Skip to content
3 min readSecurityThe NextPDF team

PAdES signatures in PHP, from B-B to B-LTA

The four PAdES levels define what a signed PDF preserves and for how long. This guide maps each level to its evidence, the NextPDF edition that produces it, and the applicable responsibility boundary.

A contract PDF needs protection against changes after signing. A digital signature binds the bytes to the signer, survives transit, and—for records that have to last—keeps verifying long after the signing certificate has expired.

PAdES (PDF Advanced Electronic Signatures, ETSI EN 319 142) organizes these capabilities into levels. The four baseline levels build on one another.

The baseline: render, sign, save

At the baseline level the code is short. You render the document, attach a certificate, and produce a CMS SignedData token over the document bytes:

sign-agreement.php
use NextPDF\Core\Document;
use NextPDF\Security\Signature\CertificateInfo;
use NextPDF\Security\Signature\DigitalSigner;
use NextPDF\Security\Signature\SignatureAlgorithm;
use NextPDF\Security\Signature\SignatureLevel;

$doc = Document::createStandalone();
$doc->addPage();
$doc->writeHtml($agreementHtml);

// Configure the PAdES B-B signature (Core).
$cert = new CertificateInfo(certificate: $pem, privateKey: $key);
$doc->setSignature(certInfo: $cert, level: SignatureLevel::PAdES_B_B);

// Produce the CMS SignedData token over the document bytes.
$signer = new DigitalSigner($cert, SignatureLevel::PAdES_B_B, SignatureAlgorithm::Pkcs1v15);
$cms = $signer->sign($doc->getPdfData());

$doc->save('agreement.pdf');

That is PAdES B-B, and it ships in the open-source Core. It is the foundation every higher level builds on.

The four levels, plainly

  • B-B (Baseline)—Who signed it, and have the bytes changed since? A CMS SignedData structure binds the document to the signer’s certificate. In NextPDF this is a Core capability.

  • B-T (Timestamp)—…and when was it signed? Adds an RFC 3161 trusted timestamp from a Time-Stamping Authority, so the signing time is attested by a third party rather than asserted by the signer’s clock. This is a Pro capability.

  • B-LT (Long-Term)—…and can I still validate it after the CA’s data changes? Embeds the validation material—certificates, OCSP/CRL revocation data—inside the document (the DSS), so later verification can use the document’s embedded validation material. An Enterprise capability.

  • B-LTA (Long-Term with Archival timestamps)—…and will it still verify in a decade? Adds document timestamps over the validation material, which can be renewed over time so the signature stays verifiable long after the original signing certificate and even the timestamp algorithms age out. Also Enterprise.

In short, B-B proves who and integrity, B-T adds when, B-LT adds self-contained validation, and B-LTA adds durability over time. Choose the level your records need.

Which level do you need?

A rule of thumb, not legal advice:

  • An internal approval or a short-lived agreement: B-B is often enough.
  • Anything where the signing time could be disputed: B-T.
  • Records with a multi-year validation horizon and embedded CA validation material: B-LT.
  • Long-retention, archival, or regulated records: B-LTA.

Where your responsibility begins

PAdES is defined by ETSI EN 319 142, and in the EU these profiles underpin eIDAS electronic signatures. NextPDF produces output that targets these profiles and emits a CMS SignedData token over the document bytes.

The PDF engine supplies the profile structures and cryptographic output. The signature’s legal status is determined by the certificates, trust service provider, signer-identification process, key protection, and applicable law. NextPDF provides the standards-targeting signing engine and levels for the selected retention horizon.

  • The deep dive, with a downloadable signed sample: Signed agreements.
  • Compare what each edition signs: Editions.
  • Sign your first PDF in five minutes: /try.