Signing PDFs with PAdES levels

A PAdES (PDF Advanced Electronic Signatures) baseline level determines how much validation material a signature carries, which in turn determines how long it stays verifiable. Higher levels embed timestamps and, eventually, revocation data so the signature can be validated long after the signing certificate expires. This guide shows how to select a baseline level and how to choose the signature container format.

Common use cases include:

• Producing PAdES B-T signatures with a trusted timestamp for legal documents
• Meeting regulatory requirements for long-term validation and archival
• Choosing between the PAdES and classic CMS container formats

How Nutrient helps

Nutrient Python SDK handles the PAdES baseline levels and container formats behind a single property each. The SDK handles:

• Building the CMS/PKCS#7 signature container to the selected baseline profile
• Requesting and embedding RFC 3161 timestamps for B-T and above
• Embedding validation material for the long-term levels
• Writing the signature into the PDF using an incremental update

Baseline levels

The SignatureLevel enumeration selects the target profile:

• PADES_BASELINE_B — a basic signature. This is the default.
• PADES_BASELINE_T — adds a trusted timestamp. Requires a configured timestamp.
• PADES_BASELINE_LT — adds long-term validation material (certificates and revocation data). Requires the PAdES format and network access to revocation services.
• PADES_BASELINE_LTA — adds a document timestamp on top of B-LT for archival.

Complete implementation

This example produces a PAdES B-T signature and a classic CMS signature:

from nutrient_sdk import Document, Signature
from nutrient_sdk import DigitalSignatureOptions, TimestampConfiguration
from nutrient_sdk import SignatureLevel, SignatureFormat

Producing a PAdES B-T signature

Set level to SignatureLevel.PADES_BASELINE_T and configure a timestamp to produce a B-T signature.

In this sample:

• Document.open("input.pdf") opens the PDF before signing.
• level = SignatureLevel.PADES_BASELINE_T selects the B-T baseline profile.
• TimestampConfiguration sets the time stamp authority (TSA) endpoint, which B-T requires.
• sign(document, output_path, options) applies the timestamped signature.

The timestamp proves the signature existed at a specific point in time, even after the certificate expires:

with Signature() as signer, Document.open("input.pdf") as document:
    options = DigitalSignatureOptions()
    options.certificate_path = "certificate.pfx"
    options.certificate_password = "Nutrient answers all your document needs"
    options.signer_name = "Legal Department"
    options.reason = "Contract Execution"
    options.level = SignatureLevel.PADES_BASELINE_T

    timestamp = TimestampConfiguration()
    timestamp.server_url = "http://timestamp.digicert.com"
    options.timestamp = timestamp

    signer.sign(document, "output_pades_t.pdf", options)

Choosing the container format

The SignatureFormat enumeration selects the signature container:

• PADES — the PAdES profile (ETSI.CAdES.detached). This is the default and the one the baseline levels build on.
• CMS — the classic CMS container (adbe.pkcs7.detached) for compatibility with tools that expect the legacy format.

Set format to SignatureFormat.CMS to produce a classic CMS signature.

In this sample:

• Document.open("input.pdf") opens the PDF before signing.
• format = SignatureFormat.CMS selects the classic CMS container.
• sign(document, output_path, options) applies the signature.

with Signature() as signer, Document.open("input.pdf") as document:
    options = DigitalSignatureOptions()
    options.certificate_path = "certificate.pfx"
    options.certificate_password = "Nutrient answers all your document needs"
    options.signer_name = "Legal Department"
    options.reason = "Contract Execution"
    options.format = SignatureFormat.CMS

    signer.sign(document, "output_signed_cms.pdf", options)

Conclusion

Use this workflow to control the baseline level and format of a signature:

1. Open the document using a context manager(opens in a new tab) for automatic resource cleanup.
2. Configure DigitalSignatureOptions with certificate credentials and signing metadata.
3. Select the baseline profile with the level property and the SignatureLevel enumeration.
4. Configure a TimestampConfiguration for B-T and above — these levels require a trusted timestamp.
5. Use PADES_BASELINE_LT or PADES_BASELINE_LTA when you need long-term validation, keeping in mind these levels require the PAdES format and network access to revocation services.
6. Select the container format with the format property and the SignatureFormat enumeration.
7. Use SignatureFormat.CMS only for compatibility with tools that expect the legacy adbe.pkcs7.detached container; otherwise keep the default PAdES format.

For related signing workflows, refer to the Python SDK guides.