Digital signature verification in PDF

Many official certificates are downloaded from an e-government site as a signed PDF: the Spanish sexual offences and criminal record certificates, AEAT and Social Security compliance certificates, the work history report… That signature is the best proof that the document hasn't been touched. Constaia verifies it on every PDF you analyse, at no extra cost and without sending the file to any third party.

What it checksCopy Anchor Link

1. That there is a signature. It finds the PDF's electronic signatures (PAdES / CMS) and its revisions.
2. Integrity. It recomputes the digest of the signed bytes and compares it with the one inside the signature. If they don't match, the content changed and the signature is broken. Then it verifies the cryptographic signature (RSA, RSA-PSS, ECDSA or Ed25519, with SHA-1 to SHA-512).
3. Signer and time. It reads the signer's certificate (name, organisation, issuer, validity) and the signing time: the timestamp's if there is one, otherwise the one declared in the signature. It checks the certificate was valid at that moment.
4. Chain of trust. It builds the chain from the signer's certificate to a root authority, verifying every link, and checks that it reaches one on the trust list.
5. Later changes. If the PDF has revisions added after signing, it looks at what they add: another signature, long-term validation data (LTV) or a timestamp don't count; anything else is document_modified_after_signing.

The PDF metadata is also checked for signs of editing: a known producer (iLovePDF, Smallpdf, Sejda, PDF24, Acrobat, Word, LibreOffice, Canva, Photoshop…), a modification date much later than the creation date, or a signature "inherited" from a PDF that was rewritten. If there are signs, you get the edited_suspected warning in warnings and as a reason with warning.

The signature objectCopy Anchor Link

Only present for PDFs (null for images):

{
  "status": "valid",
  "reasons": ["signature_valid"],
  "signer": "SELLO ELECTRONICO DEL MINISTERIO DE JUSTICIA",
  "issuer": "AC Sector Público",
  "signed_at": "2026-09-28T09:14:03Z",
  "trusted": true,
  "trust_anchor": "AC RAIZ FNMT-RCM",
  "signatures": 1
}

Statuses and reasonsCopy Anchor Link

Reasons go in verdict.reasons, so they only appear if you send expect. The signature object is always returned.

Requiring a valid signature: require_valid_signatureCopy Anchor Link

curl https://api.constaia.com/v1/analyze \
  -H "Authorization: Bearer $CONSTAIA_API_KEY" \
  -F file=@sexual_offences_certificate.pdf \
  -F 'options={
    "expect": "es_sexual_offences_certificate",
    "checks": { "require_valid_signature": true, "max_age_days": 90 },
    "language": "en"
  }'

With require_valid_signature: true, anything other than signature_valid leads to invalid. A photo, a scan or a "print to PDF" can never pass: they lose the signature, and the reason is signature_missing with error. Use it when you only accept the original PDF downloaded from the e-government site; if you accept photos, leave it off and review the review cases.

Types that are downloaded signed have signed_pdf: true in the catalogue: es_sexual_offences_certificate, es_criminal_record_certificate, es_work_history, es_aeat_tax_compliance_certificate, es_social_security_compliance_certificate, es_aeat_census_certificate, es_aeat_tax_id_card, es_aeat_income_certificate, es_social_security_number_document and mx_rfc_certificate. On any other PDF the signature is verified too and shown in signature.

Trust listCopy Anchor Link

The trust list starts from the Spanish qualified root authorities: AC RAIZ FNMT-RCM, ACCV (ACCVRAIZ1), Firmaprofesional and ANF. Most Spanish public administration certificates chain to them. To complete the chain, Constaia uses the certificates carried in the PDF itself and the intermediate authorities it has configured.

A PDF signed by a provider from another country, or whose chain can't be completed, is untrusted (untrusted_signer) even if the signature is intact. If you need to accept signatures from other providers, write to hola@constaia.com.

What it doesn't check yetCopy Anchor Link

• No European trusted list (TSL). Only the authorities on Constaia's trust list count as trusted.
• Heuristic change analysis. Revisions added after the signature are inspected, but the PDF's modification permissions (DocMDP) are not fully evaluated.
• No CSV lookup. The secure verification code is validated for format only (csv_format); Constaia doesn't look it up on the issuer's site.
• Original file only. A scan, a photo or a regenerated PDF loses the signature. edited_suspected is a signal to review, not proof of fraud.

In test modeCopy Anchor Link

The signature and metadata are not simulated: they are analysed on the file you send, also with ck_test_ keys. An unsigned PDF of a type with signed_pdf: true gives signature_missing and review. See Test mode.

Next stepsCopy Anchor Link