Qualified and certificate signatures: when a drawn one is not enough

This explains the rules; it is not legal advice. The legal texts were checked on 11 October 2026: Regulation (EU) No 910/2014 (eIDAS) and its amendment, Regulation (EU) 2024/1183, both on EUR-Lex.

Check what a PDF carries

Inspect PDFFonts, images, metadata, why it is big. Free, runs on your device.Open

Received a file and want to know whether it is digitally signed before you add anything? Inspect PDF shows a Digital signatures line with the count, on your device, and notes that rewriting the file breaks them. It does not validate the signature: for who signed and whether it is still valid, open the file in the free Adobe Acrobat Reader and look at its signature panel.

The 3 levels, in 1 paragraph each

eIDAS sorts electronic signatures into 3 levels.

A simple electronic signature is any data in electronic form attached to other data and used to sign (Article 3(10)): a drawn signature, a typed name, a photo of your ink. It is what getPDF makes, and what most everyday contracts use.

An advanced electronic signature is uniquely linked to the signer, identifies them, is made with means under their sole control, and is linked to the document so that any later change is detectable (Article 26). In practice that means a personal certificate and cryptography inside the PDF.

A qualified electronic signature is an advanced one made with a qualified signature creation device and based on a qualified certificate (Article 3(12)). The provider is audited and listed on its country’s trusted list. Article 25(2) gives it the equivalent legal effect of a handwritten signature, and Article 25(3) makes one from any member state valid in all the others.

Who actually demands a qualified signature?

Fewer people than signing companies suggest. Typical cases:

• National written-form rules. eIDAS leaves each country’s rules on the form of contracts untouched (Article 2(3)). Where German law requires written form, the electronic replacement must carry a qualified electronic signature (§ 126a BGB); some acts, such as ending an employment contract, cannot be done electronically at all (§ 623 BGB). Other countries have their own lists.
• Public bodies and registries. Some tenders, company registers, land registers and court filings require a qualified signature, or accept only their own portal’s signing.
• Banks and large companies, for certain contracts, by their own policy. Under eIDAS a qualified signature from one member state must be recognised as qualified in all the others, which is why cross-border paperwork often asks for one.

If someone tells you a drawn signature is not enough, ask which level they need and in which form (a signed PDF, or signing inside their portal). The answer decides the route.

What a certificate signature proves that a drawn one cannot

A drawn signature on a PDF is a picture of agreement. It does not prove who placed it, and nothing in the file shows whether the page changed afterwards. That is fine for most documents, because the email it travelled with does the proving.

A certificate signature adds 2 things, both checkable by software:

1. Who signed. The certificate names the signer, and for a qualified one an audited provider verified that identity.
2. That nothing changed since. The signature covers the exact bytes of the file. Change a single character and a signature check reports it.

That second point is why any tool that rewrites a signed PDF (compressing, merging, flattening) ends the signature’s validity. getPDF’s tools warn when they write a new copy of a signed file, and compressing a signed PDF explains the safe routes.

Where to get one today

• A qualified trust service provider. Each EU country publishes a trusted list of the providers its supervisor has qualified, and the European Commission brings them together on its eIDAS Dashboard. Providers sell certificates and signing services; prices and identity checks vary by provider and country, so compare a few.
• Your country’s eID. Some national eIDs already include a qualified signature. In Austria, for example, ID Austria lets you sign a PDF with a qualified electronic signature on oesterreich.gv.at (“PDF signieren”), so a resident of Vienna or Graz who has set up ID Austria can sign there (oesterreich.gv.at, checked on 11 October 2026).
• The EU Digital Identity Wallet. The 2024 amendment of eIDAS requires each member state to provide at least one wallet within 24 months of the implementing acts (Article 5a(1)); the European Commission says wallets will be available by the end of 2026. The wallet must let all natural persons sign with qualified electronic signatures by default and free of charge, and countries may limit the free use to non-professional purposes (Article 5a(5)(g)). When it actually reaches your phone depends on your country’s rollout.

When the recipient asks for a qualified signature and you have none

1. Ask whether they accept signing in their own portal. Many public bodies run one, often tied to the national eID.
2. If you have a national eID with a qualified signature, use it on the final PDF. Sign last: any change after a certificate signature shows when it is checked.
3. Otherwise, pick a qualified provider from your country’s trusted list. Expect an identity check (video call, in person or with your eID card) before the first signature, so do not leave it to the deadline day.
4. Prepare the PDF first: fill it, flatten it if it is a form, and check every page. Then apply the qualified signature as the very last step.

The honest part

getPDF does not make certificate or qualified signatures. Its signature pad makes simple electronic signatures and says so on screen. Certificate signatures are on the project’s list for later, with no date, and a list is not a feature. For documents that need one, use a qualified provider or your eID.

getPDF does not validate them either. Inspect PDF counts digital signatures and reads nothing more into them. The free Adobe Acrobat Reader checks them. Austria’s RTR offers a free online checker through oesterreich.gv.at, but that one means uploading the file to their service, so use it only for documents you are happy to send there.

getPDF does handle them with care. When you open a digitally signed PDF to add your own drawn signature or answers, the editor appends your changes after the signed version instead of rewriting the file, so the earlier signature stays valid for what was signed, and it tells you when you save. A signature check then shows that the file changed after that signature, which is true.

Most documents never need this. For a lease, an offer or an NDA, a simple signature is valid and normal; the plain-words guide to signature law shows why, and sending a PDF for signature covers the everyday round trip by email.