Understanding PKCS#12 Digital Signature Certificates (DSC) in PDF Workflows
Published by Signallpages Cryptographic Security Team • Technical Whitepaper
How Cryptographic PDF Signing Works
A Digital Signature Certificate (DSC) is an electronic credential based on public-key cryptography (PKI) issued by a licensed Certifying Authority (such as eMudhra, Capricorn, VSign, or DigiCert).
When a document is signed using a PKCS#12 file (.p12 or .pfx):
- SHA-256 Hashing: A unique cryptographic mathematical digest (hash) of the entire PDF file contents is computed.
- Private Key Encryption: The hash is encrypted using the signer's private key, creating the digital signature object.
- Embedding & Byte-Range Locking: The encrypted signature object and public X.509 certificate chain are embedded into the PDF structure under a dedicated signature dictionary.
- Integrity Verification: When opened in any standard PDF reader (like Adobe Acrobat or web viewers), the viewer decrypts the signature with the public certificate and compares hashes. If even one letter or character in the document has been altered, the signature shows as invalid.
Audit Certificates of Completion
Every transaction completed on Signallpages can be accompanied by an automated, legally admissible Audit Certificate of Completion:
- Unique Document UUID: Cryptographically random identifier for global traceability.
- Original & Signed SHA-256 Checksums: Proof that original bytes and output bytes match the immutable execution record.
- Signer Identification: Email address, plan tier, and account credentials of the authorized signatory.
- Timestamping: Precision UTC and local ISO 8601 execution timestamps.
- Network Origin: Signer IP address and browser user-agent string for forensic non-repudiation.