Digital signatures on certificates: what they prove and what makes them valid

Two things called a signature

On a certificate, the word signature covers two different things:

• The picture of a signature. The director's autograph, scanned and printed on the certificate. It tells the reader who stands behind the document, the way a handwritten signature does on paper. It proves nothing about the file: anyone can copy the image onto another document.
• A cryptographic signature. A value computed from the certificate's exact contents with a private key only the issuer holds. Anyone with the issuer's public key can check it. If a single character of the certificate changes, the check fails.

A professional certificate usually carries both: the autograph for the human reader, the cryptographic signature for the check.

What a cryptographic signature proves

A valid cryptographic signature answers two questions at once. The document was signed with the key that belongs to the issuer, and it has not changed since. It does not say whether the issuer is a real, recognised institution, which is why verifying a diploma still starts with the institution. It also does not say whether the certificate is still valid: a certificate can carry a perfect signature and have been withdrawn since. That is what a revocation check is for.

What the law says about electronic signatures

Most legal systems accept electronic signatures, with different levels of strength.

European Union: eIDAS

The eIDAS Regulation (EU) No 910/2014 defines three levels. An electronic signature is data in electronic form attached to or logically associated with other data and used by the signatory to sign. An advanced electronic signature must, under Article 26, be uniquely linked to the signatory, be capable of identifying the signatory, be created using signature creation data the signatory can use under their sole control, and be linked to the signed data so that any subsequent change is detectable. A qualified electronic signature is an advanced signature created with a qualified signature creation device and based on a qualified certificate.

Article 25 sets the legal effect: an electronic signature cannot be denied legal effect or admissibility as evidence solely because it is electronic or not qualified, and a qualified electronic signature has the equivalent legal effect of a handwritten signature. The regulation was amended in 2024 by Regulation (EU) 2024/1183, which establishes the European Digital Identity Framework.

United States: ESIGN

The federal ESIGN Act of 2000 provides that, for transactions in or affecting interstate or foreign commerce, a signature, contract or other record may not be denied legal effect, validity or enforceability solely because it is in electronic form (15 U.S.C. § 7001).

Latin America

• Mexico: under the Ley de Firma Electrónica Avanzada, published in 2012, documents signed with an advanced electronic signature produce the same effects as those with a handwritten signature (article 7).
• Colombia: Ley 527 of 1999 regulates data messages, electronic commerce and digital signatures. Under article 7, a legal requirement for a signature is met by a method that identifies the originator, shows their approval of the content, and is reliable and appropriate.
• Honduras: the Ley sobre Firmas Electrónicas (Decreto 149-2013) gives electronic signatures the same validity and legal effect as a handwritten signature, provided the law's requirements are met.

Internationally, the UNCITRAL Model Law on Electronic Signatures of 2001 set out criteria of technical reliability for treating electronic and handwritten signatures as equivalent, and many national laws draw on it.

Where certificates fit

Most education certificates are not contracts, and most jurisdictions do not require a qualified signature on them. What a reader needs is assurance that the certificate came from the institution and has not been altered: exactly what a cryptographic signature provides. When a regulator or a receiving institution requires a particular level, such as a qualified signature under eIDAS, that requirement comes from the rules of the procedure, not from the signature itself. Check them before issuing.

Why Ed25519

Ed25519 is an instance of the Edwards-curve Digital Signature Algorithm (EdDSA), specified in RFC 8032 (2017). In 2023, the US National Institute of Standards and Technology approved EdDSA, including Ed25519, in its Digital Signature Standard, FIPS 186-5. Its signatures are short and fast to verify, and deterministic: the same key and the same document always produce the same signature.

How Emitcert signs a certificate

Emitcert signs the words of every certificate at the moment it is granted with the issuing institution's own Ed25519 key. The issuer's public key is published, so anyone can check a certificate without trusting the page that shows it. The same certificate is also available as an Open Badges 3.0 credential with a W3C Data Integrity proof (the eddsa-jcs-2022 cryptosuite), which credential wallets and other software can verify on their own. Our comparison of PDF certificates and verifiable credentials explains what that format adds.