# Contained Digital Signatures on iOS

Nutrient supports a workflow where the creation of a digital signature is split in two phases:

- First, you can “prepare” a document with a signature form field by stamping a custom signature appearance and reserving space in the PDF for the digital signature.

- Second, you can “embed” a custom [PKCS#7](https://www.ietf.org/rfc/rfc2315.html) signature container in a document that was already “prepared” in the first step. The end result is a digitally signed document.

This workflow, which we call contained digital signatures, is especially useful when the cryptographic material to sign a document (keys, certificates) is not available on the platform that executes Nutrient.

For the first part, preparing a document, you may call [`prepare(_:toBeSignedWith:contents:writingTo:completion:)`](https://www.nutrient.io/api/ios/documentation/pspdfkit/pdfsigner/prepare(_:tobesignedwith:contents:writingto:completion:)) on the [`PDFSigner`](https://www.nutrient.io/api/ios/documentation/pspdfkit/pdfsigner) class. This preparation step allows customization for the raw content that will fill the digital signature contents before a real digital signature is applied: The [`PDFSignatureContents`](https://www.nutrient.io/api/ios/documentation/pspdfkit/pdfsignaturecontents) protocol is an abstraction for that. If you want to fill the digital signature contents with binary zeroes, pass an instance of the [`BlankSignatureContents`](https://www.nutrient.io/api/ios/documentation/pspdfkit/blanksignaturecontents) class to [`prepare(_:toBeSignedWith:contents:writingTo:completion:)`](https://www.nutrient.io/api/ios/documentation/pspdfkit/pdfsigner/prepare(_:tobesignedwith:contents:writingto:completion:)).

Note that the document generated by the [`prepare(_:toBeSignedWith:contents:writingTo:completion:)`](https://www.nutrient.io/api/ios/documentation/pspdfkit/pdfsigner/prepare(_:tobesignedwith:contents:writingto:completion:)) API has two important properties: First, it’s not a valid digitally signed document yet, so it may show errors if you try to validate it with Nutrient or any other third-party tool. Second, this document must not be modified in any way, so as to prevent corrupting the digital signature that will be embedded in the final document. The process of embedding the real digital signature is explained next.

For embedding a real digital signature in a document generated by [`prepare(_:toBeSignedWith:contents:writingTo:completion:)`](https://www.nutrient.io/api/ios/documentation/pspdfkit/pdfsigner/prepare(_:tobesignedwith:contents:writingto:completion:)), you can call [`embedSignature(in:with:writingTo:completion:)`](https://www.nutrient.io/api/ios/documentation/pspdfkit/pdfsigner/embedsignature(in:with:writingto:completion:)) on the [`PDFSigner`](https://www.nutrient.io/api/ios/documentation/pspdfkit/pdfsigner) class. You’re responsible for generating a valid digital signature in the cryptographic [PKCS#7](https://www.ietf.org/rfc/rfc2315.html) format for the prepared document. To do that, pass a custom implementation of [`PDFSignatureContents`](https://www.nutrient.io/api/ios/documentation/pspdfkit/pdfsignaturecontents) to the previously cited method. In your [`sign(_:)`](https://www.nutrient.io/api/ios/documentation/pspdfkit/pdfsignaturecontents/sign(_:)) implementation, you’ll receive the part of the document that you need to hash, encrypt, and package into a digital signature. You can call [`hashOfData(inRanges:algorithm:)`](https://www.nutrient.io/api/ios/documentation/pspdfkit/pdfdocumentprovider/hashofdata(inranges:algorithm:)) on a [`PDFDocumentProvider`](https://www.nutrient.io/api/ios/documentation/pspdfkit/pdfdocumentprovider) instance to help you calculate the hash value of some parts of a PDF document. You can generate the PKCS7 signature container with the help of our [`PKCS7`](https://www.nutrient.io/api/ios/documentation/pspdfkit/pkcs7) class.

You’ll find examples of this API in the Catalog file [`ContainedDigitalSignaturesExample.swift`](https://github.com/PSPDFKit/pspdfkit-ios-catalog/blob/master/Catalog/Examples/Forms/ContainedPadesDigitalSignatureExample.swift).
---

## Related pages

- [Biometric Signatures on iOS](/guides/ios/signatures/digital-signatures/biometric.md)
- [Adding a Digital Signature to a PDF on iOS](/guides/ios/features/digital-signatures.md)
- [Sign PDFs and Add Custom Encryption on iOS](/guides/ios/signatures/digital-signatures/custom-signers.md)
- [Signatures in iOS Viewer](/guides/ios/signatures/digital-signatures/built-in-ui.md)
- [Customizing Digital Signatures on iOS](/guides/ios/signatures/digital-signatures/customization.md)
- [Generate a Self-Signed Certificate for Signing on iOS](/guides/ios/signatures/digital-signatures/generate-certificate.md)
- [Digital Signature Standards: CAdES and PAdES](/guides/ios/signatures/digital-signatures/standards.md)
- [Troubleshooting](/guides/ios/signatures/digital-signatures/troubleshooting.md)
- [Secure digital signatures for iOS PDF libraries](/guides/ios/signatures/digital-signatures/supported-methods.md)
- [Validating a Digital Signature on iOS](/guides/ios/signatures/digital-signatures/validation.md)