Signing

These guides cover signing when the private key is in your process, loaded from a file or generated on the spot. Start with PKCS12 if the key and certificate came from a CA as a .p12 or .pfx, or with PEM if they are separate files and the chain needs to travel with the signature. An elliptic curve key needs its own handler, covered in ECDSA.

Generated keys make a self-signed certificate at runtime. That is fine for testing the signing path, and nothing more: a validator that uses its own trust roots refuses it unless that exact certificate is one of them.

The rest build on one of those: adding a document timestamp, signing on a new page, signing a document that already carries a signature, signing an encrypted file, and reading back the revision a document had before it was signed.

The examples are in signatures/signing.