Digital signatures on certificates: what they establish and what makes them valid

Two meanings of "signature"

On a certificate, the term signature covers two distinct things:

• The image of a signature. The director's autograph, scanned and printed on the certificate. It tells the reader who stands behind the document, as a handwritten signature does on paper. It establishes nothing about the file: the image can be copied onto any other document.
• A cryptographic signature. A value computed from the certificate's exact contents with a private key held only by the issuer. Any holder of the issuer's public key can check it. If a single character of the certificate changes, the check fails.

A professional certificate usually carries both: the autograph for the human reader and the cryptographic signature for verification.

What a cryptographic signature establishes

A valid cryptographic signature establishes two facts: the document was signed with the key that belongs to the issuer, and it has not changed since. It does not establish whether the issuer is a genuine, recognised institution, which is why verifying a diploma still begins with the institution. Nor does it establish whether the certificate remains valid: a certificate may carry a correct signature and have been withdrawn since. That is the purpose of a revocation check.

What the law says about electronic signatures

Most legal systems recognise electronic signatures, with different levels of legal effect.

European Union: eIDAS

The eIDAS Regulation (EU) No 910/2014 defines three levels. An electronic signature is data in electronic form attached to or logically associated with other data and used by the signatory to sign. An advanced electronic signature must, under Article 26, be uniquely linked to the signatory, be capable of identifying the signatory, be created using signature creation data the signatory can use under their sole control, and be linked to the signed data so that any subsequent change is detectable. A qualified electronic signature is an advanced signature created with a qualified signature creation device and based on a qualified certificate.

Article 25 sets the legal effect: an electronic signature cannot be denied legal effect or admissibility as evidence solely because it is electronic or not qualified, and a qualified electronic signature has the equivalent legal effect of a handwritten signature. The regulation was amended in 2024 by Regulation (EU) 2024/1183, which establishes the European Digital Identity Framework.

United States: ESIGN

The federal ESIGN Act of 2000 provides that, for transactions in or affecting interstate or foreign commerce, a signature, contract or other record may not be denied legal effect, validity or enforceability solely because it is in electronic form (15 U.S.C. § 7001).

Latin America

• Mexico: under the Ley de Firma Electrónica Avanzada, published in 2012, documents signed with an advanced electronic signature produce the same effects as those with a handwritten signature (article 7).
• Colombia: Ley 527 of 1999 regulates data messages, electronic commerce and digital signatures. Under article 7, a legal requirement for a signature is met by a method that identifies the originator, shows their approval of the content, and is reliable and appropriate.
• Honduras: the Ley sobre Firmas Electrónicas (Decreto 149-2013) gives electronic signatures the same validity and legal effect as a handwritten signature, provided the law's requirements are met.

Internationally, the UNCITRAL Model Law on Electronic Signatures of 2001 set out criteria of technical reliability for treating electronic and handwritten signatures as equivalent, and many national laws draw on it.

Where certificates fit

Most education certificates are not contracts, and most jurisdictions do not require a qualified signature on them. What a relying party needs is assurance that the certificate originates from the institution and has not been altered, which is precisely what a cryptographic signature provides. Where a regulator or a receiving institution requires a particular level, such as a qualified signature under eIDAS, the requirement derives from the rules of that procedure, not from the signature itself. These rules should be reviewed before issuing.

Why Ed25519

Ed25519 is an instance of the Edwards-curve Digital Signature Algorithm (EdDSA), specified in RFC 8032 (2017). In 2023, the US National Institute of Standards and Technology approved EdDSA, including Ed25519, in its Digital Signature Standard, FIPS 186-5. Its signatures are compact, fast to verify and deterministic: the same key and the same document always produce the same signature.

How Emitcert signs a certificate

Emitcert signs the wording of every certificate at the moment it is granted, with the issuing institution's own Ed25519 key. The issuer's public key is published, so a relying party can check a certificate without depending on the page that displays it. The same certificate is also available as an Open Badges 3.0 credential with a W3C Data Integrity proof (the eddsa-jcs-2022 cryptosuite), which credential wallets and other software can verify independently. Our comparison of PDF certificates and verifiable credentials explains what that format adds.