Cryptographic verification · PKCS#7 · X.509

Is that PDF really signed & untouched?

Drop any signed PDF. In seconds we extract its embedded PKCS#7 signature, verify the byte-range integrity, walk the X.509 trust chain against pre-loaded Indian CCA roots, and hand you a verdict — Green, Amber, or Red.

100%On-premise
0External APIs
≤ 20 MBPer PDF
SHA-256& SHA-1 ready

Verify a signed PDF

Drag & drop, or browse. Files are wiped from the server immediately after inspection.

Max 20 MB · .pdf only
…
Analysing…

Document snapshot

Trusted certificate roots

Bundled Indian CCA-licensed CA roots. Add your own via the admin page.

…

How the verification works

  1. 01
    ByteRange parsing. We locate the PDF /ByteRange and /Contents markers, extract the exact byte spans that were signed, and pull the embedded PKCS#7 blob.
  2. 02
    Message-digest match. We rehash the signed byte spans and compare against the messageDigest attribute inside the CMS SignerInfo. Any mismatch ⇒ the document was altered.
  3. 03
    Chain walk. Signer certificate → intermediates → root. We match the root against the bundled Indian CCA trust store using OpenSSL.
  4. 04
    Verdict. Green if bytes match and chain terminates in a trusted root; Amber if the signature parses but chain/bytes fail; Red otherwise.