Document signing is a separate primitive from code signing: different certificate profiles (typically eIDAS-qualified or Adobe-approved roots), different signature envelopes (PAdES for PDF, CAdES for other formats), and different verification rules. TigerTrust ships a dedicated section so document workflows don’t get mixed up with software release workflows.
Document Signing

​
What it is

You issue document-signing certificates from your CA, sign documents through TigerTrust, and receive a signed artifact with an optional RFC 3161 timestamp. TigerTrust verifies signatures on demand — checking signature integrity, certificate validity at the time of signing, trust chain, revocation, and timestamp authenticity.

​
When to use it

  • Provide legally-binding eIDAS-qualified signatures on contracts and agreements.
  • Sign invoices, NDAs, or audit reports before delivery.
  • Add an RFC 3161 timestamp to extend signature validity beyond the certificate’s expiry.
  • Verify that a received document was signed by a trusted party with a valid certificate.

​
Set it up

1

Issue a document-signing certificate

Go to Document Signing > Certificates and click New certificate. Enter the subject (typically the signer’s legal name and organization), select a CA, set validity, and choose the key type. For eIDAS QES, mark the certificate as qualified — this sets the required nonRepudiation key usage.
2

Sign a document

Go to Document Signing > Sign. Upload the document (or paste a pre-computed hash for large files), select the signing certificate, enter a reason and location (these are embedded in the signature dictionary and appear in PDF readers), and click Sign.
3

Configure timestamping

On the certificate or per-signing request, set a Timestamp server URL (RFC 3161). Use an external TSA (DigiCert, GlobalSign) or your internal PKI’s built-in timestamp authority for air-gapped installs.
4

Verify a signed document

Go to Document Signing > Operations, find the operation, and click Verify. You can also pass an operation ID to the verify flow to check any previously-signed document.

​
What you’ll see

Document Signing > Operations lists every signing attempt with certificate, document name, hash, signature type, status, and the user who initiated the operation. Each row expands to show the full verification result.

​
Signature formats

PAdES (PDF)

ETSI EN 319 142. Embedded signature dictionary inside the PDF byte-range. Supports Baseline B, T, LT, and LTA profiles.

CAdES (any)

ETSI EN 319 122. Detached or enveloping CMS SignedData. Used for Office documents, XML payloads, and generic binaries.

XAdES (XML)

ETSI EN 319 132. XML DSig with QES extensions. For invoices, contracts, and any XML payload.

​
Verification checks

1

Signature integrity

Re-hashes the byte-range and confirms the signature over the digest.
2

Certificate validity

Confirms the certificate was valid at the time of signing (using the embedded timestamp if present).
3

Chain trust

Walks up to a trusted root — your internal PKI or the bundled Adobe Approved Trust List / eIDAS Trust List.
4

Revocation

Fetches CRL/OCSP for the signing certificate and every intermediate.
5

Timestamp

Verifies the timestamp token was signed by a trusted TSA and the timestamped digest matches the signature.
The reason and location fields you enter at signing time are embedded in the signature dictionary. PDF readers display them in the signature panel when a recipient inspects the document. Set them meaningfully — they appear on legal exhibits.

Code signing

Same pattern for signing executables and installers.

Approvals

Two-person integrity for high-value legal signing.

Audit logs

Every signing action is captured for compliance review.