How PL/PDF signing works

1. Generate the PDF. PL/PDF creates the document and reserves the PDF signature contents area.
2. Create the PDF ByteRange. PL/PDF identifies the exact document bytes covered by the signature.
3. Build the signature in PL/SQL. PLPDF_DIGSIG calculates the SHA-256 digest and builds the CMS signed attributes required by the selected profile.
4. Sign with the RSA private key. Oracle DBMS_CRYPTO performs the RSA/SHA-256 cryptographic signing operation.
5. Optionally obtain an RFC 3161 timestamp. PAdES-B-T can call a TSA directly or delegate timestamp acquisition to an installed PL/SQL procedure.
6. Return the signed PDF. PL/PDF writes the CMS signature into the reserved PDF area and returns the final signed document as a BLOB.

The private key is not written into the PDF. The PDF signature contains the signer certificate, signed attributes and the cryptographic signature value.

A PAdES-B-B signature in PL/SQL

The signing profile, signer certificate and private key are configured before PL/PDF finalizes the document. A minimal PAdES-B-B configuration follows the same PL/SQL workflow as normal PL/PDF document generation.

plpdf_digsig.setProfile(
  plpdf_digsig.c_profile_pades_bb
);

plpdf_digsig.setDERStore(l_der);
plpdf_digsig.setPEMStore(l_pem);

plpdf.setDigSig(
  p_access_perms => 2,
  p_Name         => 'PLPDF',
  p_Location     => 'Budapest',
  p_Reason       => 'Document approval',
  p_ContactInfo  => ''
);

plpdf.SendDoc(l_blob);

For PAdES-B-T, select the PAdES-B-T profile and configure either the native RFC 3161 timestamp server or a registered timestamp procedure before PLPDF.SendDoc.

Validation and certificate trust

PL/PDF PAdES-B-B output has been validated with Adobe Acrobat Reader, Foxit Reader, the ETSI Signature Conformance Checker and the European Commission Digital Signature Service (DSS). DSS identifies the generated PAdES-B-B signature as PAdES-BASELINE-B.

Signature format and certificate trust are separate concerns. A self-signed certificate can be cryptographically valid while still appearing untrusted to a PDF viewer. Production deployments should use a signing certificate and trust configuration appropriate to the organization’s requirements.

PAdES is a technical signature format. Whether a particular signature satisfies advanced, qualified or other legal-signature requirements depends on the certificate, signing environment, trust service and applicable regulatory requirements.

Part of the PL/PDF document platform

Digital signatures are available as part of PL/PDF’s broader Oracle document-generation capabilities. Combine signing with accessible PDF output, document encryption, PDF/A, Office generation and template-driven reporting.