title: Determining if a file has a digital signature in c# without actually verifying the signature
body: <p>Is there a simple way to check if a digital signature exists on a file without trying to verify the certificate it was signed with?</p>
  
  <p>I want to sign a long list of exe &amp; dll files in a directory, but only files that haven't yet been signed. </p>
  
  <p>For example, if one of the files has been signed by Microsoft or some other 3rd party I don't want to sign them again with my company's certificate.</p>
  
  <p>It is easy to check if a file has a digital signature or not by right-clicking the file and viewing its properties (if the digital signature tab shows up then it has been signed). I'm searching for a simple way to check for this digital signature property using C#.</p>
  
  <p>Right now, I am using the verify command with signtool.exe - which doesn't only check to see if a digital signature exists, but also whether the certificate used to sign the file was issued by a trusted authority.</p>
  
  <p>Here is my simple, yet clunky approach for doing this:</p>
  
  <pre><code>private static Boolean AlreadySigned(string file)
  {
      ProcessStartInfo startInfo = new ProcessStartInfo();
      startInfo.RedirectStandardOutput = true;
      startInfo.RedirectStandardError = true;
      startInfo.FileName = "signTool.exe";
      startInfo.Arguments = "verify /v " + file;
      startInfo.UseShellExecute = false;
  
      Process process = new Process();
      process.StartInfo = startInfo;
      process.EnableRaisingEvents = true;
      process.Start();
      process.WaitForExit();
      string output = process.StandardOutput.ReadToEnd();
  
      return output.Contains("Signing Certificate Chain:");
  }
  </code></pre>
  
  <p>Notice that I'm using the verbose flag "/v" and checking if the output contains the text "Signing Certificate chain:" - just because I noticed that that string was always in the output of a file that had been signed - and was omitted from any file that hadn't been signed.</p>
  
  <p>Anyway, despite its clumsiness, this code seems to get the job done. One reason I'd like to change it though is because it appears to take a few hundred milliseconds to execute the verify command on a file. I don't need to verify the certificate I'm just trying to see if a digital signature exists on the file.</p>
  
  <p>So in short, is there a simple way to check if a digital signature exists - without trying to verify it?</p>