PDF Digital Signatures: Authentication and Integrity

Digital Signatures vs Electronic Signatures

These terms are often used interchangeably but are technically different. An electronic signature is any electronic indication of intent to agree — a typed name, a scanned handwritten signature, or a checkbox. A digital signature is a specific technology using public-key cryptography that provides three guarantees:

1. Authentication — The signer is who they claim to be
2. Integrity — The document hasn't been altered after signing
3. Non-repudiation — The signer cannot deny having signed

How PDF Digital Signatures Work

When you digitally sign a PDF:

1. The signing software computes a hash (SHA-256) of the document content
2. The hash is encrypted with the signer's private key, creating the signature
3. The signature, the signer's certificate, and a timestamp are embedded in the PDF
4. Any subsequent modification to the PDF invalidates the hash, visibly breaking the signature

Certificate Types

Self-Signed Certificates

Anyone can create a self-signed certificate for free. However, recipients cannot verify the signer's identity — the certificate only proves the document hasn't been modified. Suitable for internal documents where both parties already trust each other.

CA-Issued Certificates

Certificate Authorities (CAs) verify the signer's identity before issuing a certificate. Recipients can validate the signature by checking the CA's trust chain. Required for legally binding documents in most jurisdictions.

Qualified Electronic Signatures (QES)

QES certificates meet the highest legal standard under regulations like eIDAS (EU) and carry the same legal weight as handwritten signatures. They require face-to-face identity verification and are stored on secure hardware.

Signature Validation

When opening a signed PDF, the reader application checks:

• Is the certificate valid (not expired or revoked)?
• Is the certificate issued by a trusted CA?
• Does the document hash match the signed hash?
• Was the signature applied before the certificate expired?

A green checkmark typically indicates all checks pass. A yellow warning means the certificate is self-signed or from an untrusted CA. A red X means the document has been modified after signing.

Best Practices

Sign as the last step after all editing is complete — any change after signing invalidates the signature. Include a timestamp from a trusted timestamp authority (TSA) to prove when the signature was applied. For multi-party signing, use incremental signatures so each signer's signature remains valid.