Qualified document signature with digiSeal server

The actions of qualified document signature are used, for example, to sign invoices or to verify the receipt of signed documents. NoSpamProxy Encryption offers this function in conjunction with the digiSeal server by secrypt GmbH. This means that for this function, in addition to NoSpamProxy Encryption, a digiSeal server must also be available in your infrastructure.

NOTE: The use of the actions for the qualified signature requires the installation and configuration of a digiSeal server by secrypt GmbH. To install a digiSeal server please contact us at info@netatwork.de. You set up the connection to the digiSeal server at . In addition, the digiSeal server API files must be located in the Gateway Role directory.

NOTE: This action is valid for the following senders: Local.

This action signs documents in file attachments that match certain naming patterns. The signature process can work with different signature formats and also add an optional time stamp.

Conditions for the use of the action

NOTE:

Before you configure this action, you must ensure the following:

  • The connection to the digiSeal server must be configured. See Integrating digiSeal server.
  • A process for data verification must be defined and activated on the digiSeal server. This process must be enabled for access by the API.
  • The digiSeal server API files must be located in the installation directory of the Gateway Role.

Defining the file name patterns for which the qualified signatures are to be verified

The action will sign files with certain naming patterns. Here you can store the complete file names of documents to be signed or parts thereof.

EXAMPLE:  

You want to sign invoices with file names such as Invoice May 2021.pdf or Invoice March 2021.pdf. Here you can add the filter invoice*.pdf. The action would now sign all files that match this pattern, including for example InvoiceToJohnDoeCancelled.pdf. You can store one or more of these patterns so that you can sign different types of files with the same action.

Determining the signature format

Depending on the business process and the data to be signed, you must now select a signature format. The following signature formats are available:

  • PKCS #7 encapsulated signature
  • PKCS #7 single signature
  • PKCS #7 S/MIME multipart signature
  • XML single signature
  • XML embedded signature
  • XML single signature using the XADES standard
  • XML embedded signature using the XADES standard
  • EDIFACT signature
  • Adobe PDF Reference Version 1.6 PKCS #7 signed data signature

In addition to the signature format, you can also add an optional time stamp. The timestamp correlates to the date and time the document was signed.

NOTE: Make sure that the settings for this action meets the requirements of your business process for the qualified signature.

NOTE: This action is valid for the following senders: External.

This action scans the attachments of emails sent to local addresses for signatures. For each file type, you can specify whether a qualified or advanced signature is required. The requirements depend on the respective business process and any laws involved.

To verify qualified signatures, the digiSeal server API must be installed and

NOTE:

Before you configure this action, you must ensure the following:

  • The connection to the digiSeal server must have been configured under Advanced settings.
  • On the digiSeal server an activated process must be configured for data inspection. This process must be enabled for API access.
  • The digiSeal server API files must be located in the installation directory of the Gateway Role.

Three levels are available for the verification of documents. The option Verification options corresponds to the section Verification depth in the digiSeal server on the tab 2.5: Verification.

  • Verification of the file integrity, i.e. whether the file has been modified since it was signed.
  • Local verification of the certificate chain.
  • Online verification of the certificate used (through the OCSP protocol).

Three levels are available for checking the documents

The second and third levels respectively include the verifications from the previous levels.

TIP: Signatures that are attached to the signed document can be automatically removed. The removal of signatures is recommended if the emails are to be processed automatically by other systems.

The options of the inspection documentation consist of three parts:

  • the settings for the verification protocol,
  • the advanced verification documentation and
  • the settings for archiving the created logs or advanced documentation.

The verification protocol can consist of a detailed XML file and/or a summary of the verification as a PDF document. In addition to this protocol, further details of the inspection can be recorded in the extended inspection documentation. In addition to archiving the verification protocol, you can attach any protocols or documentation that may have been created to the email.

You can have different documentation created and attached to the email

NOTE: To successfully archive emails to local addresses, a suitable archive connector must be defined under Archive connectors. If no archive connector is defined or an archive connector is defined whose assignment of email addresses to the profiles does not apply to the email, the email is processed as usual without being archived.

Depending on the file name, you can determine which signature type the signature must match for the differently signed files sent to you:

  • Documents with the file name pattern EnergyInvoice*.pdf" must have a qualified signature.
  • Documents with the file name pattern: "TransportInvoice*.pdf" must have an advanced signature.

Specifying the file name patterns for which qualified signatures are to be verified