Two different things with almost the same name

What each one is

A drawn signature placed on a PDF is an electronic signature. It is sufficient for the overwhelming majority of commercial agreements, and it is what nearly everyone means when they say e-signature.

The legal position, in outline

Electronic signatures are legally recognised across the major jurisdictions, and have been for over two decades. This is not a grey area.

In the United States, the federal ESIGN Act of 2000 and state adoptions of UETA give electronic signatures the same legal effect as handwritten ones for most transactions. In the EU, the eIDAS Regulation does the same and defines three tiers. The UK gives effect through the Electronic Communications Act 2000 and subsequent case law.

• Simple electronic signature (SES) — a drawn, typed or clicked signature. Valid and admissible.
• Advanced electronic signature (AdES) — uniquely linked to the signer, capable of detecting changes.
• Qualified electronic signature (QES) — an AdES made with a qualified certificate on a secure device. Under eIDAS this alone has automatic legal equivalence to a handwritten signature across every member state.

Some documents are excluded from electronic signing regardless of tier, and the list varies by jurisdiction — commonly wills and testamentary instruments, certain family law documents, some property transfers, and various court filings. Check for the specific document type and jurisdiction. Nothing here is legal advice.

How a digital signature works

The mechanism explains both its strengths and its one awkward property.

Signing computes a hash of the document and encrypts that hash with the signer's private key. The result travels with the file alongside the certificate holding the matching public key. To verify, a reader recomputes the hash, decrypts the stored one, and compares. If the document changed by a single byte the hashes differ and the signature reports as invalid.

The certificate is what connects the key pair to a person, and it is issued by a certificate authority the verifier trusts. That trust chain is the whole basis of the guarantee — and, as the next section covers, it is also time-limited.

What happens when the certificate expires

This is the question behind "does my signed document expire", and the answer is more interesting than yes or no.

The document does not expire. A contract signed in 2019 remains as binding as it ever was; certificate expiry is not a legal event.

Validation can start failing. Certificates are issued for a fixed period, typically one to three years. Once past that date, a reader checking the signature may report that it cannot confirm the certificate was valid when signing occurred — because from the file alone, it cannot tell whether the signature was made before or after expiry.

• A trusted timestamp from a timestamping authority proves when the signature was made. This is the fix, and it must be applied at signing.
• Long-Term Validation (LTV) embeds the certificate chain and revocation data into the file, so verification does not depend on those still being reachable years later.
• PAdES is the PDF standard covering this, with profiles for long-term archival.
• Without either, expect a warning rather than a confirmation once the certificate lapses.

So for anything that must still verify in a decade — deeds, long-term contracts, regulatory records — the requirement is a timestamp and LTV at the moment of signing. It cannot be added afterwards, because the point is proving what was true at the time.

CAC and smart card signatures

A Common Access Card is the US Department of Defense identity card, carrying PKI certificates on a chip. Similar schemes exist elsewhere — national ID cards across much of Europe, and PIV cards for US federal civilian agencies.

Signing with one produces a digital signature where the private key never leaves the card, which is what makes it strong: the key cannot be copied off the device.

1. A card reader, connected and recognised.
2. Middleware so the operating system can talk to the card — ActivClient in DoD environments, or the platform's built-in smart card support.
3. The DoD root certificates installed, or the signature will show as untrusted even when it is perfectly valid.
4. Adobe Acrobat or Reader, which handles smart card signing properly. Browser viewers do not.
5. Then: Tools → Certificates → Digitally Sign, draw the area, choose the certificate, enter the PIN.

The third step accounts for most "my CAC signature shows as invalid" reports. The signature is fine; the verifying machine simply has no reason to trust the issuing authority until the root certificates are installed. On DoD networks this is usually already done, and on a personal machine it is not.

Choosing a signing service

For ordinary agreements, a simple electronic signature with a decent audit trail is what almost every business uses and it is entirely sufficient.

The audit trail is the part that matters, and it is what separates a service from simply pasting an image: a record of who signed, when, from which address, with what verification, and a tamper-evident sealed copy.

Assess a service on whether it produces a complete audit certificate, what identity verification it offers, whether it supports qualified signatures if you need them, where the data is stored — which matters for GDPR — and how you export your executed documents if you stop paying. That last one is worth asking before signing up rather than after. Where nothing needs countersigning and no audit trail is required, signing locally and emailing the PDF remains a perfectly legitimate approach.

Frequently asked questions