The Cloud Signature Consortium (CSC) is a standard protocol for cloud-based digital signatures that supports web and mobile applications and complies with the most demanding electronic signature regulations in the world. The goal is to provide a common technical specification that will make solutions interoperable and suitable for uniform adoption in the global market, and to meet the highest level requirements of the European Union’s regulation on Identification and Trust Services (eIDAS). SigningHub supports the Cloud Signature Consortium (CSC) API protocol, this enables customers to leverage Remote Signing Service Providers (RSSP) for signing documents. Support for CSC within SigningHub now means customers can not only use SigningHub with Ascertia ADSS Signing Server but also independently with a CSC compliant RSSP.
SigningHub supports Cloud Signature Consortium (CSC) signing via the following two flows:
CSC Signing - Client Credentials Flow
CSC Signing - Authorisation Code Flow
How it works?
Configure a Connector in SigningHub Admin
Configure a Signing Profile in SigningHub Admin
To perform CSC signing, you must configure a CSC connector, in SigningHub Admin.
Configure a signing profile using the connector, in SigningHub Admin.
Configure the signing profile to the service plan, in SigningHub Admin.
Make the following configurations to a connector in SigningHub Admin:
In the "Basic Information" section, choose "CSC" as the "Provider".
In the "Details" section, choose "Client Credentials" as the "Auth Type".
A call back URL has to be registered with the CSC (Cloud Signature Consortium) signing server. The URL where the user will be redirected after the authorisation process has completed. Here is the format of call back URL: "{DEPLOYMENT_WEB_URL}/CSC/OAuth/CallBack" For example if your SigningHub site is "https://web.signinghub.com" then the Callback URL for SigningHub will be "https://web.signinghub.com/CSC/OAuth/CallBack".
Make the following configurations to a signing profile in SigningHub Admin:
Select the CSC Connector created earlier, in the highlighted field below:
Make the following configurations to the service plan in SigningHub Admin:
In the "Signature" section of the service plan, select and add the earlier configured signing profile, as shown below:
Make the following configurations to a user role in SigningHub Web:
Against your user role, in the "Signing Server Preferences" tab, add the signing server.
Make the following configurations to your profile in SigningHub Web:
In your "Profile Information" tab, specify the "Cloud Signature Consortium (CSC) User ID".
Sign the document using the CSC Signing Server via SigningHub Web or API.
To perform CSC signatures via SigningHub Web, follow the below-mentioned steps:
From the document listing, open a document having the signature field that you want to sign.
Double-click on the signature field and select the CSC Signing Server.
Click the "Sign" button and based on your CSC Signing Server configurations, provide the authorization details for Explicit (PIN/OTP/Both), Implicit or OAuth 2.0 authorization. Once the authorization is complete the document will be signed.
The signing logs are maintained under "User Activity Logs", "Workflow History", and "Workflow Evidence Report".
The National ID will be validated for CSC Signing Servers, if the "ValidateRUT" tag in the appsettings.Production.json file has been set to "True". Upon selecting the signing server, the system will fetch all the certificates in the "Get Credentials List" call, which have the same "Subject Alternative Name" value as the National ID, specified in your profile. If a National ID has not been provided or an invalid National ID has been provided, the system will not let the user sign the documents using the CSC Signing Servers, given that the "ValidateRUT" tag in the
To perform CSC signatures via API, follow the steps:
1. Use the "" API to get the authentication token of the user who is performing the signatures.
2. The signature application uses the "" API to get the RSSP (Remote Signing Service Provider) information that is needed to perform CSC Signing.
3. The signature application uses the "" API, which returns the information about the RSSP (Remote Signing Service Provider) and the list of API methods it has implemented. This method shall be implemented by any RSSP conforming to this specification.
4. The signature application gets the access token using the "" API, Server will itself decide the grant_type (client_credentials / authorization_code) depending on its configurations.
5. The signature application gets the list of credentials associated with using the "" API. if the RUT filtration is required, this API will filter the credentials as per the RUT values. A user may have one or multiple credentials hosted by a single remote signing service provider.
6. The signature application gets the information on a signing credential, its associated certificate, and a description of the supported authorisation mechanism using the "" API.
7. If the "authorization_required" parameter is true, in response to the "" API, the "" API shall be used to get the account_token, which will be used to hit the "oauth2/authorize" CSC Server endpoint.
8. Use the "" API to get the hash of the document.
7. The signature application can use any one of the following API for authorisation of the credential ID, based on the response of the "" API of the CSC server:
"" API to start the online OTP mechanism associated with a credential ID for Explicit (OTP) authorization.
"" API to authorize access to the credential ID for signing for Explicit (OTP/PIN) or Implicit authorization. The SAD received in response shall be used in the "" API request.
"oauth2/authorize" API to initiate an OAuth 2.0 authorization flow for the OAuth 2.0 authorization. The authorization is returned in the form of an authorization code, which the signature application shall then use to obtain the SAD via "" API. The SAD received in response shall be used in the "
8. Use the "" API to embed signatures in the document.
9. The signature application uses one of the following APIs of the CSC server for revoking access tokens, as per the requirement:
"" API to revoke the service access token or refresh token.
"" API to revoke an OAuth 2.0 access token or refresh token.
The CSC Signing process can be a one-step or two-step operation, depending on the SCAL value returned by the "" API response. The distinction lies in how the document hash is calculated and how the signature is embedded.
1-Step Sign:
Condition: If SCAL is 1 in the "" API response, the signature application does not need to call the "" API to calculate the document hash.
Process: The application simply collects the necessary data to call the "" API. This API will automatically calculate the document hash, sign it using the CSC server, and embed the signature directly into the document.
How it works?
Configure a Connector in SigningHub Admin
Configure a Signing Profile in SigningHub Admin
To perform CSC signatures, you must configure a CSC connector, in SigningHub Admin.
Configure a signing profile using the connector, in SigningHub Admin.
Configure the signing profile to the service plan, in SigningHub Admin.
Make the following configurations to a connector in SigningHub Admin:
In the "Basic Information" section, choose "CSC" as the "Provider".
In the "Details" section, choose "Authorization Code" as the "Auth Type".
A call back URL has to be registered with the CSC (Cloud Signature Consortium) signing server. The URL where the user will be redirected after the authorisation process has completed. Here is the format of call back URL: "{DEPLOYMENT_WEB_URL}/CSC/OAuth/CallBack" For example if your SigningHub site is "https://web.signinghub.com" then the Callback URL for SigningHub will be "https://web.signinghub.com/CSC/OAuth/CallBack".
Make the following configurations to a signing profile in SigningHub Admin:
Select the CSC Connector created earlier, in the highlighted field below:
Make the following configurations to the service plan in SigningHub Admin:
In the "Signature" section of the service plan, select and add the earlier configured signing profile, as shown below:
Make the following configurations to a user role in SigningHub Admin:
Against your user role, in the "Singing Server Preferences" tab, add the signing server.
Sign the document using the CSC Signing Server via SigningHub Web or API.
To perform CSC signatures via SigningHub Web, follow the below-mentioned steps:
From the document listing, open a the document having the signature field that you want to sign.
Click on the signature field, select the CSC Signing Server.
Input the CSC user credentials, provided by the CSC Signing Server.
The signing logs are maintained under "User Activity Logs", "Workflow History", and "Workflow Evidence Report".
The National ID will be validated for CSC Signing Servers, if the "ValidateRUT" tag in the appsettings.Production.json file has been set to "True". Upon selecting the signing server, the system will fetch all the certificates in the "Get Credentials List" call, which have the same "Subject Alternative Name" value as the National ID, specified in your profile. If a National ID has not been provided or an invalid National ID has been provided, the system will not let the user sign the documents using the CSC Signing Servers, given that the "ValidateRUT" tag in the
To perform CSC signatures via API, follow the below-mentioned steps:
1. Use the "" API to get the authentication token of the user who is performing the signatures.
2. The signature application uses the "" API to get the RSSP (Remote Signing Service Provider) information that is needed to perform CSC Signing.
3. The signature application uses the "" API which returns the information about the RSSP (Remote Signing Service Provider) and the list of API methods it has implemented. This method shall be implemented by any RSSP conforming to this specification.
4. If the "authorization_required" parameter is true, in response to the "" API, the "" API shall be used to get the account_token which will be used to hit the "oauth2/authorize" endpoint.
4. The signature application requests authorization for the user to access the RSSP resources using the "oauth2/authorize" API of the CSC server. The authorization is returned in the form of an authorization code, which the signature application shall then use to obtain an access token with "service" as scope. To get the access token call the "" SigningHub API to get the Bearer/SAD token.
5. The signature application gets the list of credentials associated using the "" API. if the RUT filtration is required this API will filter the credentials as per the RUT values. A user may have one or multiple credentials hosted by a single remote signing service provider.
6. The signature application gets the information on a signing credential, its associated certificate, and a description of the supported authorization mechanism using the "" API.
7. If the "authorization_required" parameter is true, in response to the "" API, the "" API shall be used to get the account_token which will be used to hit the "oauth2/authorize" CSC Server endpoint.
8. Use the "" API to get the hash of the document.
7. The signature application can use any one of the following API for authorization of credential ID, based on the response of the "" API of the CSC server:
"" API to start the online OTP mechanism associated with a credential ID for Explicit (OTP) authorization.
"" API to authorize access to the credential ID for signing for Explicit (OTP/PIN) or Implicit authorization. The SAD received in response shall be used in the "" API request.
"oauth2/authorize" API to initiate an OAuth 2.0 authorization flow for the OAuth 2.0 authorization. The authorization is returned in the form of an authorization code, which the signature application shall then use to obtain the SAD via "" API. The SAD received in response shall be used in the "
8. Use the "" API to embed signatures in the document.
9. The signature application uses one of the following APIs of the CSC server for revoking access tokens, as per the requirement:
"" API to revoke the service access token or refresh token.
"" API to revoke an OAuth 2.0 access token or refresh token.
The CSC Signing process can be a one-step or two-step operation, depending on the SCAL value returned by the "" API response. The distinction lies in how the document hash is calculated and how the signature is embedded.
1-Step Sign:
Condition: If SCAL is 1 in the "" API response, the signature application does not need to call the "" API to calculate the document hash.
Process: The application simply collects the necessary data to call the "" API. This API will automatically calculate the document hash, sign it using the CSC server, and embed the signature directly into the document.
Add Signing Server to a User Role in SigningHub Web
Specify the CSC User ID against your profile in SigningHub Web
CSC Signing
Specify your CSC User ID against your profile.
Sign the document using the CSC Signing Server via SigningHub Web or API.
In case of CSC Signing:
Whenever a user clicks on the "Sign Now" button, to sign the document, the document will be locked. While the document is locked, other recipient can not process the document. The document will automatically unlock in case:
The signature has been successfully applied.
A period of 5 minutes has passed since the document was locked. (If you refresh or kill the browser window after clicking on the "Sign Now" button, the document will unlock after a period of 5 minutes has passed since the document was locked.)
Any exception has occurred from SigningHub or the CSC Server.
Any cancel action has been performed after clicking the "Sign Now" button.
If the package has multiple documents, the locking functionality will only lock the document being signed, and not the whole package.
The document locking functionality also works in case of Bulk Signing.
2-Step Sign:
Condition: If SCAL is 2 in the "Get Credentials Info" API response.
Process: Follow the below steps:
First, the signature application must call the "" API to retrieve the document’s hash.
Next, the application must call the "" API to embed the signature into the document.
Add Signing Server to a User Role in SigningHub Web
CSC Signing
Sign the document using the CSC Signing Server via SigningHub Web or API.
Click the "Sign" button and based on your CSC Signing Server configurations, provide the authorization details for Explicit (PIN/OTP/Both), Implicit or OAuth 2.0 authorization. Once the authorization is complete the document will be signed.
In case of CSC Signing:
Whenever a user clicks on the "Sign Now" button, to sign the document, the document will be locked. While the document is locked, other recipient can not process the document. The document will automatically unlock in case:
The signature has been successfully applied.
A period of 5 minutes has passed since the document was locked. (If you refresh or kill the browser window after clicking on the "Sign" button, the document will unlock after a period of 5 minutes has passed since the document was locked.)
Any exception has occurred from SigningHub or the CSC Server.
Any cancel action has been performed after clicking the "Sign Now" button.
If the package has multiple documents, the locking functionality will only lock the document being signed, and not the whole package.
The document locking functionality also works in case of Bulk Signing.
2-Step Sign:
Condition: If SCAL is 2 in the "Get Credentials Info" API response.
Process: Follow the below steps:
First, the signature application must call the "" API to retrieve the document’s hash.
Next, the application must call the "" API to embed the signature into the document.
