Certifying PDF documents

A certifying signature (also called an author or DocMDP signature) does more than prove who signed a document — it declares which changes are permitted afterward. Any change beyond what the certification permits invalidates the signature, so PDF viewers can warn the reader that the document was altered. A certifying signature must be the first signature applied to a document, and a document can have only one.

Common use cases include:

• Locking a finalized contract so no further changes are permitted
• Publishing a form that recipients may fill in but not otherwise modify
• Certifying a report while still permitting reviewers to add annotations

How Nutrient helps

Nutrient Java SDK applies the DocMDP certification transform behind a single property. The SDK handles:

• Writing the DocMDP transform parameters that declare the permitted changes
• Marking the signature as a certifying signature in the document catalog
• Computing the byte ranges and building the CMS/PKCS#7 signature container
• Writing the signature into the PDF using an incremental update

Certification levels

The SignatureCertificationLevel enumeration declares which changes are permitted after certification:

• NotCertified — An ordinary approval signature, not a certifying one. This is the default.
• NoChanges — No changes are permitted; any change invalidates the signature.
• FormFilling — Only form filling and signing are permitted.
• FormFillingAndAnnotations — Form filling, signing, and annotation changes are permitted.

Complete implementation

This example applies a certifying signature that permits form filling and signing:

package io.nutrient.Sample;

import io.nutrient.sdk.*;
import io.nutrient.sdk.enums.*;
import io.nutrient.sdk.signing.*;

public class DigitalSignatures {

Create the main method as the sample entry point:

    public static void main(String[] args) {

Certifying the document

Set setCertification(...) to make the signature a certifying signature.

In this sample:

• Document.open("input.pdf") opens the PDF before signing.
• setCertification(SignatureCertificationLevel.FormFilling) permits form filling and signing after certification.
• sign(document, outputPath, options) applies the certifying signature.

Because a certifying signature must be the first signature on the document, apply it before any approval signatures:

        try (Signature signer = new Signature();
             Document document = Document.open("input.pdf")) {
            DigitalSignatureOptions options = new DigitalSignatureOptions();
            options.setCertificatePath("certificate.pfx");
            options.setCertificatePassword("Nutrient answers all your document needs");
            options.setSignerName("Document Author");
            options.setReason("Certifying document integrity");
            options.setCertification(SignatureCertificationLevel.FormFilling);

            signer.sign(document, "output_certified.pdf", options);
        } catch (Exception e) {
            System.err.println("Error certifying document: " + e.getMessage());
        }
    }
}

Conclusion

Use this workflow to certify a document:

1. Open the document using try-with-resources for automatic resource cleanup.
2. Configure DigitalSignatureOptions with certificate credentials and signing metadata.
3. Declare the permitted changes with setCertification() and the SignatureCertificationLevel enumeration.
4. Apply the certifying signature first — it must be the first signature on the document, and a document can have only one.
5. Use NoChanges to lock the document completely, or FormFilling and FormFillingAndAnnotations to permit specific downstream changes.
6. Leave the default NotCertified for ordinary approval signatures that don’t restrict later changes.

For related signing workflows, refer to the Java SDK guides.