SignSecure
SignBridge

Browser-based DSC signing for web applications.

Connect your web application to USB DSC tokens and the Windows Certificate Store. SignBridge runs as an installed Windows service, so users can sign from a supported browser without a browser extension.

Request SignBridge accessSee how it works
Windows 10/11
Localhost HTTPS Only
No Extensions Required
SignBridgeWorkflow illustration

Web application → Local signing service → DSC

A browser workflow.
A local certificate.

Windows
Signer’s Windows computer
Web applicationSupported browserSends the document hash
SignBridgeInstalled local serviceChecks the permitted origin
DSC tokenCompatible Windows driverPerforms certificate signing
Signature returned to the application for PDF assembly
No browser extension requiredThe Windows service and certificate driver must still be installed.
Illustrative Windows signing flow. Install SignBridge and the token driver, configure permitted origins, and test browser compatibility.
Example signing journey

From unsigned PDF to certificate-signed PDF

01
Initiate

Your web app prepares the document

The user opens a PDF in your web portal. Your JavaScript computes the document hash and calls SignBridge on localhost.

https://app.yourcompany.com/contracts/sign
1const hash = await computeHash(pdfBytes);
2const certs = await fetch(
3  "https://localhost:9555/certificates"
4);
5// User picks a certificate...

Service_Agreement_2026.pdf

2.4 MB · 12 pages

Ready
02
Discover

SignBridge discovers certificates

SignBridge scans the Windows Certificate Store, detects USB tokens and smart cards, and returns the list to your browser.

Certificate Discovery
2 available

Rajesh Kumar

SELECTED

eMudhra Sub CA · USB Token

Acme Corp

n-Code Solutions · PFX File

Priya Sharma

Capricorn CA · Smart Card

Expired
03
Sign

Hash is signed on the hardware token

SignBridge sends the hash to Windows CryptoAPI. The private key signs the hash directly on the USB token — the key never leaves the device.

Hardware Signing
Complete
Receive hash
Access certificate
CryptoSignHash()
Return signatureExample

Private Key Protected

The private key signed on-device. Never exported or transmitted.

04
Complete

Signed PDF returned to your app

Your application embeds the returned signature into the PDF. Retain the signed file and check it in a PDF reader that supports digital signature validation.

Rajesh Kumar

Signed via USB DSC · eMudhra CA

Valid
Signed
Digitally Signed
Tamper-Evident
IT Act 2000 Valid
Timestamped

Supported Windows browsers

Test your browser and token driver

No extensions needed

Installed Windows service required

Keys stay on device

Hardware token isolation

Localhost only

Zero network exposure

Certificate Management

Every certificate, one bridge

This browser based DSC signing tool works with any certificate in the Windows Certificate Store: USB tokens, smart cards, and PFX files. No custom drivers or browser extensions required for web portal digital signature integration.

Auto-Discovery

SignBridge automatically detects all certificates in the Windows Certificate Store. USB tokens and smart cards are recognized the moment they are inserted.

Scans Personal, Root, and CA stores
Detects USB DSC tokens on insert
Reads certificate metadata & validity

Certificate Selection

Web applications can query available certificates and let users choose which one to sign with. Filter by issuer, key usage, or expiry date.

List available signing certificates
Filter by key usage (digital signature)
Display certificate details to user

Supported Certificate Types

USB DSC Tokens

eMudhra, Sify, n-Code, Capricorn, PantaSign

Hardware tokens from any CCA-certified provider via PKCS#11 or CSP

PFX / P12 Files

Software-based certificates

Password-protected certificate files imported into Windows Certificate Store

Smart Cards

Gemalto, Thales, SafeNet

PKI smart cards accessed through Windows CryptoAPI minidriver

Put it into practice

What you need for browser-based DSC signing

SignBridge connects a web application to local certificates. The signer’s Windows computer needs the service and the appropriate certificate driver.

  1. Prepare the signer’s computer

    Install SignBridge and the DSC token’s Windows driver. Check that the certificate is available in the Windows Certificate Store before connecting the web application.

  2. Connect the web application

    Configure the permitted application origin and certificate discovery flow. Your application prepares the document; the local certificate provider performs the signing operation.

  3. Test the complete signing journey

    Check certificate selection, signer authorization, completed PDF verification and the message shown when the service is not running. Confirm your browser and token-driver combination before rollout.

Discuss your DSC integrationNeed desktop batch signing instead?
FAQ

Frequently asked questions

Everything you need to know about SignBridge and browser-to-certificate signing.

What is SignBridge and what problem does it solve?

SignBridge is a lightweight Windows desktop service (built with Tauri/Rust) that creates an HTTPS bridge between web browsers and the Windows Certificate Store. Browsers cannot directly access USB DSC tokens or local certificates for security reasons. SignBridge runs as a local service on port 9555 and exposes a secure REST API that web applications can call to sign documents using DSC online, without browser extensions or Java applets.

Is SignBridge secure? Can malicious websites use it?

SignBridge uses multiple layers of security: (1) It only listens on localhost (127.0.0.1), so no external network can reach it. (2) Origin validation ensures only whitelisted domains can communicate. (3) CORS headers block unauthorized cross-origin requests. (4) Private keys never leave the hardware token — only the hash is signed. Configure permitted origins carefully and review the complete application integration before deployment.

What certificate types does SignBridge support?

SignBridge works with any certificate accessible through the Windows Certificate Store, including USB DSC tokens (eMudhra, Sify, n-Code, Capricorn, PantaSign), PFX/P12 software certificates, and smart cards (Gemalto, Thales, SafeNet). Any certificate with a Windows CSP/KSP driver is supported.

How does SignBridge handle private keys?

Private keys never leave the hardware token or Windows Certificate Store. SignBridge receives a hash (digest) of the document from the web application, passes it to the Windows CryptoAPI for signing, and returns the signed hash. The actual private key is never exposed to the browser, the web application, or even to SignBridge itself.

Do I need to install browser extensions?

No. SignBridge works entirely through standard HTTPS fetch() calls from the browser. No extensions, plugins, Java applets, or ActiveX controls are required. The local Windows service and token driver still need to be installed. Confirm and test your browser, Windows version and token-driver combination before rollout.

What operating systems does SignBridge support?

SignBridge currently supports Windows 10 (version 1903 and later) and Windows 11, both 64-bit. Windows is the primary target because USB DSC tokens and the Windows Certificate Store are Windows-centric. macOS and Linux support may be added in future versions.

How do I integrate SignBridge with my web application?

Integration involves three steps: (1) Your frontend JavaScript calls fetch("https://localhost:9555/certificates") to list available signing certificates. (2) The user selects a certificate and your app calls fetch("https://localhost:9555/sign") with the document hash. (3) Your backend receives the signed hash and embeds the signature into the PDF. We provide a JavaScript SDK and code examples for common frameworks.

What happens if SignBridge is not installed on the user's machine?

If SignBridge is not running, the fetch() call to localhost:9555 will fail with a network error. Your web application should detect this and show a prompt to download and install SignBridge. We provide a detection script that checks availability and displays appropriate instructions.

Is SignBridge free?

SignBridge is available as a free download for use with SignSecure products (SignPad, SignLift). For standalone enterprise deployment with custom origin whitelisting and dedicated support, contact our sales team for licensing options.

Can multiple web applications use SignBridge simultaneously?

Yes. SignBridge handles concurrent requests from multiple browser tabs and applications. Each request is validated independently. As long as the origin is whitelisted, requests from different applications are processed in parallel.

Bridge your browser to certificates

Download SignBridge and enable web-based digital signing with hardware DSC tokens. Free with SignSecure products, enterprise licensing available.

Request Windows accessEnterprise Licensing

Windows 10/11 · Localhost HTTPS · Supported Windows browsers · No extensions required