# ASiC-E File Reader: reading a container by hand

> You do not need special software to see what an ASiC-E file reader does. A ZIP tool and a text editor are enough to follow every step, which is useful when you build an integration or debug a rejected file.

Source: https://asiceviewer.com/en/blog/asice-file-reader/
Published: 2026-11-10 · Digixy

## In short

- An ASiC-E container is a ZIP archive with a fixed layout.
- `mimetype` must be the first entry and must be stored uncompressed.
- Signer, signing time and file digests are plain XML in `META-INF/signatures*.xml`.

## Unpack it

Copy the file, rename the copy to `.zip` and extract it, or run:

- `unzip -l contract.asice` to list the entries;
- `unzip contract.asice -d contract` to extract them.

You will see the documents, a `mimetype` file and a `META-INF` directory.

## Check the mimetype entry

The file must contain exactly `application/vnd.etsi.asic-e+zip`, with no line break. The standard requires it to be the first entry in the archive and to be stored without compression, so that software can recognise the container by looking at the first bytes. Tools that re-zip a container often break this rule, and strict validators then reject the file.

## Read the signature XML

Open `META-INF/signatures0.xml`. It is XAdES, an XML signature with extra properties. The parts worth knowing:

| Element | Meaning |
| `ds:Reference` + `ds:DigestValue` | One per signed file: its name and Base64 digest |
| `ds:SignatureValue` | The signature itself |
| `ds:X509Certificate` | The signer's certificate, Base64-encoded DER |
| `xades:SigningTime` | The time claimed by the signer's computer |
| `xades:ClaimedRole` | Role or resolution text entered by the signer |
| `xades:EncapsulatedTimeStamp` | A trusted time stamp over the signature |
| `xades:EncapsulatedOCSPValue` | Proof that the certificate was valid |

## Verify a digest yourself

Compute the SHA-256 of a document and Base64-encode it:

- `openssl dgst -sha256 -binary contract.pdf | openssl base64`

The output must equal the `DigestValue` of the matching reference. This is the same integrity check that [ASiCE Viewer](https://asiceviewer.com/en/#tool) performs automatically for every file.

## What reading by hand does not give you

A digest match proves the file is unchanged. It does not prove the signature value is mathematically correct, nor that the certificate chains to a trusted authority and was not revoked. That needs canonicalisation, public-key verification and trust lists, which is what validation libraries are for. The layers are explained in [ASiC-E signature verification](https://asiceviewer.com/en/blog/asice-signature-verification/) and the layout in [ASiC-E file format](https://asiceviewer.com/en/blog/asice-file-format/).

## Frequently asked questions

**Can I edit a file after unzipping and zip it back?**

You can, but the digest will no longer match and every signature becomes invalid for that file.

**Why is the signing time different from the time stamp?**

SigningTime comes from the signer's own clock. The time stamp is issued by a trusted service a moment later and is the legally reliable time.

---

Open your .asice file now: https://asiceviewer.com/en/
ASiC-E Viewer on Google Play: https://play.google.com/store/apps/details?id=com.digixy.asiceviewer