# Verify a signed document

> What Korala's signature and timestamps in a completed PDF mean, and how to check them in Adobe Acrobat or the EU DSS validator

Source: https://docs.korala.ai/guides/signature-verification

---

When a document completes, Korala seals the final PDF with its platform
signature and timestamps. The PDF carries everything a validator needs, so
anyone who receives the file can check it without a Korala account.

## What a completed PDF contains

| Part | What it is |
|------|------------|
| **Platform signature** | A PAdES baseline signature (ETSI EN 319 142-1), made with Korala's platform certificate, *Korala Document Signing Service 2026*. It covers the whole document as completed, including the stamped signatures and field values. |
| **Signature timestamp** | An RFC 3161 timestamp over the platform signature, from an EU-qualified trust service provider (*Sectigo Qualified Time Stamping*). It proves the signature existed at that moment. |
| **Validation data** | The certificates and revocation data (CRL/OCSP) needed to validate both signature and timestamp, embedded in the PDF's document security store. The PDF stays verifiable after certificates expire. |
| **Archive timestamp** | A second qualified timestamp over everything above: PAdES level **B-LTA**. |

Korala signs and timestamps the Certificate of Completion the same way. The
certificate records each signer, the audit trail and the SHA-256 hash of the
signed document. See [Audit trail and certificates](https://docs.korala.ai/guides/audit-trail).

The platform signature is Korala's seal on the document. eIDAS does not count
it as a qualified or advanced electronic signature of the individual signers.
The **timestamps** do qualify: the EU Trusted Lists name their provider as a
qualified timestamping service.

## Check it in Adobe Acrobat

Open the PDF and choose **View → Show/Hide → Side Panels → Signatures**. You
see two entries:

- **Signed by Korala Document Signing Service 2026**: "Document has not been
  modified since this signature was applied" and "The signature includes an
  embedded timestamp". Acrobat marks the signer's identity as unknown because
  Adobe's trust list does not include Korala's root certificate. The first
  line is the integrity result.
- **Signed by Sectigo Qualified Time Stamping Signer**: valid, with its source
  of trust "obtained from EU Trusted Lists", and "Signature is LTV enabled".

If anyone changes the file after completion, Acrobat reports the document as
altered or corrupted.

## Check it with the EU DSS validator

The European Commission's
[DSS demonstration validator](https://ec.europa.eu/digital-building-blocks/DSS/webapp-demo/validation)
checks signatures against the EU Trusted Lists. It rates a completed Korala
PDF **PAdES-BASELINE-LTA** and both timestamps **QTSA** (qualified). For the
platform signature itself it reports the qualification as "not applicable":
Korala, not an EU qualified provider, issued that certificate.

The demo validator is a public web service. Upload documents you may share
with it, or run the open-source DSS library yourself.

## Korala's certificates

**Korala Root CA 2026**: [download](https://korala.ai/pki/korala-root-ca-2026.crt).
SHA-256 fingerprint:

```text
fa9bd8c0d32fde45f9b8c526d4275e5ca15f3f39d9a7a5c391dc30201af2a1e9
```

**Korala Document Signing Service 2026**, the platform certificate it issues.
SHA-256 fingerprint:

```text
3facd9bc00bd4f73bbdc6e3ded8109eadc32eb56409910c992d38212f2a753f1
```

Tools print the same value with colons and upper case
(`openssl x509 -noout -fingerprint -sha256 -inform DER -in korala-root-ca-2026.crt`).
The root's certificate revocation list is at
`https://korala.ai/pki/korala-root-ca-2026.crl`. If your organization wants
Acrobat to recognize Korala as a signer, compare the downloaded root's
fingerprint with the one above, then add it under Acrobat's trusted
certificates.

## Older and test documents

- Documents completed **before 24 September 2026** carry an Adobe-style
  PKCS#7 signature and an RFC 3161 timestamp from DigiCert, and they remain
  valid. Acrobat's Signatures panel and the Certificate of Completion tell you
  which format a file uses.
- Korala signs **test (sandbox) documents** with a sandbox certificate and no
  timestamp. They exist for testing, and nothing in them proves when a
  document was signed.