Tamper proof signed PDF

A document level signature, not another mark

The signatures the parties drew are pictures stamped onto pages. This is something else entirely: a cryptographic signature over the bytes of the whole file, written into the PDF as a detached CMS structure in the standard Adobe form. It is not visible on any page, has no drawn appearance, and belongs to the platform rather than to any signer. It is applied once, at the very end, after every human signature is in place.

Certification at level one

It is added as a certifying signature rather than an ordinary approval one, with a document modification detection permission of one. That is the strictest setting: no change whatsoever is permitted after it, not form filling and not annotation. The permission is written into the document catalogue and the form flags are set to signatures exist and append only, so a reader knows to enforce it before it has finished parsing the file.

Why the certificate goes in first

If you asked for the certificate of completion to be included in the signed PDF, its pages are appended before certification, never after. Adding pages to a document already certified at level one is exactly the change the certification forbids, and a reader would flag the result as altered. The build order is therefore fixed: stamp every signature, hash it, build the certificate, append it if asked, then certify.

What a reader shows

A PDF reader that understands signatures will show a signature panel listing one signature over the whole document, with the reason recorded as all required signatures completed and a signing time. It will report whether the byte range still hashes to what the signature says. If somebody edited a figure, deleted a page or re-saved the file from another tool, that check fails and the reader says the document has been changed since it was signed.

It never degrades quietly

If certification cannot be applied, the envelope does not fall back to publishing an uncertified file. It moves to a failed state, the sender is emailed with the reason, and no completed document is distributed. That is deliberate. An earlier generation of this feature shipped unsigned output when something went wrong and still called it signed, which is worse than a visible failure because nobody finds out until it matters.

How it works, in three steps

1. Step 1

   Send and let everyone sign

   Certification is not something you switch on. It happens automatically once the last signature has been stamped in.

2. Step 2

   Download the signed document

   The Signed document button on the status page gives you the certified file, named after the envelope title.

3. Step 3

   Open it in a reader that checks signatures

   The signature panel reports one document level signature and whether the file still matches it.

Limits worth knowing

• Certification proves the file has not changed since issue. It does not prove anything about who the signers are; that is what the identity checks and the certificate are for.
• Whether your reader trusts the signing certificate depends on that reader's trust settings, not on us.
• Once certified the file cannot be added to. Merging it into a larger PDF will invalidate the certification.
• Only the completed file is certified. The working copies made after each individual signature are not.

Questions people ask

Related pages