EDS function for a web service

Question

Electronic digital signature

The task is to digitally sign (always the same) pdf-files that are generated on the server and give them to users of the website for download.
What is the best way to organize it?
Now I see such a scheme. There is a key issued by the CA. Some crypto provider is installed on the server (either CryptoPro CSP or VipNet CSP). The problem is that it is not clear how a website can send a file to a crypto provider for signature and how it can get it back. As far as I understand, CryptoAPI is about the operation of windows applications, and not the web.
Or is it not like that at all?

Answer 1

It seems that CryptoPRO is able in * nix systems through the cryptcp utility or csptest.
If you want, you can sign via openssl using Rutoken http://forum.rutoken.ru/topic/1639/
And you don't need to send anything. Everything is done on the server.

Answer 2

.net is great friends with cryptopro, for example - an example of a code is googled once or twice
in 5 minutes, write a backend with http that signs the necessary binaries, the backend is launched from the right user (having access to the private key)
it’s not clear what the difficulty is in fact