The PDF standard allows one certification per file, and it has to come first: “A document can contain only one signature field that contains a DocMDP transform method; it shall be the first signed field in the document.” Its rule is a number, P. With 1, nothing may change: “A value of 1 for P indicates that the document shall be final; that is, any changes shall invalidate the signature.” With 2, “Permitted changes shall be filling in forms, instantiating page templates, and signing; other changes shall invalidate the signature.” With 3, comments are allowed too. Adobe says certifying “is used for official documents, contracts, or any PDF where you need to ensure integrity and control future modifications.”
How does Acrobat show a certified PDF?
With a ribbon icon in the Signature Panel. Adobe’s help says that “a certify ribbon icon in the Signature Panel confirms a valid certifying signature”, and that after certifying “a signature panel with a certified badge appears at the top.” The author picks the rule from the Permitted Actions After Certifying menu, and certifies before anyone else signs: “Certificate signatures can only be applied to PDFs that have no other signatures.”
How do you tell a certified PDF from an ordinary signed one?
Both carry a signature field with a byte range. A certified file adds a Perms entry to its catalog whose DocMDP key points to the certification signature; an ordinary (approval) signature has none. PDF Textfix’s demo signed note, read with qpdf:
$ qpdf --show-object=1 "Demo Signed.pdf"
<< /AcroForm << /Fields [ 4 0 R ] /SigFlags 3 >> /Pages 3 0 R /Type /Catalog >>
One signature field and no /Perms: signed, not certified.
What happens when you edit a certified PDF?
The certification stops verifying, and how it fails depends on how the file is saved. With P set to 1 or 2, PDF Textfix opens the file read-only, and its banner says “This file is certified, and any edit invalidates the certification. Editing stays off until you allow it.” The banner’s Allow Editing… button asks first; for a no-changes file the question reads “The author certified this document and allowed no changes. Any edit invalidates the certification, and viewers will show the document as changed.” With P set to 3, a sheet asks once, when you apply the first edit, and warns that “Editing its text invalidates the certification”.
PDF Textfix writes the whole file again, so the signature stays but no longer matches its bytes. An app that appends an incremental update keeps the signed bytes, so the signature still matches the version it was computed over; the standard still counts a change outside the rule as one that invalidates the certification.
What should you do if a certified PDF needs a correction?
If the document is yours, correct the source and certify it again. If it is someone else’s, ask the author for a corrected, certified copy. How to edit a signed PDF walks through the choices, and Is it legal to edit a PDF? covers whether you may change it at all.
Questions about certified PDFs
Can you fill in or sign a certified PDF?
At levels 2 and 3, yes: filling in form fields and signing are allowed changes. Changing the text of the pages is not.
Can you print a certified PDF?
Yes. Printing does not change the file, so the certification is unaffected. Printing limits come from a permissions password, a separate setting.
Is a certified PDF the same as a certified copy?
No. A certified PDF carries its author’s digital certification. A certified copy is a copy of a paper document that a person vouches for; GOV.UK’s guidance says “You can certify a document as a true copy by getting it signed and dated by a professional person, like a solicitor.”
Related terms
- Digital signature (PDF), the byte range every signature covers.
- Incremental update, how signing apps keep the signed bytes.
- Permissions password, the other way a PDF restricts changes.