Validate digital signatures

Use this journey to accept a signed PDF only when the right people signed it with a valid ICP-Brasil certificate: register who may sign in a signer profile, then check documents with the Signature validation phase.

Who may do it:

Procedure	Profile
Create, edit and delete signer profiles	Administrator only. Other profiles that see Signer profiles can only read it.
Add the Signature validation phase to a workflow and publish it	Administrator or technical

Not available yet

The Signer profiles screen and the Signature validation phase are in the Workflow interface, but the Workflow service that stores the profiles, tests a document and runs the phase has not been released (XTRAK-2326). Until it is:

• Signer profiles cannot load or save profiles;
• the Test tab cannot validate a document;
• a published workflow that reaches a Signature validation phase fails at that phase.

Do not publish a workflow with this phase until this notice is removed. This chapter describes the interface so that it is ready on release; it will be reviewed against the released service.

Before you start

• You know the CPF or CNPJ of each person or company allowed to sign. Signers are matched by the CPF or CNPJ in their ICP-Brasil certificate, never by name.
• A sample signed PDF helps: the profile can read its signers for you, and the phase can test against it.

Register who may sign

1. Go to Administration › Signer profiles. The list shows each profile's Name, Signers and Usage (in how many workflows it is used).

2. Select New profile.

3. Fill in Profile name and, optionally, Description.

4. Add each signer with Add signer:

   Field	What to enter
   Identifier type	CPF (person) or CNPJ (company)
   CPF or CNPJ	The identifier. Check digits are verified; a sequence of repeated digits is refused.
   Name (for reference only)	A name to recognise the signer. It is not used for matching.
   Role	Required or Optional
   Certificate type	Any type, A1 or A3
   Allowed issuing authorities	Leave empty to accept any trusted ICP-Brasil authority.

   Or select Learn from a document (PDF): the ICP-Brasil signers found in the document are added as Required, with their issuer filled in. Review the role of each one.

5. Select Save profile.

Identifiers are write-only: once saved, a CPF or CNPJ is only ever shown masked. To change one, use Replace and type the new value.

Check signatures in a workflow

1. In the workflow editor, add Signature validation after the phase that produces the signed PDF.

2. In Signers, choose the Signer profile. Manage profiles opens Signer profiles.

3. Choose the Rule over the signatures:

   Rule	Passes when
   Any listed signer	At least one valid signature comes from a signer of the profile.
   All required signers	Every signer marked Required signed.
   N of M	At least Minimum number of signers different signers of the profile signed.

4. Connect both outputs: OK continues the flow; NOK handles a rejected document (for example a Manual Review or a Send that notifies). Publishing is refused while either output is unconnected.

5. Optional: in Test, choose a PDF document and select Validate document. The result is shown as a report and nothing is recorded in any run.

6. Save and publish.

The panel warns while the rule cannot work: no profile chosen, an empty profile, a minimum below one or above the number of signers, or All required signers on a profile with no required signer.

Read the result

The report — in the Test tab and in the run's phase detail — shows Result (OK or NOK), the reasons, and one line per signature: Signer (with its issuer), masked Identifier, Signed at (Trusted timestamp or Declared time, not proven) and Status (Valid, Invalid or Indeterminate).

Reason	Meaning
The document has no signature	—
The signature is not valid	The signature does not verify.
The document was modified after signing	The content changed after the signature.
The certificate is not from a trusted authority	Not an ICP-Brasil trusted chain, or not one of the allowed authorities.
The certificate had expired at signing time	—
The certificate was revoked	—
The signer is not in the profile	A signature comes from someone not listed.
A required signer did not sign	Under All required signers.
Revocation could not be checked	The result is Indeterminate.

Delete a profile

Select Delete and confirm Delete this profile?. A profile used by a published workflow cannot be deleted: the screen lists the workflows that use it. Change or unpublish them first.

If something goes wrong

What you see	What to do
This CPF or CNPJ is not valid: the check digits do not match.	Correct the identifier.
No ICP-Brasil signature with a CPF or CNPJ was found in the document.	Add the signers by hand.
Too many tests in a short time.	Wait a moment and test again.
Publish refused: Signature validation "…": the OK output is not connected. (or NOK)	Connect both outputs.
Publish refused: choose an existing signer profile, the signer profile has no signers, or the rule does not fit the signer profile	Fix the phase's profile or rule.
New profile is missing	Your profile is not administrator.

Not observed yet

Everything in this chapter: the service is not released (see the notice above).

---

Last reviewed 2026-10-09 · Version 1.0.0 · Owner: product-documentation