[Bug]: SignedXml does not support external signing or expose pre-sign SignedInfo

[marcus905]

Describe the issue

The System Application SignedXml codeunit currently supports computing an XML signature when Business Central has access to the signing key.

However, it does not expose a way to separate XML signature construction from the actual private-key operation.

This prevents use of SignedXml with external signing providers such as:

• remote signing APIs;
• qualified trust service providers;
• hardware security modules;
• centralized signing services;
• other systems where the private key is intentionally not available to Business Central.

For XMLDSIG/XAdES, the external signer must sign the canonicalized SignedInfo produced by the XML signature implementation.

The current public API does not expose:

• the canonicalized/pre-sign SignedInfo data;
• a prepare-signature operation returning the exact data that must be signed;
• or a completion operation allowing a caller to supply an externally produced SignatureValue.

ComputeSignature() therefore couples document construction and the private-key operation.

Expected behavior

SignedXml should support an external-signing workflow where Business Central can construct the signature, obtain the exact data that must be signed externally, and later supply the resulting signature value.

A conceptual API could look like:

PrepareSignature(...)
GetDataToSign(...)
SetSignatureValue(...)
CompleteSignature(...)

The exact API design may differ.

Alternatively, exposing the canonicalized SignedInfo together with a supported way to inject the externally generated SignatureValue would provide the necessary primitive.

The existing ComputeSignature() API should remain available as a convenience for scenarios where Business Central has direct access to the private key.

Steps to reproduce

1. Create an XML document and initialize SignedXml.
2. Configure the required references, transforms, digest methods, KeyInfo, and XML objects.
3. Assume that the private key is held by an external signing service and is not available to Business Central.
4. Attempt to retrieve the canonicalized SignedInfo or equivalent data that must be sent to the external signing service.
5. Observe that no public API exposes this data.
6. Attempt to provide a SignatureValue returned by the external service and complete the XML signature.
7. Observe that no supported public API allows this workflow.

The only available signing operation performs the private-key operation internally.

Additional context

Separating signature-format construction from the private-key operation is a common requirement for modern signing architectures.

In particular, qualified electronic signatures and enterprise signing solutions often use remote signing services or HSM-backed keys where the calling application is deliberately not allowed to access the private key.

Our immediate use case is XAdES creation from AL, but the missing primitive is generic to XMLDSIG.

A useful abstraction would allow the same signature structure to support both:

Business Central prepares SignedInfo
    ↓
local key signs it
    ↓
signature completed

and:

Business Central prepares SignedInfo
    ↓
remote/HSM/QTSP signs it
    ↓
signature returned
    ↓
Business Central completes the XML signature

This would also avoid individual extensions having to implement their own XML canonicalization or XMLDSIG construction merely to use an external signing provider.

We are preparing broader AdES functionality and would be willing to contribute the required System Application change and tests if appropriate.

I will provide a fix for a bug

• I will provide a fix for a bug

[github-actions]

🤖 AI triage completed. Product group, please validate the triage report (Microsoft internal access only, use Ctrl+Click to open in new tab).

---

_{Was this triage helpful? React with 👍 or 👎 on this comment to provide feedback.}

[marcus905]

One clarification regarding the intended external-signing flow:

The signer certificate/public key can be assumed to be known before
PrepareSignature() is called.

This is important for XAdES because signed properties can bind the
signature to the signing certificate (for example through
SigningCertificate / SigningCertificateV2), and those properties are
themselves referenced from SignedInfo.

So the intended flow is:

1. Resolve/select the signer certificate (and optionally its chain).
2. Construct the XMLDSIG/XAdES structure, including certificate-dependent
   signed properties and references.
3. Prepare/canonicalize SignedInfo and return the exact bytes to sign.
4. Send those bytes to the external/HSM/QTSP signer.
5. Receive SignatureValue.
6. Inject SignatureValue and complete the XML signature.

The private key is never required by Business Central, but the signer
identity/certificate is available before the pre-sign data is produced.

This is analogous to remote CAdES signing, where signingCertificateV2 must
be constructed before the external signature operation.