---
title: "AD-RT signature lifecycle"
description: "Lifecycle of an ICP-Brasil AD-RT signature, how long it stays verifiable, and how PKI SDK extends it with the AD-RC and AD-RA policies."
canonical: "https://docs.lacunasoftware.com/en-us/articles/pki-sdk/signatures/policies/adrt-lifecycle"
locale: "en"
product: "PKI SDK"
last_updated: "2026-10-11"
---

# AD-RT signature lifecycle

An ICP-Brasil **AD-RT** signature (*Referência de Tempo*) is a basic signature (AD-RB) plus a **signature timestamp**, issued by an
ICP-Brasil timestamp authority (*ACT*). The timestamp proves when the signature was made, so the signature outlives the signer's
certificate. It does not outlive the certificate of the timestamp authority, though. This article shows how long an AD-RT signature
remains verifiable, and how the PKI SDK keeps it verifiable for longer, with the AD-RC and AD-RA policies.

![The lifecycle of an AD-RT signature: the ICP-Brasil policies and the validity of each certificate and timestamp](https://docs.lacunasoftware.com/images/pki-sdk/adrt-lifecycle.svg)

For a real case, with signatures that must last decades, see [Diploma revalidation](https://docs.lacunasoftware.com/en-us/articles/digiploma/revalidation), which shows how
[Digiploma](https://docs.lacunasoftware.com/en-us/articles/digiploma) keeps digital diplomas verifiable.

## Create an AD-RT signature

The AD-RT policy requires a signature timestamp, so the signer needs a timestamp requester. The example below signs an element of an XML
document (XAdES):

```cs
var signer = new XmlElementSigner();
signer.SetSigningCertificate(cert);       // the signer's certificate, with its private key
signer.SetXml(xmlDocument);
signer.SetToSignElementId(id);
signer.SetPolicy(XmlPoliciesForGeneration.GetPkiBrazilAdrTempo());

// ICP-Brasil timestamp authority (ACT)
var tsaUri = new Uri("https://tsa.example.com/");
signer.SetTimestampRequester(new TimestampRequester(tsaUri, accessToken));

signer.ComputeSignature();                // throws TimestampException if the timestamp cannot be obtained
var signedXml = signer.GetSignedXml();
```

The same policy exists for the other formats: `CadesPoliciesForGeneration.GetPkiBrazilAdrTempo()` (CAdES) and
`PadesPoliciesForGeneration.GetPkiBrazilAdrTempo()` (PAdES).

## How long it remains verifiable

| Period | Verifiable? | Why |
|---|---|---|
| While the signer's certificate is valid | Yes | Like any signature. |
| After the signer's certificate expires | Yes | The signature timestamp proves that the signature was made while the certificate was valid. |
| After the timestamp authority's certificate expires | No | The signature timestamp itself can no longer be verified. |

An AD-RT signature also does not store the certificates and revocation lists (LCRs) used to validate it: validating it later depends on
getting them from the repositories of the certificate authorities.

To know until when an AD-RT signature can be verified, read the certificate of its signature timestamp:

```cs
var signature = XmlSignatureEditor.Open(signedXml).Signatures.First();
var timestamp = signature.SignatureTimestamps.Last().EncapsulatedTimestamp;
var verifiableUntil = timestamp.Signers.First().SigningCertificate.ValidityEnd;
```

## Keep it verifiable

Each ICP-Brasil policy adds evidence to the previous one:

* **AD-RC** (*Referências Completas*, `XmlPoliciesForGeneration.GetPkiBrazilAdrCompleta()`) adds the references to, and the values of,
  the certificates and LCRs used to validate the signature, and a timestamp over the signature and these references. It no longer depends on the repositories of the
  certificate authorities, but its timestamps still expire.
* **AD-RA** (*Referências para Arquivamento*, `XmlPoliciesForGeneration.GetPkiBrazilAdrArquivamento()`) adds an **archive timestamp**.
  Before it expires, a new archive timestamp, issued under a newer certificate of the timestamp authority, is added over everything.
  Renewed in time, the signature remains verifiable indefinitely.

`XmlSignatureEditor.ExtendArchiving` adds that new archive timestamp. It first records the validation data of the previous archive
timestamp, then timestamps the signature again:

```cs
var editor = XmlSignatureEditor.Open(signedXml);
var signature = editor.Signatures.First(s => s.ArchiveTimestamps.Any());

var expiresOn = signature.ArchiveTimestamps.Last().EncapsulatedTimestamp.Signers.First().SigningCertificate.ValidityEnd;
if (expiresOn < DateTimeOffset.Now.AddDays(180)) {
    var renewedXml = editor.ExtendArchiving(signature, timestampRequester, XmlPoliciesForValidation.GetPkiBrazil());
    // Store renewedXml in place of the previous file
}
```

`ExtendArchiving` throws `InvalidArchiveOperationException` when:

* the signature is not valid;
* none of its archive timestamps can be validated;
* the new timestamp is signed by the same certificate as a previous archive timestamp, which would not extend the expiration. Pass
  `ignoreSameTsSigner: true` to accept it anyway.

> **Caution: AD-RT and AD-RC signatures cannot be extended**
>
> `ExtendArchiving` requires a policy with an archive timestamp: on an AD-RT or AD-RC signature it fails. To preserve these signatures,
> protect them with an AD-RA signature over the whole document, which covers them, and renew its archive timestamp. This is how a digital
> diploma works: the signatures of its `DadosDiploma` and `DadosRegistro` elements are covered by the archiving signature of the whole XML.

## See also

* [Diploma revalidation](https://docs.lacunasoftware.com/en-us/articles/digiploma/revalidation) (Digiploma)
* [PKI Brazil policies (ICP-Brasil)](https://docs.lacunasoftware.com/en-us/articles/pki-sdk/signatures/policies/pki-brazil)
* [XmlSignatureEditor](https://docs.lacunasoftware.com/en-us/api/Lacuna.Pki.Xml/XmlSignatureEditor)
* [XmlPoliciesForGeneration](https://docs.lacunasoftware.com/en-us/api/Lacuna.Pki.Xml/XmlPoliciesForGeneration)