XAdES XML Digital Signatures for Oracle Applications
PL/XSIGN adds standards-based XML digital signatures directly to Oracle business workflows. Create and validate XAdES signatures for XML documents and application data using Oracle and PL/SQL.
Standards-based XAdES signing for XML
Create baseline XAdES signatures or add trusted RFC 3161 timestamps when your workflow requires stronger evidence of when a signature existed.
XAdES B-B
Create baseline XML digital signatures
Create certificate-based XAdES B-B signatures directly from Oracle over XML documents and detached XML payloads.
- Enveloped XAdES signatures
- Detached XAdES signatures
- XMLDSig-based signature structure
- XAdES signed properties
- Certificate-based signing
- Oracle XMLTYPE integration
XAdES B-T
Add trusted timestamps to XML signatures
Create XAdES B-T signatures with RFC 3161 SignatureTimeStamp evidence, or upgrade an existing valid XAdES B-B signature to B-T.
- RFC 3161 SignatureTimeStamp
- Enveloped and detached B-T signatures
- Direct B-T signing
- B-B to B-T augmentation
- TSA response validation
- PL/SQL callback or HTTPS TSA integration
XML signing where your business logic already runs
PL/XSIGN is designed around Oracle applications and XMLTYPE, allowing XML signing and validation to become part of the database workflow that already creates and processes your business data.
Oracle-first
Integrate XML digital signatures with Oracle data, PL/SQL applications, database jobs and existing enterprise workflows.
Standards-based
Use established XMLDSig and XAdES structures instead of introducing a proprietary XML signing and verification format.
Built for integration
Add signing and validation to existing XML workflows without replacing the applications or systems that generate and consume the XML.
Enveloped and detached XML signatures
Choose whether the XAdES signature becomes part of the XML document or remains a separate signature document alongside the signed payload.
Enveloped signing
Create the XAdES signature inside the XML document itself. PL/XSIGN signs the complete XML document and returns a new signed XMLTYPE value.
Detached signing
Create a standalone XAdES Signature XML document while keeping the original XML payload separate. The application supplies both the payload and its reference URI; PL/XSIGN does not fetch the referenced resource.
From signing to timestamps and validation
PL/XSIGN covers the complete technical workflow around XAdES B-B and B-T signatures—from signature creation and external signing to timestamp processing, validation, trust and revocation checks.
Local or external signing
Sign locally or use prepare/complete APIs when the private key must remain outside Oracle in an HSM, remote signing service or other external signing environment.
- Local XAdES B-B signing
- Two-phase external signing
- Enveloped and detached requests
- Data-to-sign and hash-to-sign outputs
- Application-controlled external signer integration
RFC 3161 timestamping
Create and validate RFC 3161 timestamp requests and responses, or integrate timestamping directly into XAdES B-T signing.
- Timestamp request creation
- Timestamp response validation
- Message imprint and nonce checking
- PL/SQL callback transport
- Direct HTTP(S) TSA transport
B-B to B-T upgrade
Add an RFC 3161 SignatureTimeStamp to an existing technically valid XAdES B-B signature without creating the original signature again.
- Enveloped B-B to B-T upgrade
- Detached B-B to B-T upgrade
- Callback-based TSA integration
- Direct TSA URL integration
- Original input remains unchanged
XAdES B-B validation
Validate XMLDSig core integrity and the XAdES B-B profile for enveloped or detached signatures.
- XMLDSig validation
- Signature and reference structure
- SignedProperties validation
- SigningTime validation
- SigningCertificate validation
- DataObjectFormat and profile validation
XAdES B-T validation
Validate XAdES B-T profile integrity together with the embedded RFC 3161 SignatureTimeStamp evidence.
- B-B technical validation
- SignatureTimeStamp validation
- Timestamp token validation
- Timestamp message imprint validation
- TSA certificate information
- Enveloped and detached validation
Trust and revocation validation
Validate signer and timestamp certificate paths using trust material supplied explicitly by your application.
- Caller-supplied trust anchors
- Intermediate certificates
- OCSP responses
- CRLs
- Certificate path and trust status
- Revocation status
Validation you can integrate into application logic
PL/XSIGN exposes detailed validation information instead of reducing signature verification to a single valid or invalid result.
Technical validation
Inspect XMLDSig validity, signature structure, references, XAdES qualifying properties, signing certificate information and profile compliance.
PKI validation
Evaluate certificate usage, path, trust and revocation using the trusted roots, intermediate certificates, OCSP responses and CRLs selected by your application.
Timestamp validation
For XAdES B-T, inspect timestamp presence, token integrity, message imprint, generation time and TSA certificate trust and revocation results.
Keep private keys outside Oracle when required
PL/XSIGN supports two-phase external signing for XAdES B-B, allowing the cryptographic signature to be produced by infrastructure outside the database.
PL/XSIGN prepares the exact data and SHA-256 hash to sign. Your HSM, remote signer or signing service produces the signature value, and PL/XSIGN completes the XAdES document. The resulting B-B signature can then be timestamped to create XAdES B-T.
Built for automated XML business workflows
XML signatures can become part of the same Oracle process that creates, exchanges, stores and validates structured business data.
Structured business documents
Sign XML invoices, structured documents and other application-generated XML where integrity and signer authentication are required.
System-to-system messages
Add signed XML payloads to automated integrations, message exchange and electronic business processes without adding a separate signing application.
Automated validation
Validate incoming XAdES signatures inside Oracle and use the detailed technical, trust and revocation results in your own acceptance and processing logic.
Keep control of your XML signing architecture
PL/XSIGN provides the signing, timestamp and validation building blocks while allowing your organization to control certificates, private keys, TSA integration and trust material.
Your Oracle environment
Keep XAdES signing and validation integrated with the database applications and infrastructure your organization already operates.
Your trust model
Supply the trust anchors, certificate chains, OCSP responses and CRLs that your application policy requires instead of relying on implicit network retrieval.
Your timestamp service
Connect to the RFC 3161 TSA selected by your organization through a PL/SQL callback or direct HTTP(S) integration.
Part of the PL/ signing family
Use PL/XSIGN for XAdES and XML workflows. For CAdES application-data signatures and PAdES PDF signatures, use PL/SIGN.
Try PL/XSIGN
Request access to a hosted sandbox, or evaluate PL/XSIGN in your own Oracle environment with an install kit and a 31-day evaluation key.