How to add a trusted timestamp to a PDF signature

A trusted timestamp is added in PDF by Zaweba by first setting up a timestamp server in the app, then signing with timestamping on. You can also add long-term validation information, so the signature can still be checked years from now. Together these give PAdES B-LT signatures and, with a document timestamp, B-LTA. The app is free and works on Windows.

A timestamp proves when a document was signed, using a clock you don't control, which is what makes it trusted.

Why a timestamp matters

A digital signature records a time, but that time comes from the signer's own computer, which could be set to anything. A trusted timestamp comes from a timestamp server, an outside service that seals a record of the moment it saw your signature. Anyone checking later can rely on that time.

That matters for contracts, tenders, submissions with a deadline, and anything where proving the order of events counts. It also helps after a certificate expires: if the timestamp shows the signature was made while the certificate was valid, the signature can still be accepted.

Setting up a timestamp server

Timestamp servers are run by certificate providers and other organisations, and many people use the one recommended by whoever issued their digital ID. Add its address to the app's timestamp server setting. Signing with a timestamp needs an internet connection at that moment so the server can answer; everything else in the app works offline.

Signing with a timestamp

Open the finished document, choose the Sign menu, and sign as usual with your .pfx or .p12 file, a certificate in the Windows store, or a self-signed ID. With a timestamp server set up, the signature is sent to it and comes back stamped with the time.

Then check it in View, Signatures panel, which shows each signature's status, the signed version and the certificate.

Long-term validation

Years later, the services that confirm a certificate was good may have moved or closed. Long-term validation solves that by storing what's needed inside the document: the certificates, OCSP answers and CRLs. With those in the file, the signature can be checked offline, from the document alone. That level is called B-LT.

Adding a document timestamp over the whole thing, after the validation information, gives B-LTA. The extra timestamp protects the stored information itself, and can be renewed later, so the evidence stays sound as older methods weaken.

Which level do you need?

For everyday signing, a plain signature is usually enough. Add a timestamp when the time of signing matters. Add long-term validation, B-LT, for anything you'll need to prove after the certificate expires, such as contracts and records kept for years. Use B-LTA for archives where the document must stay checkable for a very long time.

Before you rely on a timestamp, open View, Signatures panel and look at the result. It shows the status of each signature, the signed version and the certificate, and lists any changes made afterwards. If revocation checking is switched on online, the app can also ask whether the certificate is still good; otherwise it checks offline from what the document carries, which is exactly where long-term validation earns its keep.

PDF by Zaweba keeps your digital ID on your own PC and adds signatures as incremental updates, so earlier signatures in the same document stay valid.