Use case · Signed agreements
Sign agreements that hold up.
Apply PAdES digital signatures that bind a contract to a signer's certificate — from baseline signatures in Core to long-term, archival-grade validation in Enterprise.
The problem
A contract PDF that anyone can edit after the fact isn't worth much. You need a signature that binds the document bytes to the signer, survives transit, and — for records that must last years — keeps verifying long after the signing certificate expires. That's the difference between a baseline signature and a long-term one.
In code
Render, sign, save.
use NextPDF\Core\Document;
use NextPDF\Security\Signature\CertificateInfo;
use NextPDF\Security\Signature\DigitalSigner;
use NextPDF\Security\Signature\SignatureAlgorithm;
use NextPDF\Security\Signature\SignatureLevel;
$doc = Document::createStandalone();
$doc->addPage();
$doc->writeHtml($agreementHtml);
// Configure the PAdES B-B signature (Core).
$cert = new CertificateInfo(certificate: $pem, privateKey: $key);
$doc->setSignature(certInfo: $cert, level: SignatureLevel::PAdES_B_B);
// Produce the CMS SignedData token over the document bytes.
$signer = new DigitalSigner($cert, SignatureLevel::PAdES_B_B, SignatureAlgorithm::Pkcs1v15);
$cms = $signer->sign($doc->getPdfData());
$doc->save('agreement.pdf');The downloadable sample is a genuine embedded signature: a /ByteRange covering the whole document around an embedded CMS SignedData token (ETSI.CAdES.detached) — baseline PAdES B-B, a Core capability you can inspect in any reader's signature panel. Baseline B-B omits only a trusted timestamp: that timestamp (B-T) is Pro, and the long-term levels (B-LT/B-LTA) are Enterprise.
The standards
Which level do you need?
B-BBaselineCore
A CMS SignedData container binding the document to the signer.
ProvesWho signed it, and that the bytes have not changed since signing.
B-TTimestampedPro
An RFC 3161 trusted timestamp over the signature.
ProvesWhen it was signed, attested by an independent time authority.
B-LTLong-termEnterprise
Embedded validation material — the DSS, with certificates and revocation data.
ProvesIt still verifies after the signing certificate expires or its revocation service goes offline.
B-LTALong-term archivalEnterprise
Renewable archival document timestamps over the embedded validation material.
ProvesIt keeps verifying across decades as algorithms age, by re-timestamping before they weaken.
The PAdES baseline levels (ETSI EN 319 142-1); each level builds on the one before.
PAdES is defined by ETSI EN 319 142; in the EU it underpins eIDAS electronic signatures. NextPDF produces output that targets these profiles — whether a given signature is legally a qualified electronic signature depends on your certificates, trust services, and process, which remain your responsibility.