Certified PDF Signatures: How Certifying Differs From Signing

What is a certified signature in a PDF?

A certified signature, also called a certification or author signature, is the first signature applied to a PDF, and the one that sets the rules for everything that follows. Adobe's Digital Signatures in a PDF puts the rule plainly: "There can be only one certification signature and it must be the first one in a document." An approval signature carries no such rules. It records that a person signed the file at that point, and there can be any number of them.

Both kinds use the same certificate and the same cryptography: each signature covers the whole file as it stood when it was signed, and later changes are appended to the end of the file without touching the earlier bytes. What makes a signature a certification is one extra entry. In the file we certified for this article, pyHanko showed it as a DocMDP transform with the value /P 2, the level the author chose. A PDF reader compares every later revision of the file against that level.

Use certification when you are the party that produces the document, such as the company that issues a contract, a quotation or a form, and you want everyone downstream to be able to see that nothing beyond the expected filling and countersigning happened to it. For recipients' PDF readers to recognise you as the author, the certificate has to come from a provider they trust, such as the Certum document signing certificate on the Adobe trust list that My-SSL sells. If you are signing a document someone else wrote, you add an approval signature; the steps for that are in our guide on how to digitally sign a PDF.

Which changes does each certification level allow?

A certification allows one of three sets of later changes, chosen by the author when certifying. Level 1 allows none. Level 2 allows filling in form fields and signing. Level 3 adds comments. Changing the page content is not allowed at any level. Adobe's document gives the labels in the table below; inside the file the level is stored as a number from 1 to 3 (our level-2 test file carried /P 2). Adobe also states that "permission violations result in an invalid signature."

Level 2 is the one most issued documents need. It lets a customer type into the fields you left for them and lets each party sign, while anything that alters the text you wrote breaks the certification. Level 1 suits a document that is finished the moment you certify it, because even a countersignature is a change.

Does certifying make the PDF trusted?

Certifying makes a PDF tamper-evident, but whether recipients see the certification as trusted depends on the certificate behind it. Two separate checks happen when a reader opens the file: is the signature intact and within its permissions, and does the signing certificate chain to a root the reader trusts. Our test shows the split. The same certified file passed both checks when the validator trusted our test root, and returned intact=True trusted=False when it did not.

In Adobe Acrobat and Reader, the usual way to pass the second check for strangers is a certificate from a provider on the Adobe Approved Trust List (AATL). Adobe says signatures made with AATL certificates "are trusted whenever the signed document is opened in Acrobat or Acrobat Reader"; Acrobat gets the list through its AATL update setting and may ask once before installing it. As of October 18, 2026, Adobe's list includes Asseco Data Systems, the company behind Certum, under Poland. The AATL document signing certificate My-SSL sells is Certum's, so recipients using Acrobat or Reader with AATL updates enabled don't have to import a certificate themselves to validate a document you certify with it. A self-signed certificate certifies just as well technically, but each recipient sees an unknown signer; our guide to the "signature validity is unknown" message explains what they would have to do instead.

What happened when we changed certified PDFs?

We certified a one-page PDF at each level and then made the kinds of changes recipients make, to see which ones a validator accepts. The file had a text field called "Amount" and an empty signature field for an approver, both created before certification. We used pyHanko 0.38.0 (with pyhanko-certvalidator 0.33.0) on Python 3.13.16, two test certificates from a throwaway root made with OpenSSL 3.0.13, on October 18, 2026. The output, one block per case:

--- certified P=2, untouched
  Author    certify=True  intact=True trusted=True modification_level=NONE docmdp_ok=True bottom_line=True
--- certified P=2, then form field filled
  Author    certify=True  intact=True trusted=True modification_level=FORM_FILLING docmdp_ok=True bottom_line=True
--- certified P=2, then approver signs the empty field the author left
  Author    certify=True  intact=True trusted=True modification_level=FORM_FILLING docmdp_ok=True bottom_line=True
  Approver  certify=False intact=True trusted=True modification_level=NONE docmdp_ok=True bottom_line=True
--- certified P=2, then approver adds a new visible signature field and signs it
  Author    certify=True  intact=True trusted=True modification_level=OTHER docmdp_ok=False bottom_line=False
  Approver2 certify=False intact=True trusted=True modification_level=NONE docmdp_ok=True bottom_line=True
--- certified P=2, then approver adds a new invisible signature field and signs it
  Author    certify=True  intact=True trusted=True modification_level=FORM_FILLING docmdp_ok=True bottom_line=True
  Approver3 certify=False intact=True trusted=True modification_level=NONE docmdp_ok=True bottom_line=True
--- certified P=1, then form field filled
  Author    certify=True  intact=True trusted=True modification_level=FORM_FILLING docmdp_ok=False bottom_line=False
--- certified P=1, then approval signature: SigningError Author signature forbids all changes
--- certified P=2, then page text changed
  Author    certify=True  intact=True trusted=True modification_level=OTHER docmdp_ok=False bottom_line=False
--- approval only, then page text changed
  Approver  certify=False intact=True trusted=True modification_level=OTHER docmdp_ok=False bottom_line=False
--- certify after approval: SigningError Certification signatures must be the first signature in a given document.

Two results matter in practice. First, intact=True on every failed row: the cryptographic signature itself was never broken, because later changes are appended. What failed was the permission check, which is exactly the job certification adds. Second, at level 2 the approver could sign the empty field the author had prepared, and could also add a new invisible signature field and sign it. A new visible signature field was rejected, but that comes from pyHanko's default policy, which pyHanko's own code describes as "stricter than Acrobat". We did not run these cases in Acrobat. Placing a signature field for every expected signer before you certify avoids the question for any validator, and it shows each signer where to sign.

We did not test comments at level 3. Our hand-built comment did not match what Acrobat writes, so pyHanko's verdict on it would not tell you what Acrobat does, and we left it out.

How do you certify a PDF without breaking it later?

Certify a PDF as the very last step of preparing it and the very first signature on it: finish the text, add the form fields and an empty signature field for each person who will sign, then certify with the level that matches what those people will do. Adobe's help says you "must certify the documents before others sign them", and that if a document has already been signed, the Certify options are disabled.

1. Finish the content. Any edit to the page after certifying breaks it, at every level.
2. Add the fields. Form fields for what recipients fill in, and one empty signature field per signer, named so people can find theirs.
3. Choose the level. Level 2 when others fill in or sign; level 1 when nobody should; level 3 only if reviewers need to comment on the certified version.
4. Certify with a trusted certificate. In Acrobat, certifying is a separate choice from an ordinary certificate signature, and Adobe notes you can certify with or without a visible signature. A certificate from an AATL provider is what lets recipients' Acrobat recognise you.
5. Check the result. Open the certified file and confirm the certification validates and shows the level you meant before you send it.

If you script your documents instead, the pyHanko call we used was the ordinary signing call with two extra settings:

meta = signers.PdfSignatureMetadata(
    field_name="Author",
    certify=True,
    docmdp_permissions=fields.MDPPerm.FILL_FORMS,  # level 2
)
signers.sign_pdf(IncrementalPdfFileWriter(pdf), meta, signer=author)

Should you certify a PDF or just sign it?

Certify a PDF when you authored it and others will complete or countersign it; sign it when you are approving a document that already exists. The table covers the common cases. If none of the certification levels fits because the document will keep changing, a plain approval signature on each finished version is the honest choice.

Whether a court or a counterparty accepts a signature depends on the jurisdiction and the type of certificate, not on whether the signature certifies or approves; our comparison of AATL and qualified electronic signatures covers that side, and the guide to document signing certificates explains what the certificate itself contains.