settings. It shows both types of servers for Server Side Signing including eID, ADSS and CSC, based on the level of assurance set by the document owner on the signature field.

Based on the Authentication Method set under your enterprise role, SigningHub supports multiple types of authentication methods for server-side signing, which are as follows:

• No Authentication

• SigningHub ID

• Salesforce

• Microsoft Active Directory

• Microsoft ADFS

• Microsoft Office 365

• Microsoft Azure Active Directory

• Freja eID

• LinkedIn

• Google

• OAuth2

• OIDC

• Authorisation via Mobile App

To use Remote Authorisation Signing (RAS) as an authentication method, you must use signing capacity having QES (Qualified Electronic Signature) as a level of assurance that is configured under your enterprise roles > signing servers.

You can additionally set up the Secondary Authentication Method, at signing time. The following three options can only be set:

• No Authentication

• One Time Password

• Time-based One-Time Password

No Authentication

In this type of server-side signing authentication, SigningHub will use the same authentication method through which you have logged into your SigningHub account, without requiring any password.

When you click the signature field to sign a document:

1. Click the "Sign Now" button. The document is signed without requiring any password or OTP.

One Time Password

SigningHub allows two-factor authentication for the server-side signing. In this case, an OTP (one-time password) is sent to your (signer) email address and/or the configured mobile number through an SMS, depending on what's configured in the user's service plan. This OTP is used in addition to the account password to sign a document. However, the OTP feature and its length are subject to your subscribed service plan, so the SMS service is chargeable accordingly. SigningHub currently supports 4, 6, and 9 digits OTP.

When you click the signature field to sign a document:

1. Click the "Sign" button. An OTP will be sent to your configured mobile number.

2. Specify the OTP in the next appearing screen.

3. Click the "OK" button. The document is signed.

Time-based One-Time Password

SigningHub allows two-factor authentication for the server-side signing. In this case, whenever the recipient tries to sign this document they will be prompted to enter the Time-based One-Time Password from the authenticator app configured on their mobile device. In case the recipient has not configured two-factor authentication (2FA), upon trying to sign a document that requires Time based One Time Password, an email will be sent to their email address to configure two-factor authentication (2FA). The document will be signed only upon providing the correct Time-based One-Time Password.

When you click the signature field to sign a document:

1. Click the "Sign" button. ( In case you do not have two-factor authentication configured, an email will be sent to their email address to configure two-factor authentication)

2. Specify the Time-based One-Time Password from the configured authenticator app, in the next appearing screen.

3. Click the "Ok" button. The document is signed.

SigningHub ID

In this type of authentication, when you click the signature field to sign a document:

1. Click the "Sign" button, and specify your SigningHub account password in the next appearing screen.

2. Click the "Ok" button. The document is signed.

Salesforce

In this type of authentication, when you click the signature field to sign a document:

1. Click the "SIGN NOW" button, and then click the NEXT" button.

2. The Salesforce popup will appear. Specify your Salesforce credentials (ID and password). The document is signed. Please note, that if you are already logged into SigningHub through your Salesforce account, then this step will be skipped.

Microsoft Active Directory

In this type of authentication, when you click the signature field to sign a document:

1. Click the "Sign" button.

2. Specify your user ID (registered in Active Directory) and domain password. The document is signed.

Microsoft ADFS

In this type of authentication, when you click the signature field to sign a document:

1. Click the "Sign" button.

2. Specify your ADFS credentials (user ID and domain password). The document is signed.

Microsoft Office 365

In this type of authentication, when you click the signature field to sign a document:

1. Click the "Sign" button.

2. The Microsoft Office 365 popup will appear. Specify your Office 365 credentials (ID and password). The document is signed. Please note, that if you are already logged into SigningHub through your Office 365 credentials, then this step will be skipped.

3. The document will be signed.

Microsoft Azure Active Directory

In this type of authentication, when you click the signature field to sign a document:

1. Click the "Sign" button.

2. The Microsoft Azure Directory popup will appear. Specify your Azure Directory credentials (Email and password). The document is signed. Please note, that if you are already logged into SigningHub through your Azure Active Directory credentials, then this step will be skipped.

3. The document will be signed.

Freja eID

In this type of authentication, when you click the signature field to sign a document:

1. Click the "Sign" button. A signing request will be sent to your mobile device running the Freja eID app.

2. Approve it from the Freja eID app. The document is signed.

LinkedIn

In this type of authentication, when you click the signature field to sign a document:

1. Click the "Sign" button.

2. The LinkedIn popup will appear. Specify your LinkedIn credentials (ID and password). The document is signed. Please note, that if you are already logged into SigningHub through your LinkedIn account, then this step will be skipped.

Google

In this type of authentication, when you click the signature field to sign a document:

1. Click the "Sign" button.

2. The Google popup will appear. Specify your Google credentials (ID and password). The document is signed. Please note, that if you are already logged into SigningHub through your Google account, then this step will be skipped.

OAuth2

In this type of authentication, when you click the signature field to sign a document:

1. Click the "Sign" button.

2. An authentication popup for configured third-party server will appear(e.g. Azure, LinkedIn, Google or any other authentication server that supports OAuth2 protocol). Specify your credentials (ID and password). The document is signed. Please note, if you are already logged into SigningHub through the same third-party account, then this step will be skipped.

OIDC

In this type of authentication, when you click the signature field to sign a document:

1. Click the "Sign" button.

2. An authentication popup for configured third-party servers will appear(e.g. Azure, LinkedIn, Google or any other authentication server that supports OIDC protocol). Specify your credentials (ID and password). The document is signed. Please note, that if you are already logged into SigningHub through the same third-party account, then this step will be skipped.

Remote Authorisation Signing (RAS)

In this type of authentication, when your mobile device is registered and you select a signing capacity having QES as a level of assurance to sign a document:

1. Click the "Go to field" button and then click on the "Sign" button. An authentication request will be sent to your registered mobile device for remote authorisation. In case you want to withdraw the remote authorisation request, click on the "Cancel Request" button.

2. Run the SigningHub app (Android or iOS) on your mobile device and log in with the same account credentials through which you have logged in from the SigningHub web.

3. A popup will appear on your mobile device to authorise your signature through touchID or PIN. Upon authorisation, the document is signed.

Introduction

The Cloud Signature Consortium (CSC) is a standard protocol for cloud-based digital signatures that supports web and mobile applications and complies with the most demanding electronic signature regulations in the world. The goal is to provide a common technical specification that will make solutions interoperable and suitable for uniform adoption in the global market, and to meet the highest level requirements of the European Union’s regulation on Identification and Trust Services (eIDAS). SigningHub supports the Cloud Signature Consortium (CSC) API protocol, this enables customers to leverage Remote Signing Service Providers (RSSP) for signing documents. Support for CSC within SigningHub now means customers can not only use SigningHub with Ascertia ADSS Signing Server but also independently with a CSC compliant RSSP.

SigningHub supports Cloud Signature Consortium (CSC) signing via the following two flows:

• CSC Signing - Client Credentials Flow

• CSC Signing - Authorisation Code Flow

CSC Signing - Client Credentials Flow

• How it works?

• Configure a Connector in SigningHub Admin

• Configure a Signing Profile in SigningHub Admin

• Add Signing Profile to a Service Plan in SigningHub Admin

• Add Signing Server to a User Role in SigningHub Web

• Specify the CSC User ID against your profile in SigningHub Web

• CSC Signing

How it works?

1. To perform CSC signing, you must configure a CSC connector, in SigningHub Admin.

2. Configure a signing profile using the connector, in SigningHub Admin.

3. Configure the signing profile to the service plan, in SigningHub Admin.

4. Add Signing Server to your enterprise user role that you want to use for CSC signing.

5. Specify your CSC User ID against your profile.

6. Sign the document using the CSC Signing Server via SigningHub Web or API.

Configure a Connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "CSC" as the "Provider".
2. In the "Details" section, choose "Client Credentials" as the "Auth Type".

Configure a Signing Profile in SigningHub Admin

Make the following configurations to a signing profile in SigningHub Admin:

1. Select the CSC Connector created earlier, in the highlighted field below:

Add Signing Profile to a Service Plan in SigningHub Admin

Make the following configurations to the service plan in SigningHub Admin:

1. In the "Signature" section of the service plan, select and add the earlier configured signing profile, as shown below:

Add Signing Server to a User Role in SigningHub Web

Make the following configurations to a user role in SigningHub Web:

1. Against your user role, in the "Signing Server Preferences" tab, add the signing server.

Specify the CSC User ID against your profile in SigningHub Web

Make the following configurations to your profile in SigningHub Web:

1. In your "Profile Information" tab, specify the "Cloud Signature Consortium (CSC) User ID".

CSC Signing

Sign the document using the CSC Signing Server via SigningHub Web or API.

Signing via SigningHub Web

To perform CSC signatures via SigningHub Web, follow the below-mentioned steps:

1. From the document listing, open a document having the signature field that you want to sign.

2. Double-click on the signature field and select the CSC Signing Server.
3. Click the "Sign" button and based on your CSC Signing Server configurations, provide the authorization details for Explicit (PIN/OTP/Both), Implicit or OAuth 2.0 authorization. Once the authorization is complete the document will be signed.

Signing via API

To perform CSC signatures via API, follow the below-mentioned steps:

1. Use the "Authenticate" API of SigningHub to get the authentication token of the user who is performing the signatures.

2. The signature application (SigningHub) uses the "Get RSSP Information" API to get the RSSP (Remote Signing Service Provider) information that is needed to perform CSC Signing.

3. The signature application (SigningHub) uses the "info" API of the CSC server which returns the information about the RSSP (Remote Signing Service Provider) and the list of API methods it has implemented. This method shall be implemented by any RSSP conforming to this specification.

4. The signature application (SigningHub) gets the access token using the "oauth2/token" API with "client_credentials" as grant_type using the RSSP client credentials (client ID and conditionally a client secret).

5. The signature application (SigningHub) gets the list of credentials associated with a user identifier using the "credentials/list" RSSP API or if the RUT filtration is required call the "Get Filtered Credential List" API of SigningHub. A user may have one or multiple credentials hosted by a single remote signing service provider.

6. The signature application (SigningHub) gets the information on a signing credential, its associated certificate, and a description of the supported authorization mechanism using the "credentials/info" API of the CSC server.

7. If the "authorization_required" parameter is true, in response to the "Get RSSP Information" API, the "Get Account Token" API shall be used to get the account_token which will be used to hit the "oauth2/authorize" endpoint.

8. Use the "Get Document Hash" API of SigningHub to get the hash of the document.

9. Signature application (SigningHub) can use any one of the following APIs of the CSC server for authorization of credential ID, based on the response of the "credentials/info" API of the CSC server:

   1. "credentials/sendOTP" API to start the online OTP mechanism associated with a credential ID for Explicit (OTP) authorization.

   2. "credentials/authorize" API to authorize access to the credential ID for signing for Explicit (OTP/PIN) or Implicit authorization. The SAD received in response shall be used in the "signatures/signHash" API request.

   3. "oauth2/authorize" API to initiate an OAuth 2.0 authorization flow for the OAuth 2.0 authorization. The authorization is returned in the form of an authorization code, which the signature application shall then use to obtain the SAD with "credential" as scope. To get the SAD, use the "oauth2/token" API with "authorization_code" as the grant_type. The SAD received in response shall be used in the "signatures/signHash" API request.

10. The signature application (SigningHub) calculates the remote digital signature of one or multiple hash values provided in input using the "signatures/signHash" API of the CSC server. This method requires credential authorization in the form of Signature Activation Data (SAD).

11. Use the "Embed Signature" API of SigningHub to embed signatures in the document.

12. The signature application (SigningHub) uses one of the following APIs of the CSC server for revoking access tokens, as per the requirement:

    1. "auth/revoke" API to revoke the service access token or refresh token.

    2. "oauth2/revoke" API to revoke an OAuth 2.0 access token or refresh token.

CSC Signing - Authorisation Code Flow

• How it works?

• Configure a Connector in SigningHub Admin

• Configure a Signing Profile in SigningHub Admin

• Add Signing Profile to a Service Plan in SigningHub Admin

• Add Signing Server to a User Role in SigningHub Web

• CSC Signing

How it works?

1. To perform CSC signatures, you must configure a CSC connector, in SigningHub Admin.

2. Configure a signing profile using the connector, in SigningHub Admin.

3. Configure the signing profile to the service plan, in SigningHub Admin.

4. Add Signing Server to your enterprise user role that you want to use for CSC signing.

5. Sign the document using the CSC Signing Server via SigningHub Web or API.

Configure a Connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "CSC" as the "Provider".
2. In the "Details" section, choose "Authorization Code" as the "Auth Type".

Configure a Signing Profile in SigningHub Admin

Make the following configurations to a signing profile in SigningHub Admin:

1. Select the CSC Connector created earlier, in the highlighted field below:

Add Signing Profile to a Service Plan in SigningHub Admin

Make the following configurations to the service plan in SigningHub Admin:

1. In the "Signature" section of the service plan, select and add the earlier configured signing profile, as shown below:

Add Signing Server to a User Role in SigningHub Web

Make the following configurations to a user role in SigningHub Admin:

1. Against your user role, in the "Singing Server Preferences" tab, add the signing server.

CSC Signing

Sign the document using the CSC Signing Server via SigningHub Web or API.

Signing via SigningHub Web

To perform CSC signatures via SigningHub Web, follow the below-mentioned steps:

1. From the document listing, open a the document having the signature field that you want to sign.

2. Click on the signature field, select the CSC Signing Server.
3. Input the CSC user credentials, provided by the CSC Signing Server.
4. Click the "Sign" button and based on your CSC Signing Server configurations, provide the authorization details for Explicit (PIN/OTP/Both), Implicit or OAuth 2.0 authorization. Once the authorization is complete the document will be signed.

Signing via API

To perform CSC signatures via API, follow the below-mentioned steps:

1. Use the "Authenticate" API of SigningHub to get the authentication token of the user who is performing the signatures.

2. The signature application (SigningHub) uses the "Get RSSP Information" API to get the RSSP (Remote Signing Service Provider) information that is needed to perform CSC Signing.

3. The signature application (SigningHub) uses the "info" API of the CSC server which returns the information about the RSSP (Remote Signing Service Provider) and the list of API methods it has implemented. This method shall be implemented by any RSSP conforming to this specification.

4. If the "authorization_required" parameter is true, in response to the "Get RSSP Information" API, the "Get Account Token" API shall be used to get the account_token which will be used to hit the "oauth2/authorize" endpoint.

5. The signature application (SigningHub) requests authorization for the user to access the RSSP resources using the "oauth2/authorize" API of the CSC server. The authorization is returned in the form of an authorization code, which the signature application shall then use to obtain an access token with "service" as scope. To get the access token the signature application (SigningHub) uses the "oauth2/token" API with "authorization_code" as the grant_type. If the "authentication_required" parameter is true, in response to the "Get RSSP Information" API, call the "Get Access Token | SAD" SigningHub API to get the Bearer/SAD token.

6. The signature application (SigningHub) gets the list of credentials associated with a user identifier using the "credentials/list" RSSP API or if the RUT filtration is required call the "Get Filtered Credential List" API of SigningHub. A user may have one or multiple credentials hosted by a single remote signing service provider.

7. The signature application (SigningHub) gets the information on a signing credential, its associated certificate, and a description of the supported authorization mechanism using the "credentials/info" API of the CSC server.

8. Use the "Get Document Hash" API of SigningHub to get the hash of the document.

9. The signature application (SigningHub) can use any one of the following APIs of the CSC server for authorization of credential ID, based on the response of the "credentials/info" API of the CSC server:

   1. "credentials/sendOTP" API to start the online OTP mechanism associated with a credential ID for Explicit (OTP) authorization.

   2. "credentials/authorize" API to authorize access to the credential ID for signing for Explicit (OTP/PIN) or Implicit authorization. The SAD received in response shall be used in the "signatures/signHash" API request.

   3. "oauth2/authorize" API to initiate an OAuth 2.0 authorization flow for the OAuth 2.0 authorization. The authorization is returned in the form of an authorization code, which the signature application shall then use to obtain the SAD with "credential" as scope. To get the SAD, use the "oauth2/token" API with "authorization_code" as the grant_type. The SAD received in response shall be used in the "signatures/signHash" API request.

10. The signature application (SigningHub) calculates the remote digital signature of one or multiple hash values provided in input using the "signatures/signHash" API of the CSC server. This method requires credential authorization in the form of Signature Activation Data (SAD).

11. Use the "Embed Signature" API of SigningHub to embed signatures in the document.

12. The signature application (SigningHub) uses one of the following APIs of the CSC server for revoking access tokens, as per the requirement:

    1. "auth/revoke" API to revoke the service access token or refresh token.

    2. "oauth2/revoke" API to revoke an OAuth 2.0 access token or refresh token.

• Introduction

• How it works?

• Place the Policy Document in SigningHub Directory

• Modify the Web.config file in SigningHub Directory

• Place the Policy Document in ADSS Server Directory

• Modify the policy.properties file in ADSS Server Directory

• Configure a Go>Sign Profile in ADSS

• Configure a Connector in SigningHub Admin

• Configure a Signing Profile in SigningHub Admin

• Add Signing Profile to a Service Plan

• Add Signing Server to a User Role in SigningHub Web

• Signing via SigningHub Web

Introduction

SigningHub supports all kinds of server side and local side signing using the Policy OID. When a user signs a document using SigningHub, the system applies a signature policy OID to ensure that the signature adheres to the predefined rules. This includes requirements such as cryptographic algorithms, key lengths, time-stamping, and other security measures specified by the policy. For recipients of signed documents, the signature policy OID serves as a reference point during verification. It allows them to confirm that the signature meets the necessary standards for validity and compliance. For this usecase, we are going to perform local side signing with ADSS using Policy OID.

How it works?

1. Place the Policy Document, in SigningHub Directory.

2. Modify the Web.config file, in SigningHub directory.

3. Place the Policy Document, in ADSS Server Directory.

4. Modify the policy.properties file, in ADSS Server directory.

5. Configure a Go>Sign signing profile as a prerequisite, in ADSS.

6. Configure a connector, in SigningHub Admin.

7. Configure a signing profile, in SigningHub Admin.

8. Add the signing profile to the service plan.

9. Add signing server to your enterprise user role.

10. Sign the document via SigningHub Web.

Place the Policy Document in SigningHub Directory

The policy document PDF needs to be placed, in the SigningHub deployment directory, at the following path:

[SigningHub Deployment Directory]\default\signaturepolicydocuments

Modify the Web.config file in SigningHub Directory

To apply the policy OID while signing, the Web.config file needs to be modified, in the SigningHub Directory.

Make the following modifications to the web.config file:

1. Provide the values of the "SignaturePolicyOID", "SignaturePolicyURI", "SignaturePolicyName" tags. Then save the changes and close the "Web.config" file. The "SignaturePolicyName" should be the same as the name of the policy document placed in the SigningHub deployment directory.

Place the Policy Document in ADSS Server Directory

The policy document PDF needs to be placed in the ADSS deployment directory, as the ADSS Server is being used for verification, at the following path:

[ADSS Deployment Directory]\service\policy

Modify the policy.properties file in ADSS Server Directory

To apply the policy OID while signing, the policy.properties file needs to be modified in the ADSS Server Directory.

Make the following modifications to the policy.properties file:

1. Add the "Policy IDs" and their "Directory Paths" in the policy.properties file. Then save the changes and close the "policy.properties" file. Add this information using the mentioned format ( Signature Policy ID = Location of the Signature Policy Document). A sample of the format has been highlighted below:

Configure a Go>Sign Profile in ADSS

For local signing, a Go>Sign profile is configured in Go>Sign Service. (In case of server side, a signing profile will need to be configured)

Make the following configurations to a Go>Sign profile:

1. From the "General" section, copy the Go>Sign Profile ID because it would be used in SigningHub Admin.

2. In the "Keystore Settings" section, check the "OS native API (MS CAPI & Mac Keychain)" option, as we want to use the certificates installed on your local machine.

Configure a Connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "ADSS Server" as the "Provider".

1. In the "Details" section, fill in the required fields.

Configure a Signing Profile in SigningHub Admin

Make the following configurations to a signing profile in SigningHub Admin:

1. Paste the earlier copied Go>Sign Profile ID, while creating a Go>Sign Profile in the ADSS, in the highlighted field below:

Add Signing Profile to a Service Plan

Make the following configurations to a service plan in SigningHub Admin:

1. Select and add the earlier configured Signing Profile, in a service plan in SigningHub Admin, as shown below:

Add Signing Server to a User Role in SigningHub Web

Make the following configurations to a user role in SigningHub Web:

1. Against your user role, in the "Signing Server Preferences" tab, add the signing server

Signing via SigningHub Web

To sign the document via SigningHub Web, follow the below-mentioned steps:

1. Open SigningHub Web and open a document having a signature field that you want to sign.

2. Double-click on the signature field and select the Signing Server.
3. Then click on the signature field and then click "Sign".
4. After signing the document, you can view the "Verification Certificate".

5. The signatures can also be verified through the ADSS verification service's transaction logs which will reflect the "Signature Policy ID" and the "Signature Policy URI".

Introduction

SigningHub provides Remote Authorised Signing (RAS) feature, to allow you to authorise a remote signature (done on server) using your registered mobile device(s), running any of the SigningHub native apps (i.e. Android or iOS). The device will have its user authentication built-in (touchID or PIN), so in a way you can also get two-factor authentication. The feature is available on those Android devices that support fingerprints verification, while in case of iOS devices, it can work with both touch ID or passcode verification. For RAS Signing configurations are required in the ADSS Server, SigningHub Admin, and SigningHub Web. Remote Authorisation Signing (RAS) supports the "Advanced Electronic Signature (AES)", "Qualified Electronic Signature (QES)", and "High Trust Advanced Signature (AATL)" levels of assurance. The availability of Remote Authorised Signing (RAS) feature is subject to your subscribed service plan and assigned role.

How it works?

1. Configure a SAM profile, in ADSS.

2. Configure a RAS profile, in ADSS.

3. Configure a signing profile, in ADSS.

4. Configure a certification profile, in ADSS.

5. Configure a connector, in SigningHub Admin.

6. Configure a signing profile, in SigningHub Admin.

7. Configure a certification profile, in SigningHub Admin.

8. Configure a verification profile, in SigningHub Admin.

9. Add the signing profile to a service plan, in SigningHub Admin.

10. Add the verification profile to a service plan, in SigningHub Admin.

11. Add Signing Server to your user role, in SigningHub Web.

12. Allow the configured level of assurance against the user role, in SigningHub Web.

13. Sign the document via SigningHub Web.

Configure a SAM Profile in ADSS

For remote signing a SAM profile is configured in ADSS SAM Service.

To configure a SAM profile for remote signing, follow these steps:

1. Copy the SAM Profile ID because it would be used in the upcoming steps.

2. In the "User Signature Key Pair Settings" section, select "SCAL2" option against the "Sole Control Assurance Level". Then click the "Save" button.

Configure a RAS Profile in ADSS

For remote signing a RAS profile is configured in ADSS RAS Service.

To configure a RAS profile for remote signing, follow these steps:

1. Copy the RAS Profile ID because it would be used in the upcoming steps.

2. In the "SAM Service Settings" section, enter the SAM Profile ID, copied earlier, and provide the required details.

3. In the "Credentials Authorisation Settings" section, check the "Implicit" option. Then click the "Save" button.

Configure a Signing Profile in ADSS

For remote signing a signing profile is configured in ADSS Signing Service.

To configure a signing profile for remote signing, follow these steps:

1. Copy the Signing Profile ID because it would be used in the upcoming steps.

2. In the "Select Signature Type" section, check "PKCS#1". Then click the "Next" button.

1. In the "Advanced Settings" tab, check the "Enable remote signing" checkbox, enter the RAS Profile ID, copied earlier, and provide the required details. Then click the "Save" button.

Configure a Certification Profile in ADSS

For remote signing a certification profile is configured in ADSS Certification Service.

To configure a certification profile for remote signing, follow these steps:

1. Copy the Certification Profile ID because it would be used in the upcoming steps.

2. In the "RAS Service Settings" section, check the "Enable key pair generation through RAS Service" checkbox, enter the RAS Profile ID, copied earlier, and provide the required details. Then click the "Save" button.

Configure a Connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "ADSS Server" as the "Provider".

1. In the "Details" section, provide the "RAS Address" and fill in the required fields.

Configure a Signing Profile in SigningHub Admin

Make the following configurations to a signing profile in SigningHub Admin:

1. In the "Signing Method" section, check the "Enable Remote Authorisation" checkbox.

2. Enter the Signing Profile ID, copied earlier, in the highlighted field.

Configure a Certification Profile in SigningHub Admin

Make the following configurations to a certification profile in SigningHub Admin:

1. Select "Qualified Electronic Signature (QES)" as the "Level of Assurance".

2. Select "Remote Authorisation" as the "Key Protection Option".

3. Select the configured ADSS connector for certification purposes as the "Certification Authority Server".

4. Enter the Certification Profile ID, copied earlier, as the "Certification Service Profile ID". Then click "Save".

Configure a Verification Profile in SigningHub Admin

Make the following configurations to a verification profile in SigningHub Admin:

1. Select the configured ADSS connector for verification purposes as the "Signature Verification Server".

2. Enter the Certification Profile ID, copied earlier, as the "Verification Service Profile ID". Then click "Save".

Add Signing Profile to a Service Plan in SigningHub Admin

Make the following configurations to a service plan in SigningHub Admin:

1. Select and add the signing profile, configured earlier, in a service plan in SigningHub Admin.

2. Select the level of assurance which was selected in the certification profile, configured earlier. (For the purposes of this use case, the level of assurance is Qualified Electronic Signature (QES)).

3. In the "Signing Capacities" field, select the certification profile, configured earlier.

Add Verification Profile to a Service Plan in SigningHub Admin

Make the following configurations to a service plan in SigningHub Admin:

1. Select and add the verification profile, configured earlier, in a service plan in SigningHub Admin, as shown below:

Add Signing Server to a User Role in SigningHub Web

Make the following configurations to a user role in SigningHub Web:

1. Against your user role, in the "Signing Server Preferences" tab, add the signing server, configured earlier.

2. In the "Server" section, select the signing profile, configured earlier, as the "Signing Server".

Allow the Configured Level of Assurance against a User Role in SigningHub Web

Make the following configurations to a user role in SigningHub Web:

1. Against your user role, in the "Document Settings" tab, add the configured level of assurance. (For the purposes of this use case, the level of assurance is Qualified Electronic Signature (QES)).

RAS Signing via SigningHub Web

To sign the document via SigningHub Web, follow the below-mentioned steps:

1. Open SigningHub Web and open a document the document you want to sign. The level of assurance of the signature field must be the same as configured earlier. (For the purposes of this use case, the level of assurance is Qualified Electronic Signature (QES)).

2. Click on the "Signature" field, select the "Signing Capacity", configured earlier, and then click on the "Sign" button. An authentication request will be sent to your registered mobile device for remote authorisation. In case you want to withdraw the remote authorisation request, click on the "Cancel Request" button.
3. Run SigningHub app (Android or iOS) on your mobile device and log in using the credentials which you have used on SigningHub Web. Click on "Remote Authorisation" to view the authorisation requests.
4. If your device is not authorised for RAS Signing, follow the below-mentioned configurations for device registration:

   • To select the configured RAS profile against a client, in ADSS Client Manager:

     • In the "RAS Service Settings" section against a client, select the configured RAS profile.
   • Log into the SigningHub app using the credentials against which you want to register the device. Click on "Remote Authorisation" and your device will be registered after biometric or PIN verification

5. A pop-up will appear on your mobile device to authorise your signature through touchID or PIN. Upon authorisation, the document is signed.
6. After signing the document, click the three dots menu and select "Signature Verification" to view "Signature Verification" details. The signatures are verified through the ADSS verification service.

Introduction

OTP stands for "One-Time Password," and TOTP stands for "Time-based One-Time Password." Both are authentication methods that provide an additional layer of security beyond traditional passwords. In essence, OTPs, including TOTPs, are dynamic and time-sensitive, providing an effective means of securing digital accounts and transactions. When the documents are shared on the web with other users, it's important to upscale the security levels to prevent fraudulent attempts and bad actors from compromising your document security. SigningHub provides you with an option to configure One Time Password (OTP) and Time-based One Time Password (TOTP) for login authentication, document opening authentication, and document signing authentication.

How it works?

1. Configure the SMS and Email connectors, in SigningHub Admin

2. Configure OTP and TOTP against your service plan, in SigningHub Admin

3. Authentication via One Time Password (OTP) and Time-based One-Time Password (TOTP)

4. Login Authentication

5. Document Access Authentication

6. Document Signing Authentication

   • Signing Server-level Authentication

   • Recipient Permission-level Authentication

   • Field-level Authentication

   • OTP preference

Configuring Connectors in SigningHub Admin

Configure the "SMS Gateway" connector to be used for sending SMS OTPs, and the "Email Gateway" connector to be used for sending Email OTPs.

Configure an SMS Connector

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "Twilio" as the "Provider".

1. In the "Details" section, fill in the required fields.

Configure an Email Connector

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "SMTP Server" as the "Provider".

1. In the "Details" section, fill in the required fields.

Service Plan Configuration in SigningHub Admin

Make the following configurations against the service plan.

1. From the Settings screen, check the "Enable One Time Password (OTP)" and the "Enable Time based One Time Password (TOTP)" checkboxes, as required.

Authentication via One Time Password (OTP) and Time based One Time Password (TOTP)

One Time Password (OTP) and Time based One Time Password (TOTP) can be used for login authentication, document access authentication, and document signing authentication.

Login Authentication

Configuration:

Make the following configurations to the user role settings SigningHub Web:

1. In "Basic Information" tab, against your user role, choose either "One-Time Password" or "Time-based One-Time Password" as the "Secondary factor authentication".

Authentication:

1. Once a secondary authentication method has been configured for login, the user will be prompted for secondary authentication upon login, after primary authentication.

Document Access Authentication

Configuration:

Make the following configurations to a workflow in SigningHub Web:

1. From the "Set Access Security" dialog, enable the "Access Authentication", and from the following options choose either "One-Time Password" or "Time-based One-Time Password".

Authentication:

1. Once a document access authentication has been configured for a workflow, the user will be prompted for authentication upon opening the document.

Document Signing Authentication

Document signing authentication can be classified into three different categories; Signing Server-level Authentication, Recipient Permission-level Authentication, and Field-level Authentication.

Signing Server-level Authentication

Configuration:

Make the following configurations to the user role settings SigningHub Web:

1. In the "Authentications" section, choose either "One-Time Password" or "Time-based One-Time Password" as the "Secondary Authentication Method".

Authentication:

1. Once a secondary authentication method has been configured against a signing server, the user will be prompted for authentication at the time of signing.

Recipient Permission-level Authentication

Configuration:

Make the following configurations to a workflow in SigningHub Web:

1. From the "Set Access Security" dialog, check the "Document Signing OTP Authentication", and from the following options choose either "One-Time Password" or "Time-based One-Time Password".

Authentication:

1. Once a recipient permission-level signing authentication has been configured for a workflow, the user will be prompted for authentication at the time of signing.

Field-level Authentication

Configuration:

Make the following configurations to a signature/in-person signature field in SigningHub Web:

1. From the Signature/In-Person field dialog, enable "Authenticate signer via OTP" and from the following options choose either "One-Time Password (SMS and Email)" or "Time-based One-Time Password".

Authentication:

1. Once a field-level authentication authentication has been configured, the user will be prompted for authentication at the time of signing.

OTP Preference

The following OTP preference will be followed while signing, in case of configuration of Signing Server-level Authentication, Recipient Permission-level Authentication, and Field-level Authentication.

Introduction

SigningHub supports performing local side signing with Trust1Connector (T1C). For this, SigningHub needs to be registered with the T1C platform and a T1C connector needs to be created in SigningHub to allow SigningHub to connect with the T1C app. The T1C app has to be installed on your local machine and the related HSM is attached to it while signing. Also, you should have full rights on the Trust1Connector service running on your machine. SigningHub will prompt you if any of the above-mentioned prerequisites is missing. T1C provides a solution to read the hardware tokens with minimum footprint and installations. It can interact with the hardware tokens by using javascript APIs which are implemented in SigningHub for local signing. TC1 can be used as an alternative to the Go>Sign Desktop for local signing. SigningHub supports the T1C SDK v3.8.6.

How it works?

1. Configure a connector, in SigningHub Admin.

2. Configure a signing profile, in SigningHub Admin.

3. Add the signing profile to the service plan.

4. Add the signing server to your enterprise user role.

5. Sign the document via SigningHub Web.

Configure a Connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "T1C" as the "Provider".

1. In the "Details" section, fill in the required fields.

Configure a Signing Profile in SigningHub Admin

Make the following configurations to a signing profile in SigningHub Admin:

1. Select the T1C Connector created earlier, in the highlighted field below:

Add Signing Profile to a Service Plan in SigningHub Admin

Make the following configurations to a service plan in SigningHub Admin:

1. In the "Signature" section of the service plan, select and add the earlier configured signing profile, as shown below:

Add Signing Server to a User Role in SigningHub Web

Make the following configurations to a user role in SigningHub Web:

1. Against your user role, in the "Signing Server Preferences" tab, add the signing server.

Signing using T1C Server

To perform T1C signatures, follow the below-mentioned steps:

1. From the document listing, open a the document having a Signature field that you want to sign.

2. Double click on the signature field, select the T1C Signing Server.
3. Upon selecting the T1C Signing Server, the user consent dialog will appear. It will appear once for each user session. Click on the "Yes" button to proceed.
4. Click on the "Sign" button.

5. The system will prompt the user to input the token PIN to authorise the signing process.
6. After signing the document, you can view "Signature Verification".

Introduction

SigningHub supports local signing through the Go>Sign Desktop app. The Go>Sign Desktop app has to be installed and should be running on your machine. The certificates that you want to perform signatures with should either be installed on your local machine, or be stored in the HSM token attached to your machine, based on the configurations of your Go>Sign profile. SigningHub supports the latest version of the Go>Sign Desktop app.

How it works?

1. Configure a Go>Sign signing profile as a prerequisite, in ADSS.

2. Configure a connector, in SigningHub Admin.

3. Configure a signing profile, in SigningHub Admin.

4. Add the signing profile to the service plan.

5. Add signing server to your enterprise user role.

6. Sign the document via SigningHub Web.

Configure a Go>Sign Profile in ADSS

For local signing, a Go>Sign profile is configured in Go>Sign Service.

Make the following configurations to a Go>Sign profile:

1. From the "General" section, copy the Go>Sign Profile ID because it would be used in SigningHub Admin.

2. In the "Keystore Settings" section:

   1. If you want to sign documents using the certificates installed on your local machine, check the "OS native API (MS CAPI & Mac Keychain)" option.
   2. If you want to sign documents using the certificates from your HSM token, check the "PKCS#11" option. Copy and paste the sample "Device Name" and the "Library Name" in their respective fields, and click the "Add" button.

Configure a Connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "ADSS Server" as the "Provider".
2. In the "Details" section, fill in the required fields.

Configure a Signing Profile in SigningHub Admin

Make the following configurations to a signing profile in SigningHub Admin:

1. Paste the earlier copied Go>Sign Profile ID, while creating a Go>Sign Profile in the ADSS, in the highlighted field below:

Add Signing Profile to a Service Plan

Make the following configurations to a service plan in SigningHub Admin:

1. Select and add the earlier configured Signing Profile, in a service plan in SigningHub Admin, as shown below:

Add Signing Server to a User Role in SigningHub Web

Make the following configurations to a user role in SigningHub Web:

1. Against your user role, in the "Signing Server Preferences" tab, add the signing server.

Go>Sign Signing via SigningHub Web

To sign the document via SigningHub Web, follow the below-mentioned steps:

1. Open SigningHub Web and open a document having a signature field that you want to sign.

2. Double-click on the signature field and select the Go>Sign Signing Server. Upon selecting the signing server, the system will fetch all the certificates from your local machine or the HSM token attached, based on the configurations of your Go>Sign profile.
3. Then click on the signature field and then click "Sign".
4. After signing the document, you can view the"Signature Verification" details. The signatures are verified through the ADSS verification service.

Signing Behavior w.r.t Signature Appearance

The signing behaviour of the system with respect to whether the signature appearance and the logo have been configured against a signing server, in the SigningHub Web, is as below:

Simple Electronic Signatures (Signature and In-Person Signatures)

PKI Signatures (Signature and In-Person Signatures)

Bulk Signing Behavior w.r.t Signature Appearance

The bulk signing behavior of the system with respect to whether the signature appearance and the logo have been configured against a signing server, in the SigningHub Web, is as below:

Simple Electronic Signatures (Signature and In-Person Signatures)

PKI Signatures (Signature and In-Person Signatures)

Simple Electronic Signatures (Signature and In-Person Signatures) & PKI Signatures (Signature and In-Person Signatures)

Signing Behavior w.r.t Signature Appearance

The signing behavior of the system with respect to whether the signature appearance and the logo have been configured against a signing server, in the SigningHub Admin, is as below:

Simple Electronic Signatures (Signature and In-Person Signatures)

PKI Signatures (Signature and In-Person Signatures)

Bulk Signing Behaviour w.r.t Signature Appearance

The bulk signing behavior of the system with respect to whether the signature appearance and the logo have been configured against a signing server, in the SigningHub Admin, is as below:

Simple Electronic Signatures (Signature and In-Person Signatures)

PKI Signatures (Signature and In-Person Signatures)

Simple Electronic Signatures (Signature and In-Person Signatures) & PKI Signatures (Signature and In-Person Signatures)

Introduction

SigningHub supports local signing through unique RUT values that are exclusively assigned to each user. The users who wish to use the RUT based Go>Sign signing, need to modify the web.config files. The Go>Sign Desktop app has to be installed and should be running on your machine. Your RUT-based certificates that you want to perform signatures with, having the Subject Alternative Name value, must also be installed on your local machine. SigningHub supports the latest version of the Go>Sign Desktop app.

How it works?

1. Configure a Go>Sign signing profile as a prerequisite, in ADSS.

2. Modify the Web.config file, in SigningHub directory.

3. Configure a connector, in SigningHub Admin.

4. Configure a signing profile, in SigningHub Admin.

5. Add the signing profile to the service plan.

6. Add signing server to your enterprise user role.

7. Add the National ID to your Profile.

8. Sign the document via SigningHub Web.

Configure a Go>Sign Profile in ADSS

For local signing with RUT, a Go>sign profile is configured in Go>Sign Service.

Make the following configurations to a Go>Sign profile:

1. From the "General" section, copy the Go>Sign Profile ID because it would be used in SigningHub Admin.

2. In the "Keystore Settings" section, check "OS native API (MS CAPI & Mac Keychain)".

Modify the Web.config File in SigningHub Directory

To enforce the users to use the RUT values for signing, the Web.config file needs to be modified in the SigningHub Directory.

Make the following modifications to the web.config file:

1. Change the value of "ValidateRUT" tag to "True". Then save the changes and close the "Web.config" file.

Configure a Connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "ADSS Server" as the "Provider".

1. In the "Details" section, fill in the required fields.

Configure a Signing Profile in SigningHub Admin

Make the following configurations to a signing profile in SigningHub Admin:

1. Paste the earlier copied Go>Sign Profile ID, while creating a Go>Sign Profile in the ADSS, in the highlighted field below:

Add Signing Profile to a Service Plan

Make the following configurations to a service plan in SigningHub Admin:

1. Select and add the earlier configured Signing Profile, in a service plan in SigningHub Admin, as shown below:

Allow Users to Add National ID

Make the following configurations to global settings in SigningHub Admin:

1. Check the "Allow Users to Add National ID" checkbox to allow the users to add their National ID to their profiles, as shown below:

Add Signing Server to a User Role in SigningHub Web

Make the following configurations to a user role in SigningHub Web:

1. Against your user role, in the "Signing Server Preferences" tab, add the signing server.

Add National ID to your Profile

Make the following configurations to your profile in SigningHub Web:

1. Copy the National ID, which is defined as the value of "Subject Alternative Name" from your certificate, and paste it in the "National ID" field, as shown below:

Go>Sign Signing via SigningHub Web

To sign the document via SigningHub Web, follow the below-mentioned steps:

1. Open SigningHub Web and open a document having a signature field that you want to sign.

2. Double-click on the signature field and select the Go>Sign Signing Server. Upon selecting the signing server, the system will fetch all the certificates which have the same "Subject Alternative Name" value as the National ID, specified in your profile. If a National ID has not been provided or an invalid National ID has been provided, the system will not let the user sign the documents using the ADSS or CSC Signing Servers, given that the "ValidateRUT" tag in the web.config file has been set to "True".
3. Then click "Sign".
4. After signing the document, you can view "Signature Verification" details. The signatures are verified through the ADSS verification service.

Introduction

SigningHub allows users to sign via a signature pad. It involves integrating a specialized device that electronically captures handwritten signatures. This integration is seamless within the SigningHub platform, ensuring a straightforward process for users. Once integrated, users need to make the necessary configurations and connect the signature pad to their computer or tablet, typically via USB or Bluetooth to perform the signatures. While the user writes their signature on the pad using a stylus or pen-like tool, the signature's unique characteristics (such as shape, pressure, and speed) are recorded digitally. SigningHub then applies this captured signature to the document, ensuring it remains secure and legally binding.

How it works?

1. Configure a connector, in SigningHub Admin.

2. Add the connector to the service plan.

3. Configure the signature pad in the user role.

4. Set the signature pad as the default method.

5. Sign the document via signature pad.

Configure a Connector in SigningHub Admin

Make the following configurations to a connector in SigningHub Admin:

1. In the "Basic Information" section, choose "Signature Pad" as the "Provider".

1. In the "Details" section, fill in the required fields.

Add Connector to a Service Plan in SigningHub Admin

Make the following configurations to a service plan in SigningHub Admin:

1. In the "Signature" section of the service plan, enable the "Enable the Signature Pad to capture hand signature images while signing" option and add the earlier configured connector, as shown below:

Configure Signature Pad in a User Role in SigningHub Web

Make the following configurations to a user role in SigningHub Web:

1. Against your user role, in the "Signature Appearance" tab, enable the Signature Pad option.

Set Signature Pad as the Default Method in SigningHub Web

Make the following configurations to 'My Settings' in SigningHub Web:

1. Against your 'Settings', in the "Signature Preferences" tab, set Signature Pad as the default hand signature method for Web Browsers.

Signing via Signature Pad

To perform signatures via a Signature Pad, follow the below-mentioned steps:

1. From the document listing, open a document having a signature field that you want to sign.

2. Double-click on the signature field, and select a Signing Server for performing signatures.

3. Upon selecting a signing server, the browser will show a pop-up to connect the Signature Pad device. Click on the "Connect" button to connect the signature pad.
4. Once the signature pad has been connected, the user can perform signatures on the signature pad, and the signatures will be visible on the "SIGN" dialogue box in SigningHub.

   • Clear: If the 'Clear' button is pressed, either on the SIGN dialogue box or on the signature pad, the signature pad will clear up, allowing you to retry your signatures.

   • Cancel: If the 'Cancel' button is pressed, either on the SIGN dialogue box or on the signature pad, the SIGN dialogue box will close without the signatures being performed.

   • OK: If the 'OK' button is pressed, either on the SIGN dialogue box or on the signature pad, the signatures will be applied to the document and the SIGN dialogue box will close.