E-signatures · Glossary
What is a certificate of completion?
A certificate of completion is a PDF built at the end of a signing that summarises what happened. It carries the envelope details and hashes, one block per signer with their identity check, signing time, IP address and consent record, and the full event log in order. It is the document you hand over when somebody asks you to prove the signing.
Nobody reads a certificate of completion until there is an argument. At that point it is the only thing in the file that answers who, when and how, in one place, in a form a third party can read.
Nuwan Madhusanka · Co-founder
3 min read · Published
Three sections, in order
The envelope section carries the envelope id, when it was sent and completed, how many signers there were, the certification algorithm, and two document hashes: the file as sent and the file once fully signed. The signers section gives one block per person: which identity check they passed, when they signed, from which IP address, when and against which version they accepted the consent, the document hash at their moment of signing, and a hash of their signature image. The event log then lists every event with its sequence number, UTC timestamp, label and the signer's email.
Why the hashes are printed twice
The hash as sent and the hash once fully signed are different numbers, and printing both is what lets somebody check the chain end to end. Take the PDF you were sent, hash it, and it should match the first. Take the finished signed file, hash it, and it should match the second. Each signer's block also records the hash at the moment they signed, so you can place each signature against a specific state of the document.
Attach it, or keep it beside the file
The certificate can be appended to the signed PDF or kept as its own file. Appending has to happen before the document is certified, because a certified PDF at the strictest permission level forbids any change afterwards, including adding a page. If your process appends it later, the certification is either broken or was never applied.
Questions people ask
Do I need the certificate if I have the signed PDF?
The signed PDF proves the file has not changed. The certificate proves the process around it: who was challenged, who authenticated, from where, and in what order. Most disputes are about the process rather than the file, so keeping both is the sensible default and costs nothing.
Does it show the document contents?
No, and deliberately. It carries hashes of the document rather than its text, so the certificate can be shared with somebody who should see the evidence of signing without seeing the commercial terms. The hash is enough to prove which document it refers to.
What is the consent version for?
Electronic signing regimes generally require the signer to be told they are signing electronically and to agree to it. Recording which version of that wording they accepted, and when, is what lets you answer the challenge that they never agreed to sign electronically at all.
Why does it record an IP address?
Because it is the only routine signal about where an action came from. It is not proof of identity and should never be presented as such, but two signatures from the same address, or a signature from an unexpected country, are the sort of thing a challenge turns on.
Can the certificate be forged?
On its own, a PDF is a PDF. What makes it hard to fake usefully is that its hashes have to match the actual documents and its event log has to match a chained audit trail held by the provider. A certificate that contradicts either is evidence of tampering rather than evidence of signing.
Make one with e-signatures
The button opens the generator with this use case already described. Change the wording to match your own.
Send a document for signingRelated questions
- What is an audit trail?An audit trail is the ordered, tamper evident record of everything that happened to a document: who opened it, who was challenged, who signed and when.
- What is PAdES?PAdES is the ETSI standard for digital signatures embedded in a PDF. What it adds over a plain signature, its levels, and how to spot one in a reader.
- Access code against one time codeAn access code is a shared secret you send the signer yourself. A one time code is emailed at signing time and expires. When each is the right check.
- Initials against a signatureA signature signs the agreement. Initials mark that a specific page or clause was seen. When to ask for each, and when initials are theatre.
Step by step in the builder: Send a PDF for e-signature.
Written and checked by the OneCraft team. Last checked .