# Digital ID (PKI Certificates)

> Configure the PKI certificate WPsigner uses to cryptographically seal completed PDFs and help recipients detect later changes.

edition: both
Edition: Lite + Pro
AI note: This page applies to Lite and Pro. Call out Lite limits (PDF only, max 2 signers, email OTP, local timestamp) when they apply. Do not invent Pro-only features.
HTML: https://docs.wpsigner.com/digital-identity/digital-id/
Markdown: https://docs.wpsigner.com/md/digital-identity/digital-id.md
Source file: digital-identity/digital-id.md

---

A Digital ID (also called a digital certificate or PKI certificate) lets WPsigner cryptographically seal a completed PDF. This page explains what certificates do, their trust limitations, and how to configure them.

## What is a Digital ID?

A Digital ID is a cryptographic certificate that:

1. **Verifies your identity** - Proves who signed the document
2. **Seals the document** - Creates a tamper-evident container
3. **Establishes trust** - Third-party validation of authenticity
4. **Enables long-term validity** - Signatures remain valid for years

Think of it as a digital passport or notary stamp for your electronic documents.

---

## Why Digital IDs Matter

### The Problem Without Digital IDs

Without a Digital ID, your signed PDF is essentially just an image of a signature placed on a document. Anyone could:

- Modify the document after signing
- Claim the signature was forged
- Dispute when the document was signed
- Question who actually signed

### The Solution With Digital IDs

A Digital ID provides cryptographic proof:

| Without Digital ID | With Digital ID |
|-------------------|-----------------|
| Signature is just an image | Signature is cryptographically bound |
| Document can be modified | Any modification breaks the seal |
| No identity verification | Identity verified by certificate |
| Less independent integrity evidence | Stronger technical evidence |
| Fewer compliance controls | Can support a broader compliance program |

---

## Legal Importance

### Regulatory Compliance

Digital IDs enable compliance with major e-signature regulations:

| Regulation | Region | Digital ID Role |
|------------|--------|-----------------|
| **ESIGN Act** | USA | Provides intent attribution |
| **UETA** | USA (all states) | Establishes signer identity |
| **eIDAS** | European Union | Required for Advanced/Qualified signatures |
| **ZertES** | Switzerland | Required for qualified signatures |
| **IT Act** | India | Required for legally valid signatures |

### Court Admissibility

In a dispute, a valid certificate signature can provide evidence that:

- **Certificate identity** - Identifies the certificate that sealed the PDF
- **Tamper evidence** - Later PDF changes can invalidate the signature
- **Integrity** - Connects the signed byte range to the certificate's private key
- **Time evidence** - A trusted timestamp can establish independent time evidence

It does not by itself prove the human signer's identity or make a document automatically admissible or enforceable.

### Industry Requirements

Certain industries require digital certificates:

| Industry | Requirement | Reason |
|----------|-------------|--------|
| **Healthcare** | HIPAA compliance | PHI protection |
| **Finance** | SOX, PCI-DSS | Financial records integrity |
| **Government** | NIST, FedRAMP | Security standards |
| **Legal** | Bar association rules | Document authenticity |
| **Pharma** | FDA 21 CFR Part 11 | Regulatory submissions |

---

## Types of Digital Certificates

### Self-Signed Certificates

Created by you, for internal use.

**Best For:**
- Internal company documents
- Testing and development
- Non-legal agreements
- Team acknowledgments

**Pros:**
- Free to create
- Instant availability
- Full control

**Cons:**
- Not trusted by default in Adobe Reader
- Recipients see "Unknown Signer" warning
- Less credible for external parties

### Commercially Issued Certificates

Purchased from a trusted Certificate Authority (CA).

**Best For:**
- Client-facing contracts
- Legal agreements
- Regulatory filings
- Any document requiring third-party validation

**Pros:**
- Automatically trusted in Adobe Reader
- CA verifies your identity
- Stronger third-party trust signal
- Green checkmark in Adobe

**Cons:**
- Annual cost ($200-$500/year)
- Identity verification process
- Renewal required

### Certificate Authority Comparison

| Certificate Authority | Price Range | Verification Level |
|----------------------|-------------|-------------------|
| **DigiCert** | $300-500/yr | Organization validated |
| **Sectigo (Comodo)** | $150-300/yr | Organization validated |
| **GlobalSign** | $250-400/yr | Organization validated |
| **SSL.com** | $150-250/yr | Individual/Organization |
| **Entrust** | $300-500/yr | Enterprise grade |

> **tip**
For most businesses, **DigiCert** or **GlobalSign** offer the best balance of trust and support. Their certificates are on Adobe's Approved Trust List (AATL).

---

## How Digital Signing Works

### The Signing Process

When WPsigner finalizes a document with your Digital ID:

```
1. Document Hash Created
   └─ SHA-256 hash of entire PDF content
   
2. Hash Encrypted
   └─ Your private key encrypts the hash
   
3. Signature Embedded
   └─ Encrypted hash + your certificate added to PDF
   
4. Timestamp Applied
   └─ TSA server certifies the signing time
   
5. Sealed PDF Created
   └─ Final document with digital signature
```

### Verification Process

When someone opens the signed PDF in Adobe Reader:

```
1. Extract Signature
   └─ Adobe reads the embedded signature
   
2. Verify Certificate
   └─ Checks if CA is trusted (AATL)
   
3. Validate Hash
   └─ Recalculates hash and compares
   
4. Check Timestamp
   └─ Verifies signing time
   
5. Display Status
   └─ ✅ Valid or ❌ Invalid
```

---

## Configuring Your Digital ID

### Accessing Digital ID Settings

1. Go to **WPsigner → More → Digital ID**
2. Use **WPsigner → More → Security & Compliance** to configure the related signature security policies and timestamp provider

### Option 1: Generate Self-Signed Certificate

For testing or internal use:

1. Click **Generate Self-Signed Certificate**
2. Fill in the certificate details:

| Field | Description | Example |
|-------|-------------|---------|
| **Common Name** | Your name or company | Acme Corporation |
| **Organization** | Company name | Acme Corp |
| **Department** | Optional department | Legal Department |
| **City** | Your city | San Francisco |
| **State/Province** | Your state | California |
| **Country** | Two-letter code | US |
| **Email** | Contact email | legal@acme.com |
| **Valid Years** | Certificate lifetime | 3 years |

3. Click **Generate Certificate**
4. Certificate is created and activated immediately

### Option 2: Upload Commercial Certificate

For production use with purchased certificate:

1. Obtain a .p12 or .pfx file from your CA
2. Click **Upload Certificate**
3. Select your .p12/.pfx file
4. Enter the certificate password
5. Click **Upload and Activate**

### Certificate File Formats

| Format | Extension | Description |
|--------|-----------|-------------|
| **PKCS#12** | .p12, .pfx | Contains private key + certificate |
| **PEM** | .pem, .crt | Certificate only (convert to .p12) |
| **DER** | .der, .cer | Binary format (convert to .p12) |

WPsigner accepts **.p12** and **.pfx** files directly.

---

## Adobe Trust List (AATL)

### What is AATL?

The Adobe Approved Trust List is a list of Certificate Authorities that Adobe automatically trusts. When you sign with an AATL certificate:

- Adobe Reader shows a **green checkmark** ✅
- Recipients see "Signature is VALID"
- No manual trust configuration needed
- Maximum legal credibility

### AATL Members Include:

- DigiCert
- GlobalSign
- Sectigo
- Entrust
- IdenTrust
- DocuSign (certificate program)
- SwissSign

### Non-AATL Certificates

Self-signed certificates show:

- Yellow warning triangle ⚠️
- "Signature validity is UNKNOWN"
- Recipient must manually trust your certificate

The cryptographic signature can still be verified, but recipients must establish trust manually. Legal effect depends on the complete transaction and applicable law.

---

## Certificate Best Practices

### Security

| Practice | Why |
|----------|-----|
| **Strong password** | Protect your private key |
| **Secure storage** | Store .p12 file safely |
| **Limited access** | Only authorized staff should access |
| **Backup** | Keep secure backup of certificate |
| **Regular rotation** | Replace before expiration |

### Organizational

| Practice | Why |
|----------|-----|
| **Centralized management** | One certificate for all documents |
| **Document policy** | Define which docs need signing |
| **Training** | Educate staff on certificate importance |
| **Audit logging** | Track certificate usage |

### Renewal Planning

Certificates expire. Plan ahead:

1. **Set calendar reminder** - 60 days before expiration
2. **Budget annually** - Include in IT budget
3. **Test new certificate** - Verify before old expires
4. **Update WPsigner** - Upload new certificate

---

## Troubleshooting

### "Certificate password incorrect"

- Verify the password provided by your CA
- Passwords are case-sensitive
- No spaces before/after password

### "Certificate format not supported"

- Convert to .p12 format using OpenSSL:
```bash
openssl pkcs12 -export -out certificate.p12 -inkey private.key -in certificate.crt
```

### "Certificate has expired"

- Purchase a renewal from your CA
- Generate a new self-signed certificate
- Upload the new certificate to WPsigner

### Adobe shows "Signature validity unknown"

For self-signed certificates, recipients must:
1. Click on the signature
2. Click "Validate Signature"
3. Choose "Trust this certificate"

---

## Certificate vs No Certificate

### Documents Signed Without Digital ID

```
┌─────────────────────────────────┐
│ Signed PDF                      │
│ ┌─────────────────────────────┐ │
│ │ [Signature Image]           │ │
│ │  - Just a PNG image         │ │
│ │  - No cryptographic seal    │ │
│ │  - Can be modified          │ │
│ └─────────────────────────────┘ │
│ ⚠️ No verification available    │
└─────────────────────────────────┘
```

### Documents Signed With Digital ID

```
┌─────────────────────────────────┐
│ Digitally Signed PDF           │
│ ┌─────────────────────────────┐ │
│ │ [Signature + Certificate]   │ │
│ │ ┌───────────────────────┐   │ │
│ │ │ SHA-256 Hash          │   │ │
│ │ │ Private Key Signature │   │ │
│ │ │ X.509 Certificate     │   │ │
│ │ │ RFC 3161 Timestamp    │   │ │
│ │ └───────────────────────┘   │ │
│ └─────────────────────────────┘ │
│ ✅ Signature valid. Document    │
│    has not been modified.       │
└─────────────────────────────────┘
```

---

## Frequently Asked Questions

### Do I need a Digital ID for legal signatures?

For basic contracts in the US under ESIGN/UETA, a signature without Digital ID can be legally valid. However, a Digital ID provides much stronger legal protection and is recommended for:
- High-value contracts
- Regulated industries
- International agreements
- Long-term records

### Can I use one certificate for multiple documents?

Yes. Your certificate is reused for all documents you sign. There's no per-document cost or limit.

### What happens if my certificate expires?

- Previously signed documents remain valid (signature was valid at signing time)
- New documents cannot be signed until you upload a new certificate
- Consider timestamping to extend long-term validity

### Is a self-signed certificate legally valid?

A self-signed certificate can provide integrity evidence, but it does not provide third-party identity validation. Whether the overall electronic signature is legally effective depends on the transaction, signer evidence, consent, retention, and applicable law.

---

## Next Steps

- [Audit Trails](/digital-identity/audit-trails/) - Understand the legal record
- [Timestamping (TSA)](/digital-identity/timestamping/) - Prove when documents were signed
- [Compliance](/compliance/) - Regulatory requirements