E-signatures · Glossary
What is a self-signed certificate?
A self-signed certificate is a digital certificate signed with its own private key rather than by a separate certificate authority. It shows the holder controls the key, but nobody independent has vouched for who the holder is, so browsers and PDF readers do not trust it unless the user adds it to their trusted list.
Every chain of trust ends in a self-signed certificate, because root authorities sign their own. The difference is whether your software already trusts that root.
Indunil Asanka · Co-founder
4 min read · Published
| Certificate | Who vouches for it | How readers treat it |
|---|---|---|
| Self-signed end certificate | Nobody but the holder | Untrusted until manually trusted |
| Issued by a private CA | The organisation running the CA | Trusted inside that organisation if its root is installed |
| Issued by a public CA | A publicly audited authority | Trusted where that root is in the trust store |
| Chains to an Adobe AATL root | A CA on Adobe's Approved Trust List | Trusted by Adobe Acrobat and Reader by default |
How a certificate is signed
A digital certificate binds a public key to a name, under the X.509 format described in RFC 5280. Normally a certificate authority signs it with the authority's own private key, so anyone who trusts the authority can trust the certificate. In a self-signed certificate, the issuer and the subject are the same, and the certificate is signed with its own key. NIST's glossary, drawing on SP 800-57, defines it as a public-key certificate whose digital signature may be verified by the public key contained within the certificate, and adds that its signature protects the integrity of the information but does not guarantee its authenticity.
Why readers flag it
When a PDF reader checks a signature, it validates the signer's certificate up a chain to a root it already trusts. A self-signed certificate is its own root, and unless the reader has been told to trust it, the chain stops at an unknown key. Adobe Acrobat then shows the signature as valid in the sense that the document has not changed, but with the identity of the signer unknown or not verified. That is the same message people see on many signed PDFs from smaller services, and the question page on validity unknown explains it in more depth.
When self-signed is reasonable
Root certificate authorities are self-signed by design. Inside a company, a private CA whose self-signed root is installed on every managed computer works well. For development and testing, self-signed certificates are common. What they cannot do is give a stranger independent assurance of identity, which is why public websites and qualified electronic signatures rely on recognised authorities.
Common mistakes
Assuming a validity unknown message means the document was altered; usually it means only that the certificate is not in the reader's trust list. Telling recipients to click trust on any certificate, which teaches a dangerous habit. Comparing a self-signed web certificate with a document signing certificate, which serve different purposes. And believing an untrusted certificate makes an electronic signature legally invalid; the law looks at identity and intent, not only at the certificate chain.
Certificates in the product
When an envelope completes, the e-sign module certifies the PDF with a signature from a P12 certificate in the ISO 32000 PDF signature form, at DocMDP level 1 so the document cannot be edited afterwards without breaking it. This is not ETSI baseline PAdES, and no RFC 3161 timestamp token is attached in the deployed setup today. Separately, a certificate of completion lists each signer's verification method, signing time and IP address, which is the evidence most disputes turn on.
Questions people ask
Is a self-signed certificate secure?
The cryptography can be as strong as any other certificate. What is missing is independent identity checking: anyone can create a self-signed certificate claiming any name. So it secures the link to a key, not the identity behind it, unless you verified that key some other way, such as receiving its fingerprint in person.
Why does my signed PDF say the signature validity is unknown?
Usually because the signing certificate does not chain to a root your PDF reader trusts, as with a self-signed or private CA certificate. The document integrity check can still pass. Check the signature panel: if it says the document has not been modified since it was signed, the content is intact.
Should I add a self-signed certificate to my trusted list?
Only if you have confirmed it belongs to the sender through a separate channel, such as comparing its fingerprint with one the sender gave you directly. Trusting it blindly lets anyone with a similar certificate appear trusted to you in future. For one off documents, checking the audit evidence is often enough.
Can an electronic signature be valid without a trusted certificate?
Yes. Laws such as the Australian Electronic Transactions Act 1999 and the US ESIGN Act accept electronic signatures that identify the signer and show intent, by a method reliable for the purpose. Certificates are one way to provide evidence; email verification, codes and an audit trail are others.
What is the difference between a self-signed certificate and a certificate authority?
A certificate authority is an organisation that signs other people's certificates after checking their identity, and its own root certificate is self-signed. A self-signed end certificate has no authority behind it. Trust depends on whether the root at the top of the chain is in your software's trust store.
Make one with e-signatures
The button opens the generator with this use case already described. Change the wording to match your own.
Send a document for signingRelated questions
- What is a certificate authority?A certificate authority issues and revokes the certificates that sign PDFs and secure websites. Root and intermediate CAs, trust lists, and unknown validity.
- Why does my signed PDF say validity unknown?Validity unknown means the reader does not recognise the certificate issuer, not that the document changed. How to read the three states and what to do next.
- What is a digital signature?A digital signature signs a hash of the file with a private key. What it proves, what it does not, and how one is embedded in a signed PDF.
Step by step in the builder: Send a PDF for e-signature.
Written and checked by the OneCraft team. Last checked .