Is a digital signature secure if the certificate is self-signed?

Cryptographically functional, evidentially weak. The signature math works, but no third party vetted the identity in the certificate, so verification proves the key, not the person. For documents that travel outside your organization, use a CA your counterparties recognize.

Can a digital signature be forged?

The cryptography itself is not the weak point — forging it means breaking the private key or the issuance process. Real-world "forgeries" exploit the system around it: exported private keys, shared credentials, weak issuance vetting, or a genuine signature replayed onto a different document. The four checks above are designed to catch exactly those.

What happens to signature security when a certificate expires?

Nothing, for signatures made while it was valid — provided a trusted timestamp proves when the signing happened. Verification replays the chain as it stood at signing time. Expiry affects future signing, not the security of past signatures.

Does a secure digital signature need the audit trail too?

Yes. The four checks prove the seal; the audit trail proves the act — who signed, what they saw, the consent they gave, the session they signed in. Courts evaluate the whole evidentiary picture, and a perfect seal with no session record is strong cryptography on an unattributed act.

Secure Digital Signatures: Certificate, Identity, Timestamp

A digital signature is "secure" only when four independent checks all hold: the certificate behind it chains to a recognized authority, the signer’s identity was actually verified at signing time, a trusted timestamp fixes when the act happened, and the document hash proves the file has not changed since. Any one of them failing turns a mathematically impressive seal into evidence that persuades nobody. Security here is a system property, not a cryptography property.

Check 1: The Certificate Chains to a Recognized Root

The certificate is the identity layer, and it only works if the people verifying your signature trust its issuer:

CA-issued, not self-signed — a self-signed certificate verifies cryptographically and proves nothing, because no third party vetted the identity.
The chain builds to a trusted root — your counterparty's tools must walk from the signing certificate through intermediates to a root they already trust.
Revocation status at signing time — a certificate revoked last month does not invalidate a signature made while it was valid, but the evidence must include that status as of the signing moment.

The chain mechanics are covered in PKI Signatures: Certificates, Trust Chains, Verification, and the certificate's anatomy in X.509 Digital Certificates: What They Prove.

Check 2: Identity Was Verified at Signing Time

The certificate proves identity at issuance; the signing session must prove the same person is using the key now:

Key custody — who holds the private key, and what stops a colleague from using it. Platform-managed custody behind per-signer identity proofing closes the shared-key hole that defeats most deployments.
Session authentication — the check the signer passed in this session: access code, OTP, or document-level proofing, matched to the document's value.
Attribution in the record — the audit trail must name the person, not just the credential. A company certificate with no session record attributes every act to the organization and to nobody.

The authentication layer is covered in Certificate-Based Authentication for Digital Signing, and the fraud patterns weak identity checks enable in Signature Spoofing: Risks, Detection, and Prevention.

Check 3: A Trusted Timestamp Fixes the Timeline

Without an independent timestamp, "when was this signed" is whatever anyone's file metadata says — editable, disputable, useless. A trusted timestamping authority (TSA) countersigns the document hash at signing time, producing a timeline a court can rely on. The timestamp is also what keeps signatures verifiable after certificates expire: verification replays the chain as it stood then, and the TSA record is what proves "then."

Check 4: The Hash Seals the Document

The signature signs a hash of the document; any later byte change breaks verification. This is the check that defeats the replay attack — a genuine signature block lifted onto a different document — because the lifted signature no longer matches the new file's hash. It is also why the version freeze matters: the hash proves the enforced revision is the signed revision. Detection techniques for manipulated packages are covered in How to Detect a Fake or Manipulated Digital Signature.

The Fifth Element People Forget: Portable Verification

A signature passing all four checks that can only be verified through the vendor's online service is secure until the subscription ends. Portable evidence — document, chain, hash, timestamp, and the audit trail in one export that verifies offline — is what makes the other four checks durable. Downstream batch verification of exactly this package is covered in Automated Document Verification.

Checklist Before You Trust a Digital Signature

Certificate chains to a trusted root: recognized CA, not self-signed.
Revocation is recorded at signing time: status then, not status now.
Identity was verified in-session: the person, not just the credential.
Timestamp comes from a trusted TSA: independent, not file metadata.
Hash matches the current file: integrity verified, not assumed.
Everything verifies offline: the whole package, no vendor dependency.

Secure Signing Enterprises Can Prove: Nota Sign

Security that has to be reassembled at dispute time is not security; it is a scavenger hunt. Nota Sign is built so all four checks are produced by default on every certificate-backed signature: external CA certificates chain through platform-maintained validation, keys sit in hardened custody behind per-signer identity proofing, a trusted TSA stamps every signature, and the document hash seals at signing time — all of it exported as one package with the audit trail, verifiable offline, years later, with no vendor dependency. Standard electronic signatures and certificate-backed digital signatures run in the same envelope flow, with legal coverage across more than 100 countries and regions: US force under ESIGN and UETA, EU recognition across eIDAS (SES, AES, QES), and APAC compliance depth including iAM Smart, Singpass, and regional data residency, on a SOC 2 Type II-audited environment. Secure signing across the China–overseas corridor runs natively — each side's signature executes under its own jurisdiction's rules, and all four checks verify identically for both.

Nota Sign is built by FaDaDa, China's leading e-signature vendor, and the commercial model keeps strong security affordable: no per-seat fees, so reviewers and approvers never become license lines; small teams start on a low-cost package, and mid-market and enterprise buyers negotiate tailored plans sized to document volume and integration patterns.

If you have a signature whose security you want tested, contact sales and we will run the four checks against the package and show you what holds.