Carillon Information Security blog

What Can You Verify in a Signed PDF?

Author — Tue, 13 Oct 2026 18:34:50 GMT

A name typed into a PDF and a certificate-based digital signature can both be used to sign electronically. They give the recipient different ways to verify what happened.

An electronic signature might be a typed name, a signature drawn on a screen or a scanned image of a handwritten signature. It can show intent to approve. By itself, though, the visible signature cannot tell you who placed it there—or whether the document changed afterward.

A digital signature uses a certificate to connect a signer to a specific version of a file. Compatible software can check the signature and identify changes to the signed content.

You may hear several terms around this technology. They are variations on a theme, each describing a different piece of the trust process:

Digital credential: Information issued to a person to support a claim about their identity or status—for example, that they hold a professional designation.
Digital certificate: A technical certificate that connects an identity to the cryptographic key used for signing.
Digital signature: The result of using that key to sign a document, allowing a recipient to check signer information and the file’s integrity.
Digital seal: A term whose meaning depends on context. It may refer to a professional seal displayed on a document or a technical means of authenticating it. An image of a seal alone does not provide the checks of a digital signature.

What gives a signature credibility?

The technology can help show whether a signed file has changed. Trust in the signer also depends on how their identity was verified before a credential was issued and how access to it is controlled. These checks can provide different levels of assurance, from basic to more rigorous verification.

When receiving a signed document, open the original PDF file in software that supports signature validation. Check the signer’s name, the certificate issuer, the validation result and any changes reported after signing. If professional status matters, verify that claim through an appropriate source as well.

The next time a signed PDF lands in your inbox, look beyond the visible signature. Open the signature panel and see what you can verify.

What’s Inside a Digital Signing Certificate?

Author — Tue, 13 Oct 2026 18:34:40 GMT

When you open the signature panel of a signed PDF, you may see a signer’s name, an organization, dates and a list of certificates. Those details come from an X.509 certificate: a standard format for connecting identifying information to the public key used to verify a digital signature. The signer’s private key is kept separately; it is not included in the PDF’s certificate.

The certificate helps answer three practical questions: Who is identified as the signer? Who issued the certificate? And can this signature be validated?

The fields you’re likely to see

Subject: The person or entity identified by the certificate. Its fields may include a Common Name (CN), such as a person’s name; an Organization (O); and an Organizational Unit (OU), such as a department. These fields vary by certificate. An OU is descriptive information, not independent proof of a professional designation.
Issuer: The certificate authority that issued the certificate and attested to its connection with the subject.
Validity dates: The period during which the certificate was issued for use. An expiry date does not, by itself, tell you whether a signature made earlier was valid.
Serial number: A unique identifier assigned by the issuer. It helps distinguish this certificate from others the same authority has issued.
Public key and algorithms: Technical details the PDF viewer uses to check the signature. You may see both information about the public key and the algorithm the issuer used to sign the certificate. Most readers can let the validation software assess these details.

How does the certificate earn trust?

The signer’s certificate is often part of a chain of trust. An intermediate certificate connects it to a root certificate that the viewer recognizes as trusted. A readable name or familiar organization in the subject field is useful, but it does not replace validation of that chain.

The viewer may also check whether a certificate was revoked before it expired—for example, after a signing key was compromised. Two common ways to obtain status information are OCSP, an online status check, and a certificate revocation list (CRL). If that information is unavailable, the viewer may be unable to reach a complete validation result.

A trusted timestamp can provide evidence of when the signature existed. For documents that must remain verifiable for years, long-term validation can preserve the certificates, revocation information and timestamps needed to assess the signature later—even after the signer’s certificate has expired.

The useful habit is simple: open the original PDF and inspect its signature panel. Look at the subject and issuer, then read the viewer’s results for document changes, certificate trust and revocation status. The certificate supplies the evidence; the validation result helps you understand what that evidence supports.

How PDF Became an Open Standard

Author — Tue, 13 Oct 2026 18:34:30 GMT

PDF began as an Adobe format in the early 1990s. Its purpose was straightforward: a document created on one computer should look the same when opened or printed on another. That made it useful for exchanging finished reports, drawings and other records without asking every recipient to use the software that created them.

As PDF became widely used, its technical specification moved into international standardization. In 2008, PDF 1.7 became ISO 32000-1. The current PDF 2.0 specification is ISO 32000-2:2020. These standards describe how a PDF is structured and interpreted so that different software developers can build tools around a common format.

The value is practical: a firm can create a document in one application, send it to a client using another, and retain it without tying access to the original authoring software. That does not mean every PDF application has identical features, but the document format itself is governed by a published standard.

PDF/A shows why this matters over time. Defined separately in ISO 19005, PDF/A sets additional requirements for preserving a document’s appearance. For example, it requires fonts to be embedded, reducing the chance that a future reader will see substituted typefaces because the originals are no longer installed. PDF/A-1b focuses on visual preservation; PDF/A-1a also includes requirements for the document’s logical structure.

A proprietary application may remain valuable for creating a document. For an issued record that people must open years later, an open, standardized format gives organizations more choice in the software they use to read and preserve it. That is one reason PDF became a foundation for professional document exchange—and why its standards continue to matter after a document is signed.

A Digital Seal Should Carry the Same Trust as a Physical One

Author — Tue, 13 Oct 2026 18:34:17 GMT

Professional associations have spent decades protecting the use of seals and signatures. A member cannot hand their physical seal to a colleague and ask them to authenticate work on their behalf. A photocopy of a sealed page would not, by itself, establish that the recipient holds the original.

An association does not need to operate a certificate authority to bring those principles into the digital world. It can set the requirements for professional eligibility, control and verification, then select a provider capable of meeting them.

An image of a seal and handwritten signature can make a PDF look authentic, but the images alone cannot show who applied them or whether the file changed afterward. If an association is considering a digital signing service for members, preserving the meaning of its seal is a better starting point than reproducing its appearance.

What should the service demonstrate?

Requirements already used by professional associations offer a practical model:

Professional eligibility: Only authorized members can obtain and use a credential associated with the association’s designation or seal.
Association oversight: The association can suspend or withdraw that authorization when a member’s status changes.
Individual control: The credential remains under the professional’s control, with safeguards against use by someone else.
Verifiable documents: Recipients can check who signed and whether the signed content changed.
Established technology: The provider uses public-key infrastructure and standards-based certificates, such as X.509.
Practical fit: Members can use the service with their document software, and recipients can see the relevant seal, signature and date.
Dependable service: The provider has the experience, support and resources to maintain the program over time.

The association defines who is authorized, how status changes are handled and what assurance a recipient should receive. The provider supplies the technology and service to put those decisions into practice.

Moving from paper to PDF should not reduce confidence in a professional seal. Done well, it gives the recipient something paper could not: a way to verify the signer and the integrity of the digital original.

A Digital Seal Should Carry the Same Trust as a Physical One

Author — Tue, 13 Oct 2026 18:34:06 GMT

Video Embed Here...