Timestamps and long-term validation for PDF signatures

A digital signature is checked against a certificate, and certificates don't last for ever. They expire, and sometimes they are withdrawn. A contract signed today may need checking in ten years, long after the signer's certificate has run out. Timestamps and long-term validation are how a signature stays checkable that long, and PDF by Zaweba can add both.

Timestamps

A plain signature records the time from the signer's own PC clock, which nobody else can vouch for. A timestamp comes from a timestamp server, an independent service that confirms the document existed in that exact form at that moment. In PDF by Zaweba you add a timestamp from a timestamp server you set up.

That matters for two reasons. It proves when something was signed, which can be important for deadlines and agreements. And it shows the signature was made while the certificate was still valid, so a certificate expiring later doesn't cast doubt on a signature made earlier.

Adding a timestamp is the one step here that needs the internet, since the time comes from the server. Everything else in the app keeps working offline.

Long-term validation

To check a signature, a reader needs to know the certificate was good at the time. Normally that means asking online: is this certificate on a list of withdrawn ones? Years later, those answers may be hard or impossible to get.

Long-term validation solves this by keeping the evidence inside the document. PDF by Zaweba adds the certificates, OCSP answers and CRLs to the file. OCSP answers are replies from a certificate authority saying a certificate was in good standing. CRLs are the lists of withdrawn certificates. With them stored in the PDF, a signature can be checked offline, by anyone, long after the services that gave the answers have changed or gone.

B-LT and B-LTA

These are the names of levels in the PAdES standard. Adding long-term validation information gives B-LT, which means the signature carries what it needs to be checked in the long term. Adding a document timestamp as well gives B-LTA. The document timestamp covers the validation information too, fixing the whole package at a known moment.

For most everyday documents a plain signature is fine. For contracts, deeds, records you must keep for years, and anything that may end up in a dispute, B-LT or B-LTA is worth the extra minute.

A practical order

Sign the document as usual. Add a timestamp. Add long-term validation information. If you want B-LTA, add a document timestamp last. Save, then check the result in the signatures panel, where each signature shows as valid, unknown or invalid.

Because each of these is added as an incremental update, earlier signatures stay valid throughout.

Timing matters

Set up your timestamp server before you need it, not on the day a contract has to go out. Validation information must be added while the answers can still be fetched, so do it soon after signing rather than years later. And keep the original signed file, since any further editing after signing shows in the panel as a change.

These are the less visible parts of signing, but they're what makes a signature from PDF by Zaweba stand up long after the day it was made.