16

I am a Linux desktop user.

Someone sends me a PDF file which is digitally signed. It is supposed to be signed using some kind of government / regulated body / official institution issued certificate.

Is there a way that I, as a typical end-user, could determine whether the signature is valid?

I know Windows Acrobat Reader works to some extend, though even there it's not really clear about the validity of a signature as opposed to the fact that it's there and seems to be from XYZ.

4
  • As with all digital signing certificates, if you don't trust the certificate that signed the document, the authenticity of the document cannot be confirmed. You can be signed a document with any certificate you want as the author, it all depends on the fact if the person reading the document trusts the certificate you used. Only you can determine if that is the case, I would just use the same approach I use to verify the certificate path of a website certificate, to verify the signing path of a signing certificate.
    – Ramhound
    Jul 24, 2018 at 20:40
  • 1
    @Ramhound: I think the question is more along the lines "which utility will me show the chain of trust relevant to some given PDF with embedded certificates?" Offhand, I can't think of a tool where I know that it can access signatures in PDF files. I'd be interested in an answer to this, too.
    – dirkt
    Jul 25, 2018 at 6:14
  • I am aware of what the question is, avoiding that question, due to the help center.
    – Ramhound
    Jul 25, 2018 at 12:16
  • Does this answer your question? How would I validate digital signature for PDFs in linux?
    – eadmaster
    Jan 27, 2021 at 13:51

2 Answers 2

15

I spent few hours experimenting with that and found that:

1) pdfsig command from poppler-utils package is able to validate PDF signature. Usage is simple:

pdfsig signed.pdf

But for me it works only for visible signatures (version 0.62.0 on Fedora 28). For invisible signatures it shows:

File 'signed.pdf' does not contain any signatures

2) Master PDF Editor is a GUI tool which shows and validates signatures as shown on the picture below and it is enough to have free version. Master PDF Editor - Signatures

3) LibreOffice Draw is able to show and validate signature using File -> Electronic signatures -> Electronic signatures. But in my case it again shows only visible signatures.

4
  • 1
    What does "visible signature" mean to you?
    – TorstenS
    Oct 2, 2018 at 11:09
  • @TorstenS visible signature is for me that PDF has some additional annotation like visible image or text signalizing that the PDF is signed, it is like watermark.
    – cgrim
    Oct 2, 2018 at 11:32
  • My best guess would be that a visible signature is not at all related to a cryptographic signature. Some PDF signing tools which allow you to cryptographically sign a PDF will also add a visible signature to the document, but that is usually not what you are interested in.
    – TorstenS
    Oct 2, 2018 at 12:17
  • @TorstenS Look in the document Digital Signatures Appearances page 9: PDF signatures can be visible or invisible. Probably that visual Signature annotation (not the signature itself) must be present in a PDF document and can be visible or invisible. I tried document where is only the digital signature but without that visual Signature annotation and then tools which I listed in the answer cannot see it.
    – cgrim
    Oct 2, 2018 at 12:31
1

Foxit PhantomPDF should be able to provide the functionality of verifying digital certificates - available on a purchase basis. Foxit Reader can only digitally sign the certificates. mutool sign signed.pdf functionality is not available in ubuntu builds. May be present in Arch.

1
  • This is not Linux Software, according to their Datasheet_FoxitPhantomPDFBusiness.pdf
    – rwst
    Oct 6, 2021 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.