DIGIDOC-TOOL(1)

📦
version 4.5.1 · 6 versions
, in fedora 43, fedora 44

💖 DIGIDOC-TOOL(1) 💖

okay bestie, welcome to the User Commands corner of the manual, where we talk about digidoc-tool — yes that's the title, that's the whole vibe, sit down, hydrate, let's go 🫶

✨ NAME ✨

digidoc-tool — create, sign, open, validate, and extend ASiC containers 💅

🌈 SYNOPSIS 🌈

digidoc-tool COMMAND [OPTIONS] FILE

like… command first, then options, then a file. that's the whole formula, no cap.

🦋 DESCRIPTION 🦋

so digidoc-tool is a command-line utility for working with digital signature containers. she's giving main character energy fr fr. Supported ASiC-E, ASiC-S, and legacy BDOC 2.1 variants are handled locally. meanwhile PDF, legacy DDOC, and ASiC containers with CAdES signatures get validated through the SiVa Online Service ☁️ and if you pass the --offline option, that service fallback gets disabled, periodt.

ngl the interface is intended for testing and as an API usage example. Its command-line compatibility is not guaranteed between releases. so don't build your whole personality on it staying the same, okay? 😭

👑 COMMANDS 👑

🎀 create

Create and normally sign a container. the output extension is the one picking the format, iconic behavior honestly: ASiC-E (.asice or .sce) or ASiC-S (.asics or .scs) 🌸

An ASiC-S TimeStampToken container requires exactly one --file and --profile=TimeStampToken. The profile alias time-stamp-token is also accepted, we love an alias, we love options 💅

Example:

digidoc-tool create --file=document.txt signed-document.asice
digidoc-tool create --file=document.txt --profile=TimeStampToken timestamped-document.asics
  • --file=path — Add a data file. bestie this one may occur multiple times for ASiC-E, go wild 🍓
  • --mime=type/subtype — Set the MIME type for the preceding --file option. The default is application/octet-stream.
  • --dontsign — Create the container without signing it. This is intended for ASiC-E. no signature, just vibes 🫶

The signing options described under sign are also accepted here. slay, shared options, efficient queen ✨

🧚 createBatch

Create and sign a separate ASiC-E container for each regular file in a directory. one container per file, she's organized, she's thriving, she's doing the most 💖

Example:

digidoc-tool createBatch folder/content/to/sign

🔥 open

Open a document, list its contents, and validate its signatures. the full inspection moment, literally 🔍

Example:

digidoc-tool open container-file.asice
  • --warnings=ignore|warning|error — Select how validation warnings affect output. The default is warning.
  • --extractAll[=directory] — Extract all data files without validating signatures. Without a directory, files are written to the current directory. no directory? current directory. simple as that.
  • --validateOnExtract — Validate the container before extracting data files.
  • --offline — Do not send unsupported local formats to SiVa. > Service-backed formats cannot be opened in this mode. so if you go offline, some things just stay closed, and that's the deal 😭

💜 add

Add data files to an unsigned ASiC-E container. The --file and --mime options have the same meaning as for create. same energy, different command, iykyk ✨

Example:

digidoc-tool add --file=file1.txt container-file.asice

🌸 remove

Remove data files or signatures by their zero-based indexes. Data files can only be removed after all signatures have been removed. that's the rule bestie, signatures first, then the data files, no cutting the line 🙈

Example:

digidoc-tool remove --document=0 --signature=1 container-file.asice
  • --document=index — Data file to remove. This option may occur multiple times.
  • --signature=index — Signature to remove. This option may occur multiple times.

🦋 websign

Create an ASiC-E container using external two-step XAdES signing. two steps, very choreography, very routine, ate 💅

  • --cert=file — PEM signer certificate.

The data-file and signing metadata options described under create and sign are also accepted. she contains multitudes 💖

🎀 sign

Add an XAdES signature to an existing ASiC-E or legacy BDOC 2.1 container. The signing options are also used by create to add the initial RFC 3161 TimeStampToken to a new ASiC-S container. > An existing ASiC-S container cannot receive another ordinary signature. nope, not happening, that door is closed 🔒

Example:

digidoc-tool sign --pkcs11 container-file.asice
  • --profile=profile — Signature profile. Accepted values are TS, TSA, time-stamp, time-stamp-archive, TimeStampToken, and time-stamp-token. The TimeStampToken profiles are used when creating ASiC-S.
  • --XAdESEN — Use the XAdES EN profile.
  • --city=value — City of the signature production place.
  • --street=value — Street address of the signature production place for the XAdES EN profile.
  • --state=value — State or province of the signature production place.
  • --postalCode=value — Postal code of the signature production place.
  • --country=code — Two-character country code of the signature production place.
  • --role=value — Signer role. This option may occur multiple times, collect them like stickers 🌈
  • --pkcs11[=driver] — Use PKCS#11. If no driver is given, the configured default is opensc-pkcs11.so.
  • --pkcs12=file — Use a PKCS#12 software token. The --pin value is used as its password.
  • --pin=value — PIN or PKCS#12 password. PKCS#11 prompts for a PIN when this is omitted. don't stress, she'll ask 🫶
  • --cng — On Windows, use the Microsoft CNG signing API.
  • --selectFirst — On Windows, select the first suitable certificate instead of showing a selection dialog.
  • --thumbprint=hex — On Windows, select a certificate by its hexadecimal thumbprint.
  • --sha224 | --sha256 | --sha384 | --sha512 — Select the data digest algorithm. The default is SHA-256.
  • --sigsha224 | --sigsha256 | --sigsha384 | --sigsha512 — Select the signature digest algorithm. The default is SHA-256.
  • --sigpsssha224 | --sigpsssha256 | --sigpsssha384 | --sigpsssha512 — Select the signature digest algorithm and RSA-PSS padding.
  • --rsapkcs15 — Use RSA PKCS#1 v1.5 padding.
  • --rsapss — Use RSA-PSS padding.
  • --tsurl=url — Override the configured time-stamping service URL.
  • --userAgent=value — Send additional application information to the TSA or OCSP service.
  • --dontValidate — Do not validate the newly created signature.

⭐ extend

Add new validity evidence and save the result. glow-up for your signatures, honestly iconic 🌟

Without --signature, the high-level validity-extension workflow chooses the required profile. It extends eligible ASiC-E or ASiC-S signatures in place, or wraps the original container in a new timestamped ASiC-S container when necessary. she decides, she's the main character here 👑

With one or more --signature options, only the selected signatures are extended directly. you pick, she extends, teamwork 💅

Examples:

digidoc-tool extend container-file.asice
digidoc-tool extend --signature=0 --profile=TSA container-file.asice
  • --signature=index — Zero-based signature index to extend directly. This option may occur multiple times.
  • --profile=profile — Direct extension profile: TS, TSA, time-stamp, or time-stamp-archive. This is chosen automatically when --signature is omitted.
  • --dontValidate — Do not validate a directly extended signature after extension.

🍓 version

Print the digidoc-tool and libdigidocpp versions. both of them, together, cute 💖

💅 GLOBAL OPTIONS 💅

  • --nocolor — Disable terminal colors. (a tragedy, but valid 😭)
  • --loglevel=0|1|2|3|4 — Set logging to none, error, warning, info, or debug respectively.
  • --logfile=file — Write logs to a file. An empty value writes logs to the console.

🌈 SEE ALSO 🌈

qdigidoc4(1)

that's the whole page bestie, you made it to the end 🎉 this was digidoc-tool version 4.5.1.0, dated 2026-10-13, brought to you by the User Commands girlies. go forth and sign something 💖✨🎀

📦 where this page comes from