title: How do I sign a PDF document using a certificate from the Windows Cert Store?
body: <p>I need to sign a PDF document using a certificate that exists in the Windows Certificate Store. I have been digging around all day trying to figure it out, and I am <em>so close</em> yet <em>so far away</em>.</p>
  
  <p>All that is missing is this: <strong>How do I get an IExternalSignature object to sign the PDF file with?</strong></p>
  
  <p><a href="http://www.rahulsingla.com/blog/2012/09/digitally-sign-and-verify-pdf-documents-in-c-using-itextsharp-5-3-x-library" rel="noreferrer">Rahul Singla</a> has written a beautiful example of how to sign a PDF document using the new iText 5.3.0 API - <em>as long as</em> you can access a .pfx file sitting around on your PC somewhere.</p>
  
  <p>There is <a href="http://blog.imp.cz/post/2011/09/27/Digitalni-podepisovani-PDF-souboru-v-C-cast-2" rel="noreferrer">a previous question</a> on signing using a certificate from the Windows Cert Store, except it was using a version of the API where <code>SetCrypto</code> still exists, and the signature was apparently optional. In iText 5.3.0, the API has changed, and <code>SetCrypto</code> is no longer a thing.</p>
  
  <p>Here's what I have so far (comments added for posterity, since this might be the most complete and recent version of how to do this on the 'net):</p>
  
  <pre class="lang-cs prettyprint-override"><code>using iTextSharp.text.pdf;
  using iTextSharp.text.pdf.security;
  using BcX509 = Org.BouncyCastle.X509;
  using Org.BouncyCastle.Pkcs;
  using Org.BouncyCastle.Crypto;
  using DotNetUtils = Org.BouncyCastle.Security.DotNetUtilities;
  
  ...
  
  // Set up the PDF IO
  PdfReader reader = new PdfReader(@"some\dir\SomeTemplate.pdf");
  PdfStamper stamper = PdfStamper.CreateSignature(reader,
      new FileStream(@"some\dir\SignedPdf.pdf", FileMode.Create), '\0');
  PdfSignatureAppearance sap = stamper.SignatureAppearance;
  
  sap.Reason = "For no apparent raisin";
  sap.Location = "...";
  
  // Acquire certificate chain
  var certStore = new X509Store(StoreName.My, StoreLocation.LocalMachine);
  certStore.Open(OpenFlags.ReadOnly);
  
  X509CertificateCollection certCollection =
      certStore.Certificates.Find(X509FindType.FindBySubjectName,
      "My.Cert.Subject", true);
  X509Certificate cert = certCollection[0];
  // iTextSharp needs this cert as a BouncyCastle X509 object; this converts it.
  BcX509.X509Certificate bcCert = DotNetUtils.FromX509Certificate(cert);
  var chain = new List&lt;BcX509.X509Certificate&gt; { bcCert };
  certStore.Close();
  
  // Ok, that's the certificate chain done. Now how do I get the PKS?
  IExternalSignature signature = null; /* ??? */
  
  // Sign the PDF file and finish up.
  MakeSignature.SignDetached(sap, signature, chain, // the important stuff
      null, null, null, 0, CryptoStandard.CMS);
  stamper.Close();
  </code></pre>
  
  <p>As you can see: <em>I have everything but the signature</em>, and I'm stumped as to how I should obtain it!</p>