Lucy Muturi for Syncfusion, Inc.

Posted on Jul 30 • Originally published at syncfusion.com on Jul 30

How to Implement PAdES Digital Signatures in .NET for Long-Term PDF Validation

#pdf #netdevelopment #digitalsignatures #documentprocessing

TL;DR: Build compliant, long‑lasting PDF signing in .NET using PAdES standards, covering timestamps, long‑term validation (LTV), and archival protection, so signed documents remain verifiable, audit‑ready, and reliable even years after certificate expiry.

PDFs move quickly through approvals, customers, and automated workflows. Everything looks fine until someone opens the document years later and sees “Signature validity unknown.”

That’s the real problem with basic digital signatures. They can prove a document hasn’t been altered, but they can’t always prove when it was signed or whether the certificate was trusted at the time.

Certificates expire.
CAs rotate keys.
Revocation servers disappear.

Without preserved validation evidence, even a legitimate signature can fail an audit.

This is exactly the gap that PAdES digital signatures are designed to solve.

In this guide, we’ll break down how PAdES works and walk through implementing each PAdES level in .NET with the Syncfusion^® .NET PDF Library, from a basic signature to long‑term, archival‑grade validation using practical, real‑world examples.

What is PAdES, and why basic PDF signatures fail

PAdES (PDF Advanced Electronic Signatures) is an ETSI standard (EN 319 142) created for long‑term trust in signed PDF documents. Unlike simple signatures, PAdES allows a PDF to carry its own verification evidence, enabling validation of the signature years later, even without network access.

At a high level, PAdES enables PDFs to be:

Self-contained: Signature, certificates, and validation data live inside the document
Tamper-evident: Any post‑signing change is detectable
Time-provable: Trusted timestamps prove when the signature happened
Audit-ready: Aligned with eIDAS and other regulatory frameworks
Multi-signature friendly: Suitable for sequential or multi‑party workflows

If you’re building document workflows for finance, healthcare, government, or enterprise SaaS, basic signatures are rarely enough. PAdES is what keeps those documents verifiable long after the original certificate has expired.

PAdES signature levels

PAdES defines a progression of signature levels. Each level adds protection on top of the previous one.

PAdES B-B: Basic signature

The PDF is signed using an X.509 certificate to ensure integrity, but no trusted timestamp or validation evidence is embedded.

Protects against tampering
Breaks once the certificate expires

PAdES B-T: Timestamped signature

Adds a trusted RFC 3161 timestamp from a Timestamp Authority (TSA), proving when the signing occurred.

Proves signing time
Helps with non‑repudiation
Still depends on external revocation checks later

PAdES B-LT: Long-Term Validation (LTV)

Embeds the certificate chain and revocation data (OCSP/CRL) directly into the PDF’s Document Security Store (DSS).

Verifiable years later
Works offline
Survives certificate expiry

PAdES B-LTA: Archival signature

Adds a document‑level archival timestamp over the entire validation material, protecting the document for decades even as cryptographic algorithms age.

Designed for long‑term archives
Resistant to algorithm decay
Common in the public sector and regulated records

Syncfusion PDF Library: PAdES-ready signing for .NET

Our PDF Library provides PAdES‑ready signing across .NET platforms, supporting timestamps, LTV, and archival protection with clean, developer-friendly APIs. It enables secure, compliant, and long-term-trustworthy signing workflows with minimal integration effort.

Secure PDF signing with PAdES in .NET

What Syncfusion enables for PAdES

Standards-based signing: CMS/CAdES support with SHA-256, SHA-384, and SHA-512.
Trusted timestamping: Add RFC 3161 timestamps to prove the signing moment.
Long-term validation (LTV): Embed OCSP, CRL, and certificate chain data into the DSS.
Archival protection (LTA): Add document‑level timestamps for multi‑decade retention.
Flexible certificates: Works with PFX, Windows store, HSM devices, and PKCS#11 keys.
Server-side automation: Runs on Windows, Linux, and Docker without UI interaction.

Now, let’s look at how PAdES signing works at a high level and how to implement each level using our PDF Library.

Implementing PAdES digital signatures

With the Syncfusion PDF Library, adding PAdES signatures in .NET becomes simple and straightforward. The following steps walk you through loading a certificate, applying CAdES, and enabling timestamps and LTV/LTA to build a secure signing workflow.

Step 1: Create a new project

Start a new console application on .NET Core.

Step 2: Install required packages

Add the Syncfusion.Pdf.Net.Core NuGet package to your project

Step 3: Include required namespaces

In your Program.cs file, include the essential namespaces.

using Syncfusion.Pdf.Parsing;
using Syncfusion.Pdf.Security;
using Syncfusion.Pdf;
using Syncfusion.Pdf.Graphics;
using Syncfusion.Drawing;

Step 4: Add a basic digital signature

This is the foundation for all higher PAdES levels.

//Load existing PDF document.
using (PdfLoadedDocument loadedDocument =
    new PdfLoadedDocument(Path.GetFullPath(@"Data/pdf-succinctly.pdf")))
{
    //Load digital ID with password.
    FileStream certificateStream = new FileStream(
        Path.GetFullPath(@"Data/PDF.pfx"),
        FileMode.Open,
        FileAccess.Read);
    PdfCertificate pdfCert = new PdfCertificate(
        certificateStream,
        "syncfusion"
    );

    //Create a signature using a loaded digital ID.
    PdfSignature signature = new PdfSignature(
        loadedDocument,
        loadedDocument.Pages[0],
        pdfCert,
        "Signature"
    );

    //Save the PDF document
    loadedDocument.Save(
        Path.GetFullPath(@"Output/Output.pdf")
    );

    //Close the document.
    loadedDocument. Close(true);
}

Digitally signed PDF with .NET PDF Library

PAdES B-B: Applying CAdES standard to the signature

CAdES (CMS Advanced Electronic Signatures) is an ETSI standard that enhances signature security and compatibility. By default, our PDF Library%2C%20and%20Windows%20store%20certificates. ".NET PDF Library - Digital Signatures") signs using CMS with SHA-256, but you can easily switch the cryptographic standard and hashing algorithm through PdfSignatureSettings to achieve your preferred level of enhanced security.

//Load existing PDF document.
using (PdfLoadedDocument loadedDocument =
    new PdfLoadedDocument(Path.GetFullPath(@"Data/pdf-succinctly.pdf")))
{
    //Load digital ID with password.
    FileStream certificateStream = new FileStream(
        Path.GetFullPath(@"Data/PDF.pfx"),
        FileMode.Open,
        FileAccess.Read);
    PdfCertificate pdfCert = new PdfCertificate(
        certificateStream,
        "syncfusion");

    // Create a signature using a loaded digital ID.
    PdfSignature signature = new PdfSignature(
        loadedDocument,
        loadedDocument.Pages[0],
        pdfCert,
        "Signature");

    //Change the digital signature standard and hashing algorithm.
    PdfSignatureSettings settings = signature.Settings;
    settings.CryptographicStandard = CryptographicStandard.CADES;
    signature.Settings.DigestAlgorithm = DigestAlgorithm.SHA512;

    //Save the PDF document
    loadedDocument.Save(
        Path.GetFullPath(@"Output/Output.pdf"));

    //Close the document
    loadedDocument.Close();
}