Skip to content

Use case · Signed agreements

Sign the bytes. Carry the evidence

Apply a PAdES digital signature to the agreement bytes. Start with PAdES B-B in NextPDF Core, add B-T in NextPDF Pro, and carry validation material with B-LT/B-LTA in NextPDF Enterprise.

Start free trialExplore NextPDF Pro

Signature path

Render, sign, save

A PAdES signature binds the document bytes to the signer’s certificate. The baseline path is one explicit step in the document lifecycle.

Macro detail of a printed agreement with an embossed dry seal, guilloche border, countersign rule, and registration target.Macro detail of a printed agreement with an embossed dry seal, guilloche border, countersign rule, and registration target.
sign-agreement.php
use NextPDF\Core\Document;
use NextPDF\Security\Signature\CertificateInfo;
use NextPDF\Security\Signature\SignatureLevel;

$doc = Document::createStandalone();
$doc->addPage();
$doc->writeHtml($agreementHtml);

$certificate = new CertificateInfo(
    certificate: $certificatePem,
    privateKey: $privateKeyPem,
);

$doc->setSignature(
    certInfo: $certificate,
    level: SignatureLevel::PAdES_B_B,
);

$doc->save('agreement.pdf');

Sample evidence

Inspect a timestamped agreement

PAdES Digital Signature sample PDF cover
signed-agreement.pdfSHA-256a03f07dfed357512a360d7e7da193a5b628ceaa26090cb17d85c12088ad7aefeDownload PDF

The SHA-256-pinned sample carries an embedded signature. Its CMS SignedData binds the document’s /ByteRange, and an RFC 3161 token records the signature timestamp.

The sample uses repository demonstration credentials and a demonstration timestamp authority. Production trust comes from the certificate, timestamp authority, trust services, and process you configure.

PAdES levels

Choose how long the validation evidence must travel

Each PAdES baseline level adds evidence to the level before it. Editions follow the same progression.

VALIDATION LONGEVITYPROFILE PROGRESSIONB-BBASELINECOREB-TTIMESTAMPEDPROB-LTLONG-TERMENTERPRISEB-LTALONG-TERM ARCHIVALENTERPRISE

  1. B-BBaselineCore

    A CMS SignedData container covering the document bytes and carrying the signing certificate.

    Proves Signed-byte integrity associated with the included signing certificate.

  2. B-TTimestampedPro

    An RFC 3161 time-stamp token over the signature.

    Proves A TSA-attested time when the signature existed.

  3. B-LTLong-termEnterprise

    Embedded validation material—the DSS, with certificates and revocation data.

    Proves Portable validation material for later signature checks.

  4. B-LTALong-term archivalEnterprise

    Renewable archival document timestamps over the embedded validation material.

    Proves Renewable integrity evidence over the embedded validation material.

The PAdES baseline levels (ETSI EN 319 142-1); each level builds on the one before.

Legal scope

The signature profile is one part of legal status

PAdES is defined by ETSI EN 319 142-1 and supports eIDAS electronic-signature workflows in the EU.

The published AATL PAdES B-LTA chain includes a document-signing certificate, RFC 3161 timestamps, and DSS validation material. Authority acceptance depends on your certificates, trust services, signer identity, key controls, and process.

Sign your first agreement

Start with PAdES B-B, inspect the timestamped sample, or compare the four levels by edition.

Sign your first PDFCompare editionsDownload the signed sample →