Signature validation
This chapter was written from the product's source code and has not yet been checked by a person on a running Cogneris. If what you see on screen differs, the screen is right — please tell your Cogneris contact so the chapter can be corrected.
Verifies the digital (ICP-Brasil) signatures already present in the process's PDF documents against a signer profile and a rule, and sends the process down OK or NOK.
| Palette | Nodes › Signature validation |
| Outputs | OK — every checked document satisfies the rule. NOK — at least one does not. Both must be connected before the workflow can be published. A technical failure takes neither: the run fails. |
| Content status | From source; not observed (workflow-fe f88c5c1, workflow-be 6703373, 2026-10-22) |
When to use it
When a process receives PDFs that must already be signed by specific people or companies — identified by the CPF or CNPJ in their certificate — and you must route on whether they are. Register who may sign first, in a signer profile: see Validate digital signatures.
To collect a new signature from the customer, use Signature instead.
What happens in a run
Which documents. Every PDF the process received that did not fail in an earlier phase. Documents the run produced itself (for example a generated document) are not checked. Each checked document must satisfy the rule on its own.
How each document is judged.
-
Every signature in the document is verified: integrity, a trusted certificate chain, the certificate valid at signing time, and not revoked.
-
Each signature is matched to the profile by the CPF or CNPJ of the certificate's subject — never by name. When a signer of the profile lists allowed issuing authorities, the certificate's issuer must be one of them.
-
The document is OK only when:
- it has at least one signature;
- every signature is valid and belongs to a signer of the profile — a single signature by someone outside the profile makes the document NOK, whatever the rule;
- the rule is met:
Rule Met when Any listed signer At least one signer of the profile signed validly. All required signers Every signer marked required in the profile signed validly. N of M At least Minimum number of signers different signers of the profile signed validly. -
The process takes OK when every checked document is OK, and NOK otherwise — including when there is no PDF to check (
no_signature).
Reasons. A NOK carries the reasons of every document:
| Reason | Shown as |
|---|---|
no_signature | The document has no signature |
invalid_signature | The signature is not valid |
document_modified | The document was modified after signing |
certificate_untrusted | The certificate is not from a trusted authority |
certificate_expired_at_signing | The certificate had expired at signing time |
certificate_revoked | The certificate was revoked |
signer_not_allowed | The signer is not in the profile |
required_signer_missing | A required signer did not sign (rules All required signers and N of M) |
indeterminate | Revocation could not be checked |
When revocation cannot be checked. If the only thing standing between a document and OK is a revocation service that did not answer, the phase does not decide yet: it is run again after 30 seconds, 2 minutes, 8 minutes, 30 minutes and 30 minutes (5 retries by default). If the answer is still missing after the last one, the process takes NOK with indeterminate. A revoked certificate is a verdict and takes NOK immediately.
Technical failures fail the run — they never become a NOK: the profile is missing or empty, the rule does not fit the profile, the signature verifier or its trusted authorities are unavailable, the signers' identifiers cannot be decrypted, or a document is unreadable, encrypted or too large. A document that cannot be read from storage is retried.
Outputs. A signatureValidation block in the run's data, keyed by the phase's node, so several Signature validation phases keep their own results: ok, the rule, the profile, one entry per signature (signer, masked identifier, issuer, signing time, whether the time is a trusted timestamp, status Valid, Invalid or Indeterminate, reasons, revocation check), one entry per document, the reasons, the trust-store version and the duration. A JSON validation report is also filed in the Document Center beside the case (reportRef); if that fails, the run continues and reportError says why. Identifiers appear only masked.
Configuration
The panel has two tabs, Signers and Test.
Signers
| Field | What it does | Required | Format / values | Default | Validation messages |
|---|---|---|---|---|---|
| Description | Name shown on the node. | No | Text | Signature validation | — |
| Signer profile | The company's list of allowed signers to match against. Each option reads … (… signers). Signers are registered per tenant, in a profile. Manage profiles opens Signer profiles. Once chosen, the panel shows … signers in the profile, … of them required. | Yes | One of your signer profiles | Choose a profile (none) | Choose a signer profile. · The selected profile has no signers. · Could not load the signer profiles. |
| Rule over the signatures | Which signatures make a document OK. | Yes | Any listed signer (At least one valid signature from a signer in the profile.), All required signers (Every signer marked as required must have signed.), N of M (At least N different signers from the profile must have signed.) | Any listed signer | The profile has no required signer, so this rule can never pass. |
| Minimum number of signers (out of …) | N, for N of M. Shown only for that rule. | Yes, for N of M | Whole number from 1 to the number of signers in the profile | 1 when you choose N of M | The minimum must be at least one signer. · The minimum cannot exceed the … signers in the profile. |
Below the fields: Connect both outputs: OK continues the flow and NOK handles a rejected document. Publishing is refused while either one is unconnected.
The phase stores only the profile reference and the rule; the signers themselves stay in the profile, so editing the profile changes what every workflow using it accepts.
Test
Check a sample PDF against this profile and rule. Nothing is recorded in any run.
| Field | What it does | Required | Format / values | Default | Validation messages |
|---|---|---|---|---|---|
| PDF document | The sample document to check. | Yes | A PDF file | None | Choose a signer profile first. (no profile chosen yet) |
The result is the Signature validation report: Result, the reasons, and one line per signature with Signer (Issued by …), Identifier, Signed at (Trusted timestamp or Declared time, not proven) and Status. With no signature: No signature was found in the document. When the report was filed: Stored validation report.
Buttons and actions
| Button | What happens | Reversible? |
|---|---|---|
| Manage profiles | Opens Signer profiles. | Yes |
| Validate document | Runs the chosen PDF through the same check a run makes (Validating…) and shows the report. Enabled once a PDF and a profile are chosen. Nothing is recorded in any run. | Yes |
Common problems
| Message | Cause | What to do |
|---|---|---|
| Signature validation “…”: the … output is not connected. (publish) | OK or NOK leads nowhere. | Connect both outputs. |
| Signature validation “…”: choose an existing signer profile. (publish) | No profile, or the profile no longer exists. | Choose a profile. |
| Signature validation “…”: the signer profile has no signers. (publish) | The profile is empty. | Add signers to the profile. |
| Signature validation “…”: the rule does not fit the signer profile. (publish) | N of M with N out of range, or All required signers on a profile with no required signer. | Fix the rule or the profile. |
| The document could not be validated. (test) | The test failed. | Check the file is a readable PDF; try again. |
| Too many tests in a short time. Wait a moment and try again. (test) | Too many tests (10 per minute by default). | Wait and test again. |
| A process takes NOK with The signer is not in the profile | A document carries a signature by someone outside the profile — every signature must belong to the profile. | Add that signer to the profile, if they are allowed. |
| Processes take NOK with Revocation could not be checked | The revocation service did not answer during all retries. | Restart the process later. |
Related
- Validate digital signatures — signer profiles step by step.
- Signature — collect a signature from the customer.
- Manual Review — a manual review never approves on its own after a signature validation.
- Design and publish a workflow
Last reviewed 2026-10-22 · Version 1.0.0 · Owner: product-documentation