PDSigner Digital Signature

1. Installation

PD Signer is a small Windows desktop app that talks to your smart card or USB token through a PKCS#11 driver and exposes a local HTTPS bridge so any browser can request signatures from it.

1. Go to the Downloads page and click Install Now for your platform.
2. Run PD-Signer-Setup-X.Y.Z.exe. Windows will ask for administrator permission — required because the app installs to C:\Program Files\PD Signer.
3. Choose your language (Turkish or English) and click through the installer. A Start Menu entry and an optional desktop shortcut are created.
4. Launch PD Signer. On first start it auto-registers a license bound to this machine and opens the main window.

2. Smart card and driver setup

Plug your USB token or smart-card reader in before the first signing attempt. PD Signer detects the PKCS#11 driver installed by the token vendor:

• KamuSM / AKİS — C:\Windows\System32\akisp11.dll
• e-Tuğra — C:\Program Files\eTugra\eTugraPKCS11.dll
• SafeNet / Gemalto — C:\Windows\System32\eTPKCS11.dll
• e-Güven — C:\Program Files\e-Guven\egpkcs11.dll

Open Settings → PKCS#11 Library and click Scan to auto-detect, or Browse to point at a custom DLL. Once a driver is loaded, the Tokens tab lists every reader and shows whether a card is present.

3. License activation

When PD Signer starts for the first time it contacts pdsigner.com, sends a hash of this machine's fingerprint, and receives a license tied to it. The flow is automatic — you'll see the main window straight away.

If you ever need to enter a license key manually (e.g. you bought a commercial license), open Settings → License, paste the PDSGN-XXXX-XXXX-XXXX-XXXX key and click Activate. The same license can be re-validated from any other machine you own, up to the limit configured by the issuer.

4. Signing a document

1. Open Sign from the side navigation, or drop a file onto the PD Signer window.
2. Choose the signature standard: PAdES for PDFs, XAdES for XML, CAdES for everything else.
3. Choose the level: B (baseline), T (with timestamp), LT (long-term, embeds revocation data), LTA (archival, periodic re-timestamping).
4. Pick the reader and certificate, enter your PIN and click Sign.
5. The signed file is saved next to the original with the standard suffix (e.g. document.pdf → document.signed.pdf).

5. Verifying a signature

Open Verify and drop a signed PDF / XML / CAdES envelope on it. PD Signer parses the signature, walks the certificate chain against the bundled trusted roots, checks revocation (CRL / OCSP), and reports overall validity plus per-certificate detail.

6. Browser extension

The PD Signer Bridge extension is a thin layer that lets any web app talk to your local PD Signer over http://127.0.0.1:51720 without you having to install anything special per site.

Chrome / Edge

1. Download pd-signer-bridge-X.Y.Z.zip from the Downloads page.
2. Unzip it to a folder you'll keep around.
3. Open chrome://extensions (or edge://extensions), turn on Developer mode, click Load unpacked and pick the unzipped folder.
4. The PD Signer icon appears in the toolbar. Click it to see the bridge status; click ⚙ to set your default signature level, web app URL and language.

Firefox

1. Download pd-signer-bridge-X.Y.Z.xpi.
2. Drag the .xpi into Firefox or open about:addons → ⚙ → Install Add-on From File….

7. Web app integration

For developers building their own signing UI, two integration paths are supported:

• Direct HTTPS bridge — your page calls http://127.0.0.1:51720/sign with a JSON body. Works on localhost dev sites without the extension.
• Via the extension — use chrome.runtime.sendMessage(EXTENSION_ID, …). The extension brokers the request to the local PD Signer, which avoids mixed-content blocks on HTTPS production sites.

A reference POST /sign request body:

{
  "fileBase64": "JVBERi0xLj…",
  "fileName": "contract.pdf",
  "type": 1,           // 0=CAdES, 1=PAdES, 2=XAdES
  "profile": "B",      // B | T | LT | LTA | LTA-TSA | C | X | XL
  "pin": "0000",
  "terminalIndex": 0
}

8. Updates and trusted certificates

PD Signer polls pdsigner.com/updates.php every 15 seconds. When a new version is published, the in-app App Update screen shows the version, release notes, and a single Download and Install button. The installer verifies SHA-256 before applying, then restarts the app.

The Trusted Certificates screen pulls the latest list of root and intermediate certificates from the server, verifies each file's hash, and stores them under %APPDATA%\com.pdsigner\pd_signer\trusted\. These are used by the Verify flow.

9. Troubleshooting

"PD Signer unreachable" in the extension popup

PD Signer isn't running, or the HTTPS bridge is blocked. Open PD Signer manually; if Windows asks about firewall access, allow it. The bridge listens only on 127.0.0.1:51720 — it's not exposed to the network.

No certificates listed after entering PIN

The PKCS#11 library can't see your card. Re-plug the token, then in Settings click Scan to re-detect. If that fails, the vendor driver isn't installed.

"Login failed: C_Login failed: 0xb3"

Another process is holding a session on the same slot. Close any other signing tool (browser tabs, e-imza apps) and try again.

License rejected after working before

An administrator may have suspended or revoked your license for this machine. Contact info@pdsigner.com with the machine fingerprint shown on the License screen.

Still stuck? Email info@pdsigner.com with steps to reproduce and we'll get back to you.

Overview

All public endpoints under pdsigner.com return HMAC-SHA256-signed JSON. The signature covers a canonical (alphabetically sorted) representation of the response without the signature field, so the client must recompute the canonical form before comparing.

Every response includes timestamp (RFC 3339 UTC) and signature (lowercase hex). Apps are expected to reject any reply where the signature doesn't match.

License

POST /license.php

License validation, activation and machine-bound auto-registration. Used by PD Signer at startup and on a periodic heartbeat.

{
  "action": "auto-register",  // "validate" | "activate" | "auto-register"
  "licenseKey": "PDSGN-XXXX-XXXX-XXXX-XXXX",
  "fingerprint": "sha256-hex",
  "machineName": "PD-LAPTOP",
  "osInfo": "Windows 10",
  "appVersion": "0.2.0"
}

Updates

GET /updates.php?platform=windows&channel=stable&current=X.Y.Z

Returns the latest active release for that platform / channel. available is true if current < latest. forceUpdate is true if current < minRequired. Apps download via ?download=ID, verify SHA-256, and apply the staged installer.

Trusted certificates

GET /trusted-certificates.php

Returns a signed manifest of trusted root and intermediate certificates. Each entry includes a SHA-256 fingerprint and a download URL. PD Signer hashes the downloaded bytes and rejects any file that doesn't match.

Upload release

POST /upload-release.php auth

Bearer-token-protected upload of new release ZIPs (for self-update) plus optional installer EXE / extension ZIP / CRX / XPI (for the Downloads page). Rate-limited per IP. Server validates ZIP magic bytes and version regex.

Authorization: Bearer <release_upload_token>
Content-Type: multipart/form-data

  version       = 0.2.0
  platform      = windows
  channel       = stable
  release_notes = …
  file          = pd-signer-0.2.0-windows.zip
  setup         = PD-Signer-Setup-0.2.0.exe     (optional)
  extension_zip = pd-signer-bridge-1.0.0.zip    (optional)
  extension_crx = pd-signer-bridge-1.0.0.crx    (optional)
  extension_xpi = pd-signer-bridge-1.0.0.xpi    (optional)

Local bridge

PD Signer itself exposes a local HTTP bridge on http://127.0.0.1:51720 with permissive CORS. Three endpoints:

• GET /status — host + version + license summary
• GET /terminals — connected PKCS#11 reader list
• POST /sign — perform a signature (see next section)

Signature request

POST http://127.0.0.1:51720/sign

{
  "fileBase64":   "JVBERi0xLj…",
  "fileName":     "contract.pdf",
  "type":         1,           // 0=CAdES, 1=PAdES, 2=XAdES
  "profile":      "B",         // B | T | LT | LTA | LTA-TSA | C | X | XL
  "pin":          "0000",
  "terminalIndex": 0,
  "digitKey":     "",
  "id":           0
}

Response: { success, data: { signedHash, signedFileName, digitKey } }. The local bridge refuses with HTTP 402 if no active license is loaded.