What is the difference between "Digitally Sign" and "Certify (Visible Signature)"?

[martinz59337526]

Hi guys,

When I click "Certificates" to sign a PDF file, I saw "Digitally Sign" and "Certify (Visible Signature)" on the toolbar.  Both of them can be used to sign the document. But what exactly the difference between these two functions?

Thanks,

Martin

[Thom Parker]

The answer is very little. Digitally signing, in this case, is certifying. A digital certification creates an encrypted hash of the PDF. Someone with the Public key for the certificate can then verify that the certification is valid and the document hasn't been modified since it was signed. I don't totally understand the nuances between the too, but am under the impression that more than one "Digital Signature" can be applied to a PDF, whereas a PDF can only be "Certified" once.   

[martinz59337526]

Thanks for the explanation. The reason why I feel confused about these two functions is that I've always been thinking when I digitally sign a document with an encrypt digital certificate or a token, I have already "certified" the document. But as you said, from the view of a workflow, these two things can happen one next to the other. Somebody can "sign" the document first and later it can be "certified" by another person?

I have tried on my computer of a PDF document, just to see if the above workflow can be done. However, once it is digitally signed, it cannot be certified anymore. You can add more digital signatures as you wish but it is not possible to certify the document.

Still I am not quite clear about the difference. The only thing I know is if another person open the file that "Digitally signed" or "Certified" by myself, he will see the "Signed by" or "Certified by" in the part of the Signatures on his computer screen. This is the only difference from a viewer. 

[ls_rbls]

Digitally sign a signature field allows any signer to apply their digital signature for a particular portion of the PDF document. Certify with Visible Signature will lock the entire document. Normally it is intended to seal the document with a final approving (or dissapproving action); usually after a review workflow is completed and normally reserved for the creator or author of a document.

See more here:

• https://www.globalsign.com/en/blog/certifying-vs-approval-signatures-in-adobe
• https://helpx.adobe.com/acrobat/kb/certificate-signatures.html
• https://helpx.adobe.com/acrobat/using/certificate-based-signatures.html

[martinz59337526]

I have tried a PDF document on my computer and the result I find is the following:

Once it is Digitally Signed, you can still create more fields for other digital signatures, but you cannot certify it. It seems that the "Certify" can only be done on a clean document without any signature. And, once a clean document is "Certified", you will not be able to put signatures anymore.

If this is true, "Digital Signature" and "Certify" are not gonna happen one after another in a workflow. So what is the purpose of having these two functions together?

[ls_rbls]

This is part of ISO standards  for electronic records compliance.

You can always use digital signature fields and customize your needs in your PDFs.

This only makes sense when you work for the  FDA and FDA-regulated agencies , for example. They need workflows like these because a reviewer has to verify that all information is accurate. If any discrepancies are found another reviewer with the final authority to certify a document must also sign without altering the already signed document and without disassembling the original document. Certifying seals all that process and once it is closed it cannot be altered or modified.

The have a thing called Title 21 Part 11 -(21 CFR Part 11), for example. It is a requirement in their workflow to not only protect  electronic records from being copied (they have to remain in digital format from beginning to end(no hard copies), but also , protecting the individual's PII in those documents as well as those that have a need to know when they request for such documents for review.

Very strict  sanctions or fines are imposed if the companies that conduct business transactions with agencies like the FDA (i.e. medical device manufacturers, food manufacturers), violate any of these procedures.

I just learned all of that trying to answer this question before in the  forums for two other Acrobat users.

The keyword here is the workflow. If you don't need to implement this workflow there's no need to worry too much about that feature.(that is just my very personal opinion though).

[martinz59337526]

Thank you.

[Thom Parker]

Confusing isn't. Can't remember a time when this wasn't true 😉

But these two things are technically the same thing under the covers. Acrobat just handles them differently, like the text in the purple bar. But there is more to it. A "signature" is part of the form thing.  So I don't think the entire AcroForm key inside the PDF is part of the hash, that way you can still make some form changes and not invalidate the signature. Whereas Certifying may or may not include the entire PDF in the hash, so any change invalidates it. You'll note that are some some permission options when you apply a certification. These determine what is included in the encryped hash. 

I'm not sure of the exact nature of these details, you'd have to dig into it more, but the gist is that both lock down the document so that non-allowed modifications cause it to invalidate. 

[martinz59337526]

Thank you so much for your detailed explanation. I think it is much clearer to me now.