Glossary
What is PKI?
Short answer
PKI, or public key infrastructure, is what lets a computer trust a digital signature from someone it has never met. A certificate authority checks an identity and issues a certificate binding it to a public key; software trusts that certificate because it chains back to a root certificate it already trusts. The same system secures HTTPS websites, signed PDFs and the timestamp on every Sign PDF seal.
Updated 25 October 2026
- PKI (public key infrastructure)
- Public key infrastructure (PKI) is the set of roles, policies and technology used to create, issue, manage and revoke digital certificates, which bind public keys to named people, organisations or services so their digital signatures can be trusted.
The parts of a PKI
A working PKI has several pieces:
- Key pairs: a private key kept secret and a public key shared freely
- Certificates: X.509 documents (profiled in RFC 5280) that bind a public key to a name, signed by an issuer
- Certificate authorities (CAs): organisations that verify identities and sign certificates
- Root and intermediate certificates: a chain from the trusted root down to the end certificate
- Revocation: lists (CRLs) and live checks (OCSP) that show if a certificate has been withdrawn
How trust flows
Your operating system, browser and PDF reader ship with a store of trusted root certificates. Adobe maintains its own lists, the Adobe Approved Trust List, and imports the EU trusted lists. When software checks a signature, it follows the certificate chain up to a root. If the chain ends at a trusted root and nothing is revoked or expired, the signer's identity is shown as trusted.
If the chain ends somewhere else, the integrity check still works, but the reader may say the identity is unknown.
PKI and e-signature laws
eIDAS qualified signatures are built on PKI: a qualified certificate from a qualified trust service provider, listed on a member state's trusted list. Advanced signatures usually use PKI too. The US ESIGN Act and UETA are technology neutral and do not require PKI.
How Sign PDF uses PKI
Sign PDF uses PKI for the seal, not for each signer. The finished PDF is signed with a certificate held by Sign PDF, and the timestamp comes from DigiCert's timestamp authority, which signs each token with its own certificate. Signers do not need certificates or keys; they are verified by email code. That is why our signatures are simple electronic signatures, not advanced or qualified ones.
Questions people ask
Do I need my own certificate to sign documents?
For everyday e-signatures, no. You need one only for advanced or qualified signatures, or if an organisation requires certificate-based signing.
What is a certificate authority?
An organisation trusted to verify identities and issue digital certificates. DigiCert, Sectigo and GlobalSign are well-known examples.
What happens when a certificate expires?
New signatures cannot be made with it. Signatures made before expiry can still be validated, especially if they carry a trusted timestamp.
Is PKI the same as encryption?
PKI uses the same mathematics, but it is about managing keys and trust. It supports both encryption and digital signatures.
Upload a document and watch the boxes land
See every signature, initial and date box placed before you sign up. Sending starts at $5 a month, monthly, cancel any time.
Upload a document