npm install @google-cloud/kms

npm install @google-cloud/secret-manager

import { PDF, GoogleKmsSigner } from "@libpdf/core";
import { readFile, writeFile } from "fs/promises";

// Load your DER-encoded certificate (issued by your CA for the KMS key)
const certificate = await readFile("certificate.der");

// Create signer with KMS key reference
const signer = await GoogleKmsSigner.create({
  keyVersionName:
    "projects/my-project/locations/us-east1/keyRings/my-ring/cryptoKeys/my-key/cryptoKeyVersions/1",
  certificate,
});

// Sign the PDF
const pdf = await PDF.load(await readFile("document.pdf"));
const { bytes } = await pdf.sign({ signer });

await writeFile("signed.pdf", bytes);

const signer = await GoogleKmsSigner.create({
  keyVersionName:
    "projects/my-project/locations/us-east1/keyRings/my-ring/cryptoKeys/my-key/cryptoKeyVersions/1",
  certificate: certificateDer,
  buildChain: true, // Automatically fetch intermediate certificates
});

const signer = await GoogleKmsSigner.create({
  projectId: "my-project",
  locationId: "us-east1",
  keyRingId: "my-ring",
  keyId: "my-key",
  keyVersion: "1",
  certificate: certificateDer,
});

const signer = await GoogleKmsSigner.create({
  keyVersionName: "projects/.../cryptoKeyVersions/1",
  certificate: certificateDer,
});

signer.keyType; // "RSA" or "EC"
signer.signatureAlgorithm; // "RSASSA-PKCS1-v1_5", "RSA-PSS", or "ECDSA"
signer.digestAlgorithm; // "SHA-256", "SHA-384", or "SHA-512"
signer.keyVersionName; // Full resource name
signer.certificate; // DER-encoded certificate
signer.certificateChain; // Chain certificates (if provided/built)

// Load certificate from Secret Manager
const certificate = await GoogleKmsSigner.getCertificateFromSecretManager(
  "projects/my-project/secrets/signing-cert/versions/latest",
);

const signer = await GoogleKmsSigner.create({
  keyVersionName: "projects/my-project/.../cryptoKeyVersions/1",
  certificate,
});

// Certificate in shared-certs project, KMS key in app project
const certificate = await GoogleKmsSigner.getCertificateFromSecretManager(
  "projects/shared-certs/secrets/signing-cert/versions/1",
);

const signer = await GoogleKmsSigner.create({
  keyVersionName:
    "projects/my-app/locations/us-east1/keyRings/ring/cryptoKeys/key/cryptoKeyVersions/1",
  certificate,
});

openssl x509 -in cert.pem -outform DER -out cert.der

const signer = await GoogleKmsSigner.create({
  keyVersionName: "projects/.../cryptoKeyVersions/1",
  certificate: certificateDer,
  buildChain: true, // Fetch intermediates via AIA
  chainTimeout: 20000, // Optional: extend timeout (default 15s)
});

console.log(`Chain has ${signer.certificateChain.length} certificates`);

const signer = await GoogleKmsSigner.create({
  keyVersionName: "projects/.../cryptoKeyVersions/1",
  certificate: certificateDer,
  certificateChain: [intermediateDer, rootDer],
});

import { KeyManagementServiceClient } from "@google-cloud/kms";

const client = new KeyManagementServiceClient({
  keyFilename: "/path/to/service-account.json",
});

const signer = await GoogleKmsSigner.create({
  client,
  keyVersionName: "projects/.../cryptoKeyVersions/1",
  certificate: certificateDer,
});

import { readFile, writeFile } from "fs/promises";
import { PDF, GoogleKmsSigner, HttpTimestampAuthority } from "@libpdf/core";

async function signWithKms() {
  // Load certificate from Secret Manager
  const certificate = await GoogleKmsSigner.getCertificateFromSecretManager(
    "projects/my-project/secrets/signing-cert/versions/latest",
  );

  // Create KMS signer with automatic chain building
  const signer = await GoogleKmsSigner.create({
    projectId: "my-project",
    locationId: "us-east1",
    keyRingId: "document-signing",
    keyId: "contract-key",
    certificate,
    buildChain: true,
  });

  // Load document
  const pdf = await PDF.load(await readFile("contract.pdf"));

  // Create timestamp authority for long-term validation
  const tsa = new HttpTimestampAuthority("http://timestamp.digicert.com");

  // Sign with timestamp
  const { bytes } = await pdf.sign({
    signer,
    level: "B-LT",
    timestampAuthority: tsa,
    reason: "Contract approval",
    location: "Cloud signing service",
  });

  await writeFile("contract-signed.pdf", bytes);
  console.log("Document signed with KMS");
}

signWithKms().catch(console.error);

import { GoogleKmsSigner, KmsSignerError } from "@libpdf/core";

try {
  const signer = await GoogleKmsSigner.create({
    keyVersionName: "projects/.../cryptoKeyVersions/1",
    certificate: certificateDer,
  });
} catch (error) {
  if (error instanceof KmsSignerError) {
    console.error("KMS error:", error.message);
    // error.cause contains the original error if available
  }
}

# Create key ring (if needed)
gcloud kms keyrings create document-signing \
  --location us-east1

# Create RSA signing key (HSM-backed)
gcloud kms keys create contract-key \
  --keyring document-signing \
  --location us-east1 \
  --purpose asymmetric-signing \
  --default-algorithm rsa-sign-pkcs1-2048-sha256 \
  --protection-level hsm

# Or create ECDSA key
gcloud kms keys create contract-key-ec \
  --keyring document-signing \
  --location us-east1 \
  --purpose asymmetric-signing \
  --default-algorithm ec-sign-p256-sha256 \
  --protection-level hsm

gcloud kms keys versions get-public-key 1 \
  --key contract-key \
  --keyring document-signing \
  --location us-east1 \
  --output-file public-key.pem