How to Retrieve Certificate Policy OID from a Signed PDF in C#

The Syncfusion Essential^® PDF library is a robust, high-performance .NET PDF library that enables developers to work with PDF documents programmatically. Using this library in C#, you can access and validate digital signatures embedded in a PDF and retrieve the certificate policy Object Identifier (OID). This capability allows you to extract certificate policy information from digitally signed PDF documents, helping verify authenticity and evaluate the level of trust associated with the digital signatures for compliance and validation purposes.

Steps to retrieve the Certificate Policy OID from a digitally signed PDF

1. Create a new project: Start a new console application in .NET core.
   
   
2. Install required packages: Add the Syncfusion.Pdf.Net.Core NuGet package as a reference in the console application from Nuget.org.
   
   
3. Set up the environment: In the Program.cs file, include the following namespaces.

using Syncfusion.Pdf.Parsing;
using Syncfusion.Pdf.Security;
using System.Security.Cryptography.X509Certificates;

4. Implement main logic: Use the provided code sample in Program.cs to retrieve the Certificate Policy OID from a digitally signed PDF document using C#.

// Load signed PDF
using (PdfLoadedDocument document = new PdfLoadedDocument(Path.GetFullPath(@"Data/Input.pdf")))
{
    // Get the PDF form
    PdfLoadedForm form = document.Form;
    if (form != null && form.Fields != null && form.Fields.Count > 0)
    {
        foreach (PdfLoadedField field in form.Fields)
        {
            // Check for signature field
            if (field is PdfLoadedSignatureField signatureField && signatureField.IsSigned)
            {
                Console.WriteLine($"Signature Field: {signatureField.Name}");
                // Validate signature
                PdfSignatureValidationResult result = signatureField.ValidateSignature();
                if (result?.Certificates != null && result.Certificates.Count > 0)
                {
                    X509Certificate2 certificate = result.Certificates[0];
                    Console.WriteLine("Issuer: " + certificate.Issuer);
                    Console.WriteLine("Subject: " + certificate.Subject);
                    string policyId = GetCertificatePolicyOID(certificate);

                    if (!string.IsNullOrEmpty(policyId))
                    {
                        Console.WriteLine($"Policy OID: {policyId}");
                    }
                    else
                    {
                        Console.WriteLine("❌ Certificate policy not found.");
                    }
                    Console.WriteLine("-----------------------------------");
                }
            }
        }
    }
}

// Extract Certificate Policy OID (2.5.29.32)
string GetCertificatePolicyOID(X509Certificate2 certificate)
{
    foreach (X509Extension extension in certificate.Extensions)
    {
        if (extension?.Oid?.Value == "2.5.29.32")
        {
            string formatted = extension.Format(true);
            // Example format contains: "Policy Identifier=OID"
            return ExtractPolicyID(formatted);
        }
    }
    return null;
}

// Extracts Policy Identifier from formatted string
string ExtractPolicyID(string policyText)
{
    if (string.IsNullOrEmpty(policyText))
        return null;
    const string keyword = "Policy Identifier=";
    int index = policyText.IndexOf(keyword, StringComparison.OrdinalIgnoreCase);
    if (index < 0)
        return null;
    index += keyword.Length;
    int endIndex = policyText.IndexOf(",", index);
    string rawOid;
    if (endIndex > index)
        rawOid = policyText.Substring(index, endIndex - index);
    else
        rawOid = policyText.Substring(index);
    // Clean unwanted characters
    return CleanOID(rawOid);
}

string CleanOID(string oid)
{
    if (string.IsNullOrEmpty(oid))
        return null;
    // Remove line breaks, tabs, spaces
    oid = oid.Replace("\r", "")
             .Replace("\n", "")
             .Replace("\t", "")
             .Trim();
    // Remove anything after invalid characters like '['
    int index = oid.IndexOfAny(new char[] { '[', ' ' });
    if (index > 0)
        oid = oid.Substring(0, index);
    return oid.Trim();
}

A complete working sample is available for download from GitHub.

By executing the program, you will generate the following PDF document.

Take a moment to peruse the documentation to learn how to apply and manage digital signatures in PDF document.

Conclusion

We hope you found this guide helpful in learning how to retrieve the Certificate Policy OID from a digitally signed PDF using C#.

You can refer to our PDF feature tour page to know about its other groundbreaking feature representations and documentation, and how to quickly get started for configuration specifications. You can also explore our PDF example to understand how to create and manipulate data.

For current customers, you can check out our components from the License and Downloads page. If you are new to Syncfusion^®, you can try our 30-day free trial to check out our other controls.

If you have any queries or require clarifications, please let us know in the comments section below. You can also contact us through our support forums, Direct-Trac, or feedback portal. We are always happy to assist you!