PDF Certification Signature: DocMDP and Permissions

What is a PDF certification signature?

A PDF certification signature is a digital signature that establishes a certified document version and specifies permitted later changes. It uses PDF modification-detection rules commonly described through DocMDP. It is different from an approval signature added simply to sign a document.

Certification versus approval

The certifying signature is the first signature in the PDF. An approval signature can be added later when the certification permissions allow it.

“Certify” here is a technical PDF function. It does not mean the document is notarized, its facts are true or the signature is automatically qualified under eIDAS. A completion report is another distinct artifact.

What can DocMDP permit?

Depending on the selected permission level, the document may allow no changes, form filling and additional signatures, or a broader permitted set including annotations. Check the actual document rather than assume all certified PDFs have the same restrictions.

ETSI’s PAdES standard describes DocMDP permissions and their relationship to later signatures. A change outside the allowed set can affect validation even where the page looks familiar.

Do later signatures always invalidate certification?

No. Permitted incremental updates can preserve earlier signed data. This is why a later authorized signature is different from rewriting the agreement’s content.

Assess signature validation using the certificate, permitted changes and actual signed versions. A whole-file hash may change after an allowed update, so it is not a substitute for checking the PDF’s signature and modification rules.