Digital Signature Support: CSP, CNG, and ECDSA
IronPDF can digitally sign PDF documents in .NET applications, but the range of supported signature types is limited. Knowing which key formats work today helps you plan an integration that will not hit a wall at signing time.
Current Support: CSP-Based Signatures
IronPDF signs PDFs using certificates based on Microsoft's legacy Cryptographic Service Provider (CSP) model. CSP is an older cryptographic framework from earlier Windows versions; it supports traditional algorithms like RSA but lacks modern extensibility. Certificates stored in CSP containers work with the Sign() method without issue.
What works today:
- Signing PDFs with a certificate stored in a CSP-based PFX file using RSA keys.
- Verifying signatures created in this legacy format.
- Signing and verifying ECDSA-signed PDFs on IronPDF
v2026.6.1and later.
Limitation: CNG Certificates
Microsoft introduced CNG (Cryptography Next Generation) with Windows Vista and Windows Server 2008 to replace CSP. It supports modern algorithms such as ECDSA and offers a more flexible cryptographic API.
IronPDF v2026.6.1 added ECDSA PDF signature support for both signing and verifying EC-signed PDFs. Certificates whose private keys are held in CNG, however, still fail.
ECDSA (Elliptic Curve Digital Signature Algorithm): on versions prior to v2026.6.1, ECDSA certificates throw:
certificate key algorithm not supportedRSA via CNG: throws:
requested operation not supportedThese errors occur because IronPDF's current signing implementation does not integrate with Microsoft's newer CNG key storage provider and API.
What a CNG Signature Is
CNG is Microsoft's modern cryptographic framework, designed to replace the older CryptoAPI and CSP system.
Key features:
- Supports modern algorithms including RSA, ECDSA, SHA-256, and SHA-384.
- Enables custom, pluggable cryptographic providers.
- Backs Windows services like BitLocker, TPM, and Windows Hello.
Signatures created with CNG offer stronger security and modern standards compliance, which makes them the preferred choice in newer, security-conscious applications.
Roadmap
Wider CNG support is under active review for a future release. The planned goals are:
- Support RSA and ECDSA certificates whose private keys are held in CNG, such as non-exportable keys in the Windows Certificate Store. ECDSA certificates loaded from a
.pfxfile already work fromv2026.6.1. - Ensure compatibility with the Windows Certificate Store and CNG key storage providers.
- Pass signing and verification with industry-standard tools and meet PDF signature specification requirements.
Curtis Chau holds a Bachelor’s degree in Computer Science (Carleton University) and specializes in front-end development with expertise in Node.js, TypeScript, JavaScript, and React. Passionate about crafting intuitive and aesthetically pleasing user interfaces, Curtis enjoys working with modern frameworks and creating well-structured, visually appealing manuals.
