Get Digital Signatures

Returns a document's digital signatures.

A document's digital signature status is computed by looking at all the digital signatures included in the document. Digital signature status is automatically updated after each change (e.g. adding a new annotation).

The validity of a signature is determined by the signing certificate used to create it: If you're using a custom certificate, you need to set up Document Engine to use a corresponding certificate store in order to identify the signature as valid. Please check our guide article on how to set up custom certificates for digital signature validation.

By default, the signature certificates are validated against the current time. This means that valid signatures with expired certificates validate as expired. You can modify the DIGITAL_SIGNATURE_CERTIFICATE_CHECK_TIME configuration option to signing_time if you wish to instead validate certificates against the signing time.

⚠ Warning: If you're validating digital signature certificates against the signing time, special care should be taken: By default, there's no way of knowing whether the creation time stored with the signature itself can be trusted. To solve this issue, digital signatures need to use a Time Stamping Authority to provide a signed timestamp to embed. Note that we don't validate the timestamp token's certificates — we always assume a valid proof of existence if it's present. Thus, it's expected that the timestamps will be validated independently by your client code.