서명 검증

이 도구가 하는 일

This checks the digital signatures inside a PDF and writes a report. It asks four separate questions and never collapses them into one tick: does the signature cover the whole file, does the digest still match, does the signature verify against the certificate embedded with it, and is that certificate one you should trust. The last is answered honestly - there is no trust store here, so the report says not checked.

Whenever a signed document matters and you did not produce it: an invoice that claims to be signed, a contract returned by a counterparty, a certificate sent as proof of something. It is also worth running on your own output, to see what the recipient's reader will report.

작동 방식

1. Drop the signed PDF onto this page.
2. Leave certificate details on to see the subject, the issuer, the validity dates and the serial number in the report.
3. Press Verify signature. A document with no signature field says so plainly and points you at Digital signature, rather than reporting a failure.
4. Read the report. Each signature gets its own section, and every line is marked ok, information, warning or danger.
5. Keep the report as a web page, or switch the format to JSON under advanced options if something else is going to read it.

The check most verifiers skip is whether the signature covers the whole file. A PDF signature covers only the byte ranges named in its /ByteRange array, so a forged document can carry a perfectly valid signature over the first two pages and an appended third page that nobody signed. A verifier that asks only whether the CMS validates reports that as signed and intact, which is why it is the first line of this report.

Certificate trusted: not checked is the honest answer, and it is deliberate. Deciding whether a certificate belongs to whoever it names requires a trust store and, for revocation, a call to the issuer - and this tool ships no trust store and contacts no issuer. So the report shows the subject, the issuer and the validity window and asks you to compare them against what you expected.

Read the four lines together rather than looking for a verdict. Covers the whole document and document unchanged tell you the bytes are as they were signed; signature verifies tells you the private key matching the embedded certificate produced it. An expired certificate is a warning rather than a failure, because a signature made before expiry stays valid - though without a timestamp nothing proves when it was made.

A document signed with a picture of a signature has nothing here to check, and the report says no signature field rather than pretending otherwise. That is not evidence of anything wrong - most everyday signing is done that way - but the file carries no evidence of its own integrity, and no tool can supply that afterwards.