Digital Signatures in PDF: Basics for Small Business

A certificate signature in a PDF detects changes after signing. A pasted picture of a signature does not. Merge PDF and Compress PDF both rewrite the file, so run them before anyone signs. After the signature, treat the PDF as final.

A vendor can return a "signed" contract that is a JPEG of a signature pasted into Word and exported to PDF. No certificate. No tamper seal. For a $2,000 deal, counsel may say that is enough. Accounting may still want proof that nothing changed after the CFO approved it.

Small businesses use these files every day, often without knowing which kind of signature they have. The label "digital signature" covers more than one thing.

Three levels of signing

| Type | What it is | Tamper evidence | | --- | --- | --- | | Wet ink scan | A photo or scan of a signature on paper | None in the file | | Electronic signature (e-sign) | A click, a typed name, or a drawing in DocuSign or HelloSign | An audit trail, depending on the platform | | Digital signature (certificate) | PKCS#7 or PAdES cryptography in the PDF | Validation of a cryptographic hash |

Everyday speech calls all three a digital signature. Lawyers and IT do not mean the same thing. Ask counsel which one a regulated contract requires.

How a certificate signature works

1. The signer holds a private key, often in an HSM, on a smart card, or in a cloud HSM
2. The software hashes the PDF at sign time
3. That hash is encrypted with the private key and stored in the PDF
4. A reader checks it with the public certificate, chained to a trusted CA
5. Change any byte after signing and the signature is invalid

Acrobat shows a validity panel with the signer name, the time, and whether the file was modified.

Which kind a small business usually needs

E-sign platforms are enough for:

• NDAs and service agreements under a local e-sign act
• Sales quotes and order confirmations
• HR onboarding in an industry that is not regulated for this

Certificate signatures matter more for:

• A government filing that specifies PAdES
• An EU qualified signature on some cross-border deals
• Long-term archival that requires long-term validation (LTV)
• An internal policy that mandates PKI

Ask a lawyer about your jurisdiction. This article is about the workflow. It is not legal advice.

Before, during, and after signing

Before signing

• Finish the content. Do not run Merge PDF after the signature
• Flatten a fillable form if the values must stay fixed. See Fillable vs Flat PDF
• Embed fonts. See Embedding Fonts Word to PDF

Signing

• Use an e-sign vendor with an audit trail
• Or use Adobe Acrobat certificate signing when the workflow is PKI
• For a tablet stylus, see Signing PDFs With Tablet Stylus

After signing

• Store the signed copy so it will not be edited. Rename it with the date and the counterparty
• Send every party a read-only flat PDF
• Do not run Compress PDF hard if LTV embeddings matter. Validate again after any compress

Mistakes

• Sign, then edit. The signature becomes invalid
• Use a screenshot of a signature. There is no integrity check
• Get the signer order wrong on a multi-party flow, and end up with conflicting versions
• Email an unsigned draft as if it were final. Put a "DRAFT" watermark on proofs. See Client Proof Watermarks

Nearby security topics

• Fake sign-in links: Phishing PDF Attachments
• A draft author left in metadata: PDF Metadata
• A password is not a signature: PDF Password Protection

Offline and online tools

Offline vs Online PDF Tools contrasts a certificate on a local smart card with a browser upload to a signing service. Match the tool to how sensitive the file is.

GDPR and Browser Processing applies when the contract contains EU personal data and the sign step runs in the browser.

What to keep after signing

Keep the signed PDF, the certificate of completion from the e-sign vendor, the audit log export, the original unsigned version, and the email thread that authorized the signers. Retention depends on the industry. Seven years is common for contracts. Regulated sectors often want immutable storage (WORM).

Revocation and expiry

A certificate signature can include a timestamp from a timestamp authority. The clock matters. If the signer's certificate is revoked after signing, validation may warn, depending on whether LTV data was embedded. An enterprise PKI team manages revocation lists. A small business on a SaaS e-sign tool leaves that to the vendor.

Cross-border deals

EU eIDAS qualified signatures, the US ESIGN Act, and UK law after Brexit do not line up. Legal picks a tool that covers the jurisdictions on the deal. A DocuSign click is not a qualified signature in every country.

Limits

Merging or a hard compress after signing invalidates a certificate signature unless the save preserves the signature dictionary. A typed name can still be a valid e-sign under local law, and it will not show a later edit the way a certificate hash does. This is operational guidance. Counsel decides what your contracts require. Test a sample file, and keep the unsigned original.

E-sign with an audit trail covers most small-business contracts. A certificate signature adds cryptographic tamper evidence when a regulation or a policy asks for it. Sign last, store a copy you will not edit, and know which of the two your tool actually applies before someone asks for proof.