Is a PKI signature the same as a digital signature?

A PKI signature is the common production form of a digital signature: the signing math is public-key cryptography, and the trust framework around the keys is PKI. "Digital signature" names the cryptographic operation; "PKI signature" names that operation plus the certificate and trust-chain infrastructure that makes it verifiable by strangers.

Does a PKI signature expire when the certificate expires?

No — provided the signature was timestamped by a trusted source while the certificate was valid. Verification replays the chain as it stood at signing time: the certificate valid then, the revocation status then, the timestamp proving when. Expiry affects future signing, not past evidence.

Can I create a PKI signature with a self-signed certificate?

The cryptography will work, and the signature will verify against your own certificate — but no third party has any reason to trust the identity in it, because no CA vetted anything. Self-signed certificates authenticate the key holder's claim, not the key holder. For documents that travel outside your organization, use a CA your counterparty recognizes.

Do all signers in a workflow need their own certificates?

Only where the flow requires personal non-repudiation. Many deployments use organizational certificates with the signing-session record carrying personal attribution — who actually performed each act. Individual credentials are the stronger evidence, and platform-managed custody is what makes issuing them practical at scale.

PKI Signatures: Certificates, Trust Chains, Verification

A PKI signature is a digital signature whose trust comes from public key infrastructure: a certificate authority vets the signer's identity and issues a certificate binding that identity to a key pair, the signer produces the signature with the private key, and any later verifier checks it against the certificate chain — cryptographically, without calling the signer, the CA, or the signing platform. It is the mechanism behind certificate-backed document signing, and its evidentiary strength comes from one property: verification is offline and independent.

The Four Moving Parts

A PKI signature is not one thing but a system of four:

The key pair — a private key that signs and a public key that verifies. The security of everything downstream reduces to who controls the private key.
The certificate — a CA-issued credential binding the public key to a verified identity, with validity dates and usage constraints.
The trust chain — the certificate chains up through intermediate CAs to a root that verifiers already trust. Trust is inherited, never self-declared.
The signature operation — the document hash is signed with the private key; changing one byte of the document breaks the verification.

The certificate's own anatomy is covered in X.509 Digital Certificates: What They Prove, and the certificate-versus-signature distinction in Digital Signature and Digital Certificate: How They Work Together.

How Verification Actually Runs

When a recipient opens a PKI-signed document, their reader executes a fixed chain of checks — the same checks whether the reader is Adobe, a browser plugin, or a custom verifier:

Step	Question	Failure means
Signature math	Does the signature match the document hash?	Document altered
Chain build	Does the cert chain to a trusted root?	Unknown issuer
Revocation	Was the cert valid at signing time?	Compromised or expired key
Timestamp	When was the signature made?	Timing unprovable

The timestamp deserves emphasis: verification evaluates the chain as it stood at signing time, not as it stands today. A certificate that expired last year does not invalidate a signature made while it was valid — provided a trusted timestamp proves when the signing happened. This is why the timestamp authority is infrastructure, not decoration.

Where PKI Signatures Are Required (and Where They Are Overkill)

Most US commercial documents do not need PKI — ESIGN and UETA are technology-neutral, and an ordinary electronic signature with a strong audit trail suffices for NDAs, sales contracts, and HR paperwork. PKI earns its operational cost where the evidence must stand alone:

Counterparty and regulator mandates — banks, governments, and enterprises that require certificate-backed signatures on specified document classes.
Cross-border qualified contexts — the EU's eIDAS QES is the canonical case: a qualified certificate carries a presumption of validity ordinary signatures do not get.
Long-horizon evidence — documents that must verify years later, after vendors and systems change, where cryptographic self-containment beats platform dependence.
High-fraud flows — where the cost of a disputed identity exceeds the cost of running certificates.

The deployment and custody decisions are covered in Certificate-Based Authentication for Digital Signing, and the purpose frame in Document Signing Certificates: Purpose and Use Cases.

The Failure Modes That Defeat PKI in Practice

Exported private keys — a certificate whose private key circulates in a shared drive authenticates nobody in particular.
Self-signed certificates — cryptographically functional, evidentially empty: no third party vouched for the identity, so the chain of trust has no root outside the signer's own claim.
Missing timestamps — the signature verifies today and becomes unprovable after the certificate expires or is revoked.
Unverifiable exports — a signed file whose evidence requires the issuing platform's online service to check is not portable evidence; it is a subscription dependency.

How the signature operation itself works underneath all of this is covered in How Digital Signatures Work in Business Workflows, and the algorithm layer in Digital Signature Algorithm: How Signing Math Works.

Checklist Before You Rely on a PKI Signature

Key custody is defined: who holds private keys, and what happens when a holder leaves.
CA is recognized: the issuing CA chains to roots your verifiers trust.
Timestamp is independent: a trusted TSA stamps every signature.
Revocation is checked at signing time: the evidence includes the status then, not now.
Export verifies offline: document, chain, hash, and timestamp check without any vendor online.

Why Enterprises Run PKI Signing on Nota Sign

Ask a room of IT directors what killed their last PKI rollout and none of them will say "the cryptography." It is the operational tail: issuing credentials to people who lose them, chasing revocations, keeping timestamps trustworthy, and explaining to auditors why the verification depends on a vendor staying online. Nota Sign's answer is to run that entire tail as managed infrastructure rather than your project — external CA certificates plug in, chains and revocation are maintained by the platform, keys stay in hardened custody behind per-signer identity proofing, and every signature leaves with a trusted timestamp and a complete evidence package that verifies offline, years later, with no support ticket.

The legal frame travels just as well. More than 100 countries and regions are covered in one envelope flow — ESIGN and UETA for US signers, the full eIDAS spectrum (SES, AES, QES) for EU ones, iAM Smart, Singpass, and regional data residency across APAC — all on SOC 2 Type II-audited infrastructure, with standard electronic signatures and PKI-backed digital signatures available to the same operator. Cross-border corridors are first-class: a signer in China executes under PRC rules while your side executes under ESIGN, and the chain-bound evidence verifies identically on both ends of the China–overseas route.

Nota Sign is built by FaDaDa, the e-signature vendor leading China's market, and the commercial model keeps PKI affordable at scale: no per-seat fees, so certificate-backed workflows never price out occasional signers; small teams start on a low-cost package, and mid-market and enterprise buyers negotiate tailored plans sized to document volume and integration patterns.

If a counterparty or regulator is asking for PKI-backed signatures, contact sales with the requirement and we will show you the custody and CA model that fits it on a real document.