E-signatures · Glossary
What is a certificate authority?
A certificate authority, or CA, is a trusted organisation that issues digital certificates binding a public key to a named person, organisation or website, and that revokes them when they should no longer be trusted. Software trusts a certificate when it chains back through the CA to a root certificate it already trusts.
Every padlock in a browser and every signature panel in a PDF reader rests on a certificate authority. Knowing how the chain works explains why one signed PDF shows a green tick, another shows validity unknown, and neither result says anything about whether the document itself was changed.
Nuwan Madhusanka · Co-founder
4 min read · Published
| Certificate | Issued by | Job |
|---|---|---|
| Root CA certificate | Itself, it is self signed | Trust anchor, shipped in operating systems, browsers and readers |
| Intermediate CA certificate | The root or another intermediate | Issues end entity certificates so the root key can stay offline |
| End entity certificate | An intermediate CA | Identifies the website, organisation or person whose key signs |
| Self signed end certificate | Its own holder | Works technically but proves no identity to anyone else |
What a CA actually does
NIST defines a certificate authority as a trusted entity that issues and revokes public key certificates. Before issuing, the CA checks the applicant to the level its policy promises: control of a domain for a basic website certificate, the legal existence of an organisation for an organisation certificate, or an individual's identity for a personal signing certificate. It then signs a certificate containing the subject's name and public key. RFC 5280 sets the format used across the internet, X.509 version 3, along with how software builds and validates a certification path from the certificate to a trust anchor and how revocation is published through certificate revocation lists.
Trust lists decide who counts
A CA is only trusted where software has been told to trust it. Browsers and operating systems run root programmes, and the CA/Browser Forum, a group of certificate issuers and browser makers, sets baseline requirements for website, code signing and email certificates. PDF signatures use a separate set of lists: Adobe's Approved Trust List names CAs and trust service providers whose signing certificates Acrobat and Reader trust worldwide, and Adobe also works with the European Union Trust List of qualified providers. A certificate from a CA outside those lists can still sign perfectly well, but a reader will report that it cannot confirm who the signer is.
Why a signed PDF says validity unknown
A PDF reader asks two separate questions about a signature. First, has the document changed since signing? That is answered by the hash, regardless of who issued the certificate. Second, can the signer's certificate be traced to a trusted root? If not, the reader marks the signer's identity as unknown. So a file can be intact and still show a warning, and a file can be from a trusted CA and still show that it was modified afterwards. Reading the signature panel, rather than the colour of the icon, tells you which question failed.
Common mistakes
Clicking to trust a certificate in a reader to make a warning go away, which trusts that certificate for every future document. Treating a self signed certificate as proof of identity. Assuming a website certificate can sign PDFs. Forgetting that certificates expire and can be revoked, so long lived signed records need a timestamp and validation data to stay checkable. And confusing the certificate authority with the e-signature service, which may or may not be one.
How completed documents here are certified
The e-sign tool uses one platform certificate, loaded from a P12 file, to certify each completed PDF, with DocMDP permissions so the file cannot be edited or annotated without breaking the certification. Because the certificate belongs to the platform, a reader names the service rather than an individual signer, and depending on the trust lists on that machine it may report the issuer as unknown while confirming the document is unchanged. The evidence about who signed is the certificate of completion, issued as its own file with each signer's verification method, signing time and IP address. Individual signers do not need certificates of their own.
Questions people ask
Is a certificate authority the same as a trust service provider?
Often, but not always. Trust service provider is the EU term for any organisation offering services such as certificates, timestamps or seals, and a qualified one is supervised under eIDAS. Many trust service providers act as certificate authorities, but the CA role is specifically issuing and revoking certificates.
Can I become my own certificate authority?
Technically yes: tools such as OpenSSL can create a root and issue certificates in minutes, and companies run private CAs for internal systems. Nobody outside your organisation will trust those certificates unless they install your root. For documents sent to clients or regulators, use a CA that their software already trusts.
What happens when a certificate authority is distrusted?
Browsers and other root programmes remove or restrict its root, so certificates chaining to it stop being trusted for new uses. Holders have to replace their certificates with ones from another CA. Past signatures may still verify if they carry timestamps and validation data captured while the CA was trusted.
How long does a signing certificate last?
Typically one to three years, depending on the CA and the certificate type, while root certificates often last much longer. After expiry no new signatures can be made with it. Signatures made before expiry can still be validated later if a trusted timestamp proves when they were made.
Does every electronic signature need a certificate authority?
No. Most electronic signatures used in business, such as a drawn or typed signature with an emailed link and an audit trail, involve no certificate for the signer at all and are valid under laws such as the ESIGN Act and the Electronic Transactions Act. Certificates matter for digital signatures and for higher levels such as qualified signatures under eIDAS.
Make one with e-signatures
The button opens the generator with this use case already described. Change the wording to match your own.
Send a document for signingRelated questions
- What is a common seal?A common seal is a company stamp with its name and ACN. Australian companies may still use one, but section 127 lets them sign without it.
- What does fully executed mean?Fully executed means every party required to sign a contract has signed it. How it differs from signed and effective, and what proves it in e-signing.
- What is an electronic seal?An electronic seal is data an organisation attaches to a file to prove its origin and integrity under eIDAS. Seal against signature, and the three levels.
- Why does my signed PDF say validity unknown?Validity unknown means the reader does not recognise the certificate issuer, not that the document changed. How to read the three states and what to do next.
Step by step in the builder: Send a PDF for e-signature.
Written and checked by the OneCraft team. Last checked .