Unpack it
Copy the file, rename the copy to .zip and extract it, or run:
unzip -l contract.asiceto list the entries;unzip contract.asice -d contractto extract them.
You will see the documents, a mimetype file and a META-INF directory.
Check the mimetype entry
The file must contain exactly application/vnd.etsi.asic-e+zip, with no line break. The standard requires it to be the first entry in the archive and to be stored without compression, so that software can recognise the container by looking at the first bytes. Tools that re-zip a container often break this rule, and strict validators then reject the file.
Read the signature XML
Open META-INF/signatures0.xml. It is XAdES, an XML signature with extra properties. The parts worth knowing:
| Element | Meaning |
|---|---|
ds:Reference + ds:DigestValue | One per signed file: its name and Base64 digest |
ds:SignatureValue | The signature itself |
ds:X509Certificate | The signer's certificate, Base64-encoded DER |
xades:SigningTime | The time claimed by the signer's computer |
xades:ClaimedRole | Role or resolution text entered by the signer |
xades:EncapsulatedTimeStamp | A trusted time stamp over the signature |
xades:EncapsulatedOCSPValue | Proof that the certificate was valid |
Verify a digest yourself
Compute the SHA-256 of a document and Base64-encode it:
openssl dgst -sha256 -binary contract.pdf | openssl base64
The output must equal the DigestValue of the matching reference. This is the same integrity check that ASiCE Viewer performs automatically for every file.
What reading by hand does not give you
A digest match proves the file is unchanged. It does not prove the signature value is mathematically correct, nor that the certificate chains to a trusted authority and was not revoked. That needs canonicalisation, public-key verification and trust lists, which is what validation libraries are for. The layers are explained in ASiC-E signature verification and the layout in ASiC-E file format.
Frequently asked questions
Can I edit a file after unzipping and zip it back?
You can, but the digest will no longer match and every signature becomes invalid for that file.
Why is the signing time different from the time stamp?
SigningTime comes from the signer's own clock. The time stamp is issued by a trusted service a moment later and is the legally reliable time.