Signatures, encryption and attachments / Certification signature
Certification signatures and DocMDP permissions
The first signature on a document, which certifies the whole thing and declares what, if anything, anyone is allowed to change afterwards.
Where this API stands
This is not something a renderer emits. It is applied to a finished file by a step that comes after rendering, so the honest answer is about where the boundary falls. This API does not create signatures of any kind, so there is no /Perms, no /DocMDP and no certification. The distinction from an ordinary approval signature is worth knowing before you build the pipeline rather than after, because certification has an ordering constraint that approval does not: it has to come first. If your process is render, then apply a password, then certify, the password is an incremental update that lands before the certification and that is fine. If it is render, certify, then password, the password is a modification after certification and the reader will report it.
What the standard requires
The requirements as a checker enforces them, rather than as a procurement document paraphrases them. A file satisfies all of these or it satisfies none of them.
- A /Perms entry in the catalogue with /DocMDP referencing the signature, which is what makes it a certification rather than an approval.
- A /P value in the transform parameters: 1 means no changes at all, 2 allows form filling and signing, 3 additionally allows annotations.
- It must be the first signature applied to the document, and there can be only one.
- A byte range covering the entire file as it stood at certification, with later permitted changes appearing as incremental updates on top.
- The permitted changes are enforced by the reader, not by the file, which is a distinction that matters when the recipient uses something other than Acrobat.
Who asks for this
Anyone issuing a document that others will sign or fill in: a contract sent for counter-signature, a form issued for completion, a certificate that must not be edited. It is the mechanism behind the blue bar saying the document is certified by an organisation, which is the trust signal most recipients actually respond to.
What to do about it
Decide the /P level before choosing a tool, because it is a business decision rather than a technical one: a form that recipients fill in needs /P 2, a certificate that must not change needs /P 1. Then certify with a tool that supports DocMDP properly, which means DSS, pyHanko or a commercial signing service rather than whatever is quickest to script. Certify once, at the point the document becomes final, and let every later signature be an ordinary approval on top.
How to check a file rather than assume
Acrobat shows a certified document with a distinct blue bar and names the certifier, and it will tell you which changes are permitted. `mutool show file.pdf trailer/Root/Perms` shows whether /DocMDP is present at all. The EU DSS validator reports the signature type alongside the qualification.
The mistake people make here
Certifying with /P 1 and then discovering the workflow needs a counter-signature. No changes means no changes, including adding a signature, so the document has to be reissued. Choosing /P 2 by default is not the answer either, because it permits form filling on a document you may have intended to be fixed. Work out what happens to the document next, then pick.
Frequently asked
Does this API produce Certification signature?
A step after rendering. This API does not create signatures of any kind, so there is no /Perms, no /DocMDP and no certification. The distinction from an ordinary approval signature is worth knowing before you build the pipeline rather than after, because certification has an ordering constraint that approval does not: it has to come first. If your process is render, then apply a password, then certify, the password is an incremental update that lands before the certification and that is fine. If it is render, certify, then password, the password is a modification after certification and the reader will report it.
Can I turn on the pdf_a option and be done?
No. The option writes an XMP packet declaring PDF/A-1b into the document catalogue, and the render response comes back carrying a warning that says in as many words that this is best-effort and that full conformance requires tagged structure and an embedded ICC profile. It is a claim written into the file, not a certificate earned by it, and a validator checks the claim against the bytes. Read the warning array in the response rather than taking the absence of an error as a pass.
Should I convert before rendering or after?
After, always. A conformance converter rewrites colour, embeds profiles, sets boxes and stamps metadata on a finished PDF. Trying to satisfy a conformance target from the source side means guessing at what the converter would have done, and the guesses that go wrong are expensive: flattening transparency you did not need to flatten changes what the page looks like.
Standards this one is confused with
The neighbours that matter are the ones people mistake for this, not the ones that sort next to it.
Adding a digital signature field to a PDF
A form field holding a cryptographic signature over the file, which proves who signed it and that nothing has changed since.
PAdES signature levels B-B, B-T, B-LT and B-LTA
The four European profiles for PDF signatures, each adding what the one below it needs to still be verifiable years later.
AcroForm fields and HTML form inputs in a PDF
Interactive form fields inside a PDF, and why an HTML input rendered to PDF is a picture of a field rather than a field.
Password protection and PDF/A conformance
Why a password-protected file can never be PDF/A or PDF/UA, and what the password option here actually gives you.
Embedding a file in a PDF/A-3 hybrid invoice
The mechanism behind hybrid invoices: a machine-readable XML payload carried inside an archivable PDF, so one file serves both the person and the system.
Every standard, with what this API does about it
The full list, grouped by what the requirement is for, each marked with how far this API gets.
What this API actually does
One page per option and endpoint that exists, with nothing that does not.
Conformance is decided after a file exists. Render the document, then check it, then convert only what the checker actually flags.