Detached .p7s signature for SEAP/SICAP with Simplifi Sign and EU DSS
Some SICAP tender data sheets require bid documents to be accompanied by a detached signature in .p7s (CAdES) format. Acrobat produces only PAdES (signature inside the PDF), and so does Simplifi browser signing. For .p7s you use the Simplifi certificate, exposed by Simplifi Sign, in a CAdES application: the European Commission's free EU DSS Standalone app, on Windows.
When you need .p7s and what it is
GD 395/2016, art. 60(4), requires bid documents to be signed with an electronic signature based on a qualified certificate. The contracting authority sets the format in the data sheet: most often a signed PDF (PAdES), sometimes a ".p7s file" or "detached signature", especially for ZIP archives.
A .p7s file is a detached CAdES signature: a separate file that signs any document or archive without modifying it. It is uploaded to SICAP together with the original document.
Simplifi Sign exposes your qualified certificate to the operating system (Windows certificate store). Any CAdES application that reads that store can sign with it. The EU DSS Standalone app, published by the European Commission, does exactly that, free and offline (except OCSP/CRL checks).
Steps (Windows)
- 01
Check the certificate in Windows
With Simplifi Sign running and logged in, open certmgr.msc > Personal > Certificates. Your Simplifi certificate must show the key icon (has a private key). DSS reads exactly this list.
- 02
Download EU DSS Standalone
From the DSS demo's "Standalone application" page (ec.europa.eu/digital-building-blocks), choose the Windows x64 "Complete" archive (includes Java). Unzip it to a folder without spaces in the name and run dss-run.bat. Windows SmartScreen may ask for confirmation.
- 03
Configure the signature
In the Signature window: Signature format CAdES, Packaging DETACHED, Level CAdES-BASELINE-B, Digest SHA256. Token: MS CAPI. Pick the file to sign (PDF, ZIP, anything).
- 04
Sign with the Simplifi certificate
Press Sign, choose the certificate issued by "Simplifi Qualified CA" and confirm in Simplifi Sign when prompted. DSS saves the signature as a separate file, usually the document name plus the .p7s extension.
- 05
Validate
In DSS's Validation tab, upload the .p7s and, under "Detached content", the original document. Expected result: CAdES-BASELINE-B, QESig, TOTAL_PASSED. On first run it may show "indeterminate" until DSS downloads the EU Trusted List; retry after a minute.
- 06
Upload to SICAP
Upload the original document and the .p7s file together at the step the data sheet requires. Do not rename or modify either file after signing.
Common problems
- DSS does not show the Simplifi certificate under MS CAPI
- Simplifi Sign is not running or you are not logged in. Check in certmgr.msc that the certificate appears with a private key, then restart DSS.
- "Signature not valid" in SICAP or at the authority
- Most often: the original file was modified or renamed after signing, or the .p7s was made on a different file (e.g. on the PDF while the archive was uploaded to SICAP). A detached signature is bound to the file's exact bytes.
- You need a timestamp (CAdES-T)
- SEAP does not require a timestamp in the .p7s. Simplifi's timestamp is applied on our servers and is not exposed as an RFC 3161 service, so DSS produces CAdES-B. Do not use free public time servers: they are not qualified.
Frequently asked questions
- Is a .p7s made this way qualified?
- Yes, the certificate is qualified and the key is protected in Simplifi's QSCD; DSS only formats the CAdES signature. The validator reports it as QESig.
- One .p7s per document or one per archive?
- As the data sheet requires. If unspecified, the safest is one .p7s for each uploaded file.
- Does it work on macOS?
- Not yet for .p7s: EU DSS Standalone has no macOS build. Sign PDFs in the browser or use a Windows computer for .p7s.
- Why not use the DSS web demo?
- The web demo signs on the Commission's server, requires a .p12 file with an exportable key and uploads your documents there. It is unsuitable both technically (the Simplifi key is not exportable) and for bid confidentiality.