BlueRidge server provides a mechanism that can digitally sign a PDF file. This is done using a X509 v3 based certificate. A HSM can be enclosed by the BlueRidge server to store the private keys used by the Advanced Electronic Signature Service. The signature solution of BlueRidge consists of a server and a client component.

​  A PDF document can be signed by BlueRidge in a blank signature field or a new signature field can be added. If this case, an annotation is first added containing the appearance of the signature field (this is empty in case of an invisible signature).

​  The PDF signature information is stored in a signature dictionary data structure.

​  To create an electronic signature a digest is computed of the data stored in the document. All bytes of the PDF file are covered by the signature digest, including the signature dictionary, but excluding the signature value itself.  To verify the signature, the digest is recomputed and compared with the one stored in the document.

​  The computed digest is than signed using a selected X509 certificate by the client component of the signature generation module. The hash can be signed in semi-delegated (certificate present in local store) or full-delegated mode (certificate present on server).

​  This signed data is then added to the PDF as the signature value.

BlueRidge can sign using custom filters or using the standard Adobe.PPKLite or Adobe.PPKMS filter. As SubFilter BlueRidge supports adbe.pkcs7.detached and adbe.pkcs7.sha1.

Multiple signatures are supported using the incremental save capabilities of PDF. When changes to a file are made and a new signature is applied to the document, the changes are appended after the last byte of the previously existing document.

BlueRidge supports time stamping. When the BlueRidge server validates the signature, not only the signature and its integrity are checked, but the time stamp can also be validated online with the Time Stamp Server. The software uses the public key to prove the time stamp is authentic.

BlueRidge also supports Long-term validation (LTV). LTV is a special feature of PDF signing and allows for validity checking years after the certificate was created. When LTV is enabled, the certificate’s sign-time status is stored inside the PDF. This verification certificate remains in the file so that its validity can be determined even at some later date, regardless of whether the certificate has expired or been revoked, or the issuing authority no longer exists. Because the record is stored inside the signed document, it is also authenticated by the document’s signature, further reducing the chances for error or fraud. LTV helps reduce dependencies on external systems and reduces the potential for future ambiguity around expired or revoked certificates.

These methods can be pre-configured for automatic use.

Some transactions and records are time-sensitive, and often electronic records need to record the time of signing in a verifiable manner. PDF signature features can increase the accuracy and trust of the signature time. The most basic source for time is the system clock of the signing computer. System time is usually accurate, especially in enterprise environments, but there is the possibility that the system date could be altered to fraudulently predate a document. In some cases, the signature time can be compared with other system logs to determine its accuracy. For example, if LTV is employed, the revocation response contains a time stamp from the issuing system. Because the time on the revocation response is usually more secure than system time, this time can be cross-referenced and compared with the signature time.

The most accurate way to establish the time of signing is to add a secure time stamp to a digital signature. A secure time stamp is a standards-based method (based on RFC 3161) for recording the time of a transaction. In PDF documents, secure time stamps are added directly to a signature at the time of signing and are visible when verifying signatures.

BlueRidge supports time stamping. In this case the program will fetch a time stamp upon creation of the signature from a Time Stamp Server. The program calculates a hash value of the document to sign. This hash is packed into a timestamp request and is sent to the Time Stamp Server. Only the data file’s unique hash value is transmitted, sensitive data is never transmitted outside the client. The Time Stamp Server adds the current time to the hash value, signs it, and generates a time stamp according to [RFC3161]. This time stamp is delivered back to the BlueRidge server as a DER coded ASN.1 stream. All client to server communication is HTTP(s). The TSA response is then incorporated in the signature itself. When the BlueRidge server validates the signature, not only the signature and its integrity are checked, but the time stamp can also be validated online with the Time Stamp Server. The software uses the public key to prove the time stamp is authentic.