Signing a PDF with your eID

In chapter 7.1 you signed a little sentence about the washing-up. You made the key pair for it on the spot in your browser, and when you closed the tab it was gone — it had never existed anywhere else. Here you do exactly the same thing, but with a key you didn't make and can't copy, because it sits in a piece of plastic in your wallet. And you're not signing a little sentence but a real document. What comes out is, in the eyes of the law, your signature.

What happens when you click "sign"

1. The whole PDF file is hashed (chapter 2). A three-megabyte document comes down to a single number of 32 bytes. Change one comma in it and that number is completely different.
2. Only that hash goes to the chip in your card. The document itself does not: the chip has neither the room nor the computing power for it, and it doesn't need to see it either.
3. You enter your PIN. The chip signs the hash with the sign key — the private half of a key pair (chapter 6) that never leaves the chip, as you saw in chapter 8.2. What comes out is only the signature.
4. That signature goes into the PDF file, together with your signing certificate and the certificates above it, all the way up to the Belgian State — the chain from chapter 7.2. Without that chain a reader knows that something was signed, but not by whom.
5. A timestamp is fetched and enclosed with it, so that later on it's established when you signed, even if your certificate has expired in the meantime.

PAdES: the signature sits inside the document

A scanned scribble at the bottom of a page is a picture. It sits next to the text and knows nothing about the text. Someone can cut it out from underneath and paste it under another document, or change the amount above it, and there's nothing to see on the picture. So it only proves that a signature once existed somewhere.

A PAdES signature isn't a picture but a calculation over the bytes of the file. It's stored inside the PDF file itself, in a fixed place every PDF reader knows, along with which part of the file has been signed. Change one character in there and the hash from step 1 no longer matches, so the seal no longer matches, and every reader says so. There's no "nearly right" — exactly as in the demo in chapter 7.1.

PAdES isn't a separate invention for PDF. Underneath it sits CMS, the same packaging format for signed data that also lies under signed email, in the ETSI version called CAdES. PAdES is the agreement on how you get such a package neatly into a PDF file.

auth or sign: here it's sign

Your card has two keys, and the difference is not a technical detail. auth says "this is me" — that's a login attempt, and you can simply do it again tomorrow or not do it. sign says "I agree with what's written above". Signing a document is the second one, and so this service uses sign.

Never sign anything you haven't read. This is the most important sentence in this chapter. The chip doesn't read your document, doesn't check whether it's reasonable and doesn't warn you about anything; it works out a seal over the bytes it's given. That seal is legally just as valid as your signature with a pen, and you can't deny it afterwards and can't take it back. Whoever asks for your PIN for sign is asking for your signature — not your password.

What the law says about it

eIDAS knows three levels of electronic signature: simple, advanced and qualified. Only the last one is put on a par with a signature made by hand. Article 25 of Regulation (EU) No 910/2014 says that a qualified electronic signature has the equivalent legal effect of a handwritten signature. A judge may not refuse the other two levels because they're electronic, but they don't get that equivalence.

Your eID is at that top level. The certificate belonging to the sign key is literally called, in the official documents, "Gekwalificeerd Certificaat voor Elektronische Handtekeningen" (qualified certificate for electronic signatures), and the certificate for logging in expressly is not — that distinction was made on purpose.

In 2024 eIDAS was revised by Regulation (EU) 2024/1183 of 11 April 2024, which you'll usually see called eIDAS 2. It adds the European framework for a digital identity wallet on your phone. It changes nothing about the three levels or about the equivalence of the qualified signature.

Two reasons why it might not work yet. The signing certificate only goes onto your card from the age of eighteen; if you're younger, only auth is on it and you can log in but not sign. That isn't a technical limit but a legal one: a minor usually can't bind themselves legally. And since 21 May 2026 the oldest cards are out — the signing certificate on eIDs issued before 4 July 2016 lost its qualification that day. Logging in with such a card still works, signing doesn't; the government is setting up a separate service for that. See the announcement from the Interior Ministry.

How you check whether it worked

Open the signed PDF in a reader that knows about signatures — Adobe Acrobat Reader does. A bar appears at the top saying the document has been signed. Open up the signature panel and you'll see who signed, when, and the sentence it's all about: that the document hasn't been changed since that signature. If you can't find that sentence, something is wrong.

If you'd rather not lean on Adobe alone, there's the European Commission's validation tool: the DSS demo. There you upload your PDF and get back a report from a party that has nothing to do with your document or with this service. That's the point of a standard like PAdES: everyone checks the same file in the same way, and you don't have to take anyone's word for it.

Want to see that it really works: make a copy, edit that copy, change one letter and save. Open it again. The reader now reports that the document has been changed after signing. That's the same Verify button from chapter 7.1, only built into your PDF reader.