Signature types
When the instance has signature types turned on, whoever creates a document picks one of these types: Simple, Advanced or Qualified. The type sets how participants can sign and how Signer validates the signatures.
The instance's SignatureTypes setting turns the types on and sets the screen default. See
Signature Types settings.
What each type produces
| Type | How the participant signs | What the file gets | What validation accepts |
|---|---|---|---|
| Simple | Electronic signature only. | One platform signature, added when the document is concluded. | Simple electronic signatures. It also accepts advanced ones if Simple.AllowAdvancedElectronicSignatures is on. |
| Advanced | With the means the security context allows. The context is required and sets the accepted authentications and the trusted certificates. | One signature per signer. | What the security context accepts. It accepts simple electronic signatures only if Advanced.AllowSimpleElectronicSignatures is on. |
| Qualified | Digital certificate only. Electronic signature is off. | One signature per signer. | Digital certificates only. By default, only ICP-Brasil certificates. |
For an electronic signature, Signer signs the file with a certificate of the platform itself. By default, that certificate is self-signed, that is, no Certificate Authority issued it.
ITI validator
The ITI (gov.br) signature validator accepts a qualified signature made with the signer's own ICP-Brasil certificate. You do not need to set anything up.
The validator rejects electronic signatures of the Simple and Advanced types, because the platform certificate is
self-signed. For the validator to accept them, the instance must sign with an ICP-Brasil certificate, such as the
company's e-CNPJ A1. From version 1.52.0, the instance uses the PFX file in the certificates folder of its
Blob Storage. The SignatureCertificate section
names the file and its password, and the ElectronicSignature:UseSignatureCertificateAsSelfSignedCertificate
setting makes Signer use that certificate instead of the self-signed one.
The validator shows the name in the certificate. With an e-CNPJ, it shows the company name.
If you use Signer in the cloud (SaaS), send the PFX and its password to Lacuna support through a secure channel. Support sets it up.
Document created through the API without a type
If the creation request does not send the signatureType field, the document has no type (None). Signer
does not use the screen default (SignatureTypes:DefaultType), because that setting applies to the screen only.
A document without a type follows the rules of none of the three types. Each participant signs with the means the request gave, and Signer does not restrict the authentication or the certificate.
To get a type, send signatureType on creation. For the Advanced type, also send securityContextId. A document
created from a template gets the template's type. See
Creating documents.
A PDF that arrives already signed
Signer adds new signatures without rewriting the file. So signatures made outside Signer stay valid, in any type.
There are some exceptions and limits:
- An envelope joins several PDFs into one. When joining them, Signer removes the signatures the PDFs already had, because they would no longer be valid.
- Conversion to PDF/A also removes existing signatures.
- On a signed PDF, Signer does not apply the validation stamp. Initials and other placed marks may also be missing.
- With the Qualified type, an external signature made with a certificate from outside ICP-Brasil shows as invalid in Signer's validation. The file does not change.
If the external signatures must stay in the file, do not send the PDF inside an envelope.