What is a signature certificate?

What is actually inside one

A subject, being the name of the holder and often their organisation and country. A public key. An issuer, naming the authority that produced the certificate. A validity period with a start and an end. A serial number, which is how the certificate is referred to when it is revoked. Extensions that say what the key may be used for, such as document signing rather than encrypting email. And the issuer's own signature over all of it, which is what makes the whole structure trustworthy to somebody who already trusts the issuer.

Chains and trust stores

Certificates come in chains. The signing certificate is issued by an intermediate authority, which is issued by a root, and the root is the part your software already trusts because it shipped in a list maintained by the operating system, the browser or the reader. Verification walks that chain upward until it reaches something in the store. A perfectly valid signature whose chain leads to a root nobody carries will report as untrusted, which is a statement about the list rather than about the file.

Revocation, and why it complicates things

Keys get lost and staff leave, so authorities publish lists of certificates that should no longer be relied on, or answer live queries about individual serial numbers. A reader checking a signature may consult one of those services, which means verification can depend on a network call that could fail or return nothing years later. That dependency is the reason long term validation exists: capture the revocation answer at signing time and embed it, rather than hoping the service still answers in a decade.

Who holds the certificate in a signing service

Two different arrangements get confused. In a certificate based model each signer holds their own certificate, so the signature names the individual. In a hosted signing service the platform holds one certificate and applies it to finished documents, so the signature names the platform and the humans are evidenced by the signing record instead. Neither is wrong, and the second is far more common, but reading a document without knowing which model produced it leads people to expect a name in the signature panel that was never going to be there.

Expiry does not undo a signature

A certificate has a validity window, typically one to three years, and a signature made inside that window remains valid afterwards. What expires is the ability to check easily: a reader looking at an old signature has to establish that the certificate was valid at the time, which requires a trusted timestamp and, ideally, revocation data captured then. Without those, the file may show a warning that says nothing about whether anything is wrong, which is an unsatisfying but accurate outcome.

What the certificate proves about the humans

Only as much as the issuer checked before issuing it. A commercial authority typically verifies that an organisation exists and that the applicant is connected to it. A qualified provider verifies an individual to a defined standard, often in person or through an equivalent remote process. A self signed certificate verifies nothing at all. Reading the issuer, rather than the presence of a green tick, is what tells you how much identity assurance sits behind the name in the panel. Where a business does hold its own certificate, the private key is the thing that matters and it should not live in a file on somebody's laptop. Keys used for document signing normally sit in hardware or in a managed service that will use the key on request but never release it, so a stolen machine does not become a stolen identity. Renewal deserves an owner as well, because a certificate that lapses quietly stops the signing pipeline on a day nobody chose. Both points are ordinary operational hygiene rather than cryptography, and both are where real incidents come from. Neither one appears in a product comparison table. A short annual review naming who holds which key and recording when each certificate lapses covers both concerns, and it takes considerably less time than the first missed renewal would.

Questions people ask