Digital Signature PDF

A digital signature in PDF is not the same as a drawn or typed signature — it's a cryptographic hash of the document content, encrypted with the signer's private key and embedded alongside their X.509 certificate. When a recipient opens the signed PDF in a viewer like Adobe Acrobat, it decrypts the signature hash using the signer's public key, recomputes the hash of the document content, and verifies they match. Any modification to the document after signing — even changing a single byte — invalidates this hash comparison, providing tamper-evidence.

PDF digital signatures conform to the PKCS#7/CMS (Cryptographic Message Syntax) standard and reference the signer's X.509 certificate, which contains their public key and identity information. The certificate is issued by a Certificate Authority (CA) — Adobe's Approved Trust List (AATL) and European Trust Service Providers under eIDAS are the primary sources of certificates recognized as trusted by default in Acrobat and other viewers.

For documents that don't require third-party trust validation, self-signed certificates provide the same tamper-evidence guarantees — they simply won't show as 'trusted' in Acrobat without manually adding the certificate to the viewer's trusted identity store.

When Adobe Acrobat validates a digital signature, it checks the entire certificate trust chain from the signer's certificate up to a root CA certificate that Acrobat trusts by default (via AATL or EUTL). A signature from a self-signed certificate shows a yellow question mark — 'validity unknown' — because Acrobat can't verify the issuer. A signature from an AATL-trusted CA certificate shows a green checkmark with 'Document has not been modified since this signature was applied.' Long-term Validation (LTV) embedding includes OCSP responses or CRL data in the signed PDF so the signature remains verifiable after the signing certificate expires, which is essential for documents with multi-year retention requirements.