Why SignClearly runs its own certificate authority

What changed on 28 October 2026

A PDF signed through SignClearly now carries two digital signatures, and both certificates come from SignClearly's own certificate authority:

• the signer's signature, made with a one-time key created in the signer's browser;
• the SignClearly platform seal, which covers the final file and shows it has not changed since SignClearly sealed it. The seal is not the signature of a person.

Both certificates lead to the same root certificate, SignClearly Root CA.

A one-time key that stays in the browser

When the signer confirms, their browser creates an ECDSA P-256 key pair. The private key cannot be exported from the page and is gone after the signature is made. SignClearly's certificate authority issues a certificate for the public key, valid for 24 hours and for this one signature. The certificate carries the signer's email address, and when the sender required an ID check, also the name from the ID.

The signature uses PAdES, the standard format for signatures inside PDF files. It gets a timestamp from an RFC 3161 time-stamping authority, DigiCert, which makes the level PAdES-B-T. The timestamp comes from DigiCert, not from SignClearly's servers.

We issue a certificate per signature rather than per device. Nothing has to be stored in the browser, so clearing it or switching to another phone loses nothing, and each certificate describes only what was checked for that one signature.

Why not a provider Adobe already trusts

Adobe Acrobat trusts certificates from authorities on its Approved Trust List (AATL) and on the EU trusted lists. Signing through a cloud provider from those lists would make Acrobat show the signer as trusted with no setup. We decided against it: it needs a contract with the provider, and in that model the signing key is held on the provider's servers instead of being created in the signer's browser.

We also considered a certificate from an AATL member for the platform seal only. It would have to be issued to a legal entity, and the signer's signature next to it would still show as unknown.

What you see in Adobe Acrobat

Acrobat and Reader check both signatures and show whether the file changed after signing. Because SignClearly Root CA is not on the AATL or the EU trusted lists, Acrobat also shows “Signature validity is unknown” or “At least one signature has problems”. That message is about who issued the certificates. It does not mean the file was changed.

To make Acrobat trust both signatures, import the root once per computer:

1. 1Download the root certificate from https://pki.signclearly.com/r1.crt and check its fingerprint as shown below.
2. 2In Acrobat, open Preferences → Signatures → Identities & Trusted Certificates → More.
3. 3Choose Trusted Certificates → Import and select r1.crt.
4. 4Select the imported certificate, click Edit Trust and tick “Use this certificate as a trusted root”.

The same steps, with more detail, are on Verify a signed PDF. Trusting the root tells Acrobat that you accept SignClearly as the issuer of these certificates. It does not make the signature a qualified electronic signature (QES).

The platform seal

After the signer signs, SignClearly adds a second signature over the final file: the platform seal. Its certificate is issued by the same certificate authority to “SignClearly platform seal”, and its policy states that it is not the signature of a person. The seal shows that the file has not changed since SignClearly sealed it. Because both certificates lead to the same root, one import makes Acrobat trust the signer's signature and the seal.

The root certificate

SignClearly Root CA is valid until 28 October 2046. Its private key is not kept on the server that issues certificates: the server holds an issuing certificate authority signed by the root, and the root can revoke it. Before you import r1.crt, compare its SHA-256 fingerprint with this one:

On macOS, run this in Terminal:

On Windows, run this in Command Prompt:

If the result differs from the fingerprint above, do not import the file.