Skip to content

How Signing Works

Jump to bottom
Liviu Stoica edited this page May 20, 2026 · 1 revision

How Signing Works

XignAll uses pyhanko to apply digital signatures to PDF files. All signing happens locally — no document data is sent to any external server.

Signature format: PAdES

XignAll produces PAdES (PDF Advanced Electronic Signatures) — the standard defined in ETSI EN 319 132, mandatory under the eIDAS regulation (EU 910/2014).

PAdES signatures are:

  • Embedded directly in the PDF file structure
  • Accepted by courts, notary offices, public institutions, and government agencies across all EU member states
  • Verifiable by Adobe Acrobat Reader, Foxit, and any eIDAS-compliant validator
  • Compatible with QES (Qualified Electronic Signature) when using a qualified certificate issued by a trust service provider listed in an EU Trusted List

Incremental update — preserving existing signatures

When XignAll signs a PDF that already contains signatures from other signers, it uses an incremental update: the new signature is appended to the end of the PDF without modifying the existing content. This means:

  • All previous signatures remain valid
  • Each signer's signature covers exactly the content that existed at the time they signed
  • The document history is preserved and auditable

This is the correct approach for multi-signer workflows and is required by the PAdES standard.

Certificate types

PKCS#12 (software certificate)

A .p12 or .pfx file containing a private key and certificate chain, protected by a password/PIN.

  • PIN entered once per XignAll session
  • PIN is never stored on disk
  • Certificate details (subject, issuer, validity, qualified status) shown before signing
  • Suitable for: individual signers, accounting firms, organizations without hardware tokens

PKCS#11 (hardware USB token)

A hardware cryptographic device (smart card or USB token) where the private key never leaves the hardware.

Compatible devices:

  • SafeNet/Thales eToken (5100, 5110, 5300)
  • SafeNet iKey
  • Gemalto/Thales IDPrime
  • Any PKCS#11-compliant device

How XignAll handles PKCS#11:

  • Auto-detects installed token drivers on Windows, macOS, and Linux
  • Identifies the token by serial number — stable across reboots and USB reconnects
  • PIN entered once per session
  • Wrong PIN protection: if an incorrect PIN is detected, XignAll stops signing immediately to prevent token lockout (most hardware tokens lock permanently after 3–10 wrong PINs)

TSA timestamp (optional)

XignAll can embed a trusted timestamp from any RFC 3161-compliant Timestamp Authority (TSA). The timestamp proves the document existed and was signed at a specific point in time, independent of the certificate validity period.

Compatible TSA servers: DigiCert, GlobalSign, Sectigo, and any RFC 3161 server.

Configuration: Sign tab → signer profile → enable TSA → enter TSA URL.

Default URL pre-configured: http://timestamp.digicert.com

Signature appearance

Each signature has a visible rectangular area in the PDF containing:

Field Description
Name Signer's name from the certificate
Reason Configurable text (e.g. "Approved", "Certified")
Location Configurable text (city, department)
Date Signing date and time
Logo PNG or JPG image — supports transparent PNG for stamp overlay

Position is set per signer profile via drag-and-drop on a live PDF preview and reused automatically across the entire batch.

Page range selection

Per signer profile, you can choose which pages receive the signature:

  • All pages
  • Even pages only
  • Odd pages only
  • Custom range: 1,3,5–8 (comma-separated pages and ranges)

Verification

The Verify tab inspects any PAdES-signed PDF and reports:

  • Signer name and certificate details
  • Signing time (and TSA timestamp if present)
  • Whether the document was modified after signing
  • Certificate validity and chain

Clone this wiki locally