Documents & Signatures
How Digital Signatures Work in India: CCA Root and the Green Tick
How a signed PDF from UIDAI, an employer or a court is checked against India's CCA root, what the green tick proves, and the four things it can't tell you.
myutils.me8 min read
A green tick on a signed PDF answers two questions. Has the file changed since it was signed? And does the signer's certificate lead back, through a chain of certifying authorities, to a root the viewer trusts? In India that root is run by the Controller of Certifying Authorities (CCA), and both questions are answered by arithmetic on the file, not by anyone looking at it.
This post explains the chain, why Indian PDFs so often show a question mark instead of a tick, and what a valid signature does and doesn't tell you.
What happens when a PDF is signed
The Information Technology Act, 2000 describes a digital signature in section 3: the electronic record is run through a hash function and the result is transformed using the signer's private key, from an asymmetric key pair.
In practice:
- The signing software computes a hash of the PDF: a short fingerprint that changes completely if a single byte of the file changes.
- It encrypts that fingerprint with the signer's private key, which sits on a USB token, in a hardware security module or, for eSign, is created for one use and then destroyed.
- It embeds the result in the PDF along with the signer's certificate, which holds the matching public key and the signer's name.
When you open the file, the viewer recomputes the fingerprint, decrypts the stored one with the public key from the certificate, and compares them. If they match, the file is unchanged since signing. That is the integrity half of the green tick.
The chain of trust: CCA, licensed CAs, signers
Anyone can make a certificate with any name in it. What makes a certificate believable is who signed it.
| Level | Who it is | What it signs |
|---|---|---|
| Root Certifying Authority of India | Set up by the CCA under section 18(b) of the IT Act; the CCA sits under MeitY | The licences and public keys of licensed CAs |
| Licensed Certifying Authority | Companies and bodies licensed by the CCA, such as eMudhra, Capricorn, (n)Code Solutions, Protean, IDRBT and CDAC | Certificates for individuals, organisations and sub-CAs |
| Signer | A person with a DSC, an organisation's document-signing certificate, or an Aadhaar eSign user | The PDF |
The CCA's website listed 23 licensed CAs when this post was written. A viewer that trusts the CCA root can follow the chain from your PDF's signer, up through the CA that issued its certificate, to the root. That is the identity half of the green tick.
The CCA's root certificates
The CCA publishes its roots at cca.gov.in:
| Root certificate | Valid from | Valid to | Status |
|---|---|---|---|
| CCA India 2022 | 2 Feb 2022 | 2 Feb 2042 | Current |
| CCA India 2022 SPL | 20 Sep 2022 | 20 Sep 2042 | Current |
| CCA India 2015 SPL | 29 Jan 2015 | 29 Jan 2025 | Expired |
| CCA India 2014 | 5 Mar 2014 | 5 Mar 2024 | Expired |
| CCA India 2011 | 11 Mar 2011 | 11 Mar 2016 | Expired |
An expired root doesn't make older documents invalid. A signature is judged by whether the chain was valid when the document was signed. A document signed in 2023 by a certificate that chains to the 2014 root is still checked against the 2014 root today.
Three kinds of signer certificate you'll meet
- DSC on a USB token. Issued to a person after identity checks by a licensed CA, protected by a PIN. Used by directors on MCA filings, by employers signing Form 16 and by professionals.
- Document signer certificate. Issued to an organisation for signing documents automatically, in bulk. Signer names starting with "DS" usually mean this kind. e-Aadhaar is signed this way by UIDAI.
- Aadhaar eSign. Section 3A of the IT Act and its Second Schedule allow electronic signature techniques beyond the classic DSC. With eSign, the signer authenticates through Aadhaar e-KYC (OTP or biometric), a licensed CA acting as the eSign service provider issues a short-validity certificate in the signer's name, and the CCA says the key is destroyed right after its one use. The certificate still chains to the CCA root.
Under section 5 of the IT Act, where a law requires a document to be signed, an electronic signature that meets the Act's conditions satisfies that requirement.
Why your viewer shows a question mark
A viewer only trusts roots in its trust list. Many viewers on phones, Macs and browsers don't include the CCA India roots, so they confirm the file is intact but stop short of the root and show "validity unknown" with a yellow question mark. The document isn't fake; the viewer just can't finish the chain. Why e-Aadhaar and other PDFs show a yellow question mark covers this for common documents.
The PDF signature verifier carries the CCA India roots and checks the chain in your browser. The PDF isn't uploaded; to complete the chain, it fetches the issuing authorities' public certificates through our server. For e-Aadhaar, use the e-Aadhaar verifier, which also handles UIDAI's password format. If a checker reports "invalid" or "unknown" rather than a question mark, troubleshooting an invalid or unknown PDF signature goes through the causes.
What a green tick proves, and what it doesn't
| Proves | Doesn't prove |
|---|---|
| The file hasn't changed since it was signed | That the content is true: a signed Form 16 can still contain a payroll error |
| The signer's certificate leads to a CCA root | That the signer was authorised by their organisation to sign this document |
| The name in the certificate, as checked by the CA that issued it | That the person showing you the file is the person named in it |
| When the signer's clock says it was signed | A trusted time, unless the signature carries a timestamp from a timestamp authority |
Two more points. A signature check doesn't tell you whether the certificate was revoked later; a full check queries the CA's revocation list, which our checker doesn't do. And a print, a screenshot or a scan carries no digital signature at all. Only the original file can be checked. For an Aadhaar printout, the Secure QR code is the check that works on paper; see is this e-Aadhaar real?.
A worked example: one e-Aadhaar, three viewers
Asha downloads her e-Aadhaar from UIDAI and opens it in three places:
| Viewer | Result | Why |
|---|---|---|
| Phone's built-in PDF viewer | No signature shown | The viewer doesn't read signatures |
| Adobe Acrobat Reader, default settings | Validity unknown (?) | The file is intact but the CCA root isn't trusted |
| A checker that trusts the CCA roots | Signature is valid | Intact file, chain complete to a CCA root |
Same file, same signature. Only the trust list changed. If she had edited one letter of her address and re-saved the file, all three would have reported a broken or missing signature.
Frequently asked questions
Is a digital signature the same as a scanned signature?
No. A scanned signature is an image anyone can copy. A digital signature is a cryptographic value tied to the exact file and to the signer's certificate.
Who regulates digital signatures in India?
The Controller of Certifying Authorities, under the Ministry of Electronics and Information Technology. It licenses certifying authorities and runs the Root Certifying Authority of India.
Does a valid signature mean the document is genuine?
It means the file is unchanged since a CCA-chained certificate signed it. Whether the content is true, and whether that signer was the right one, still need checking.
Should I add the CCA root to Adobe Reader?
You can, but download the root only from cca.gov.in and check it before trusting it. A browser checker that carries the CCA roots avoids changing your reader's settings.
Why does my eSigned contract show the signer's Aadhaar name?
Because eSign issues the certificate from the Aadhaar e-KYC record. The name is the one in Aadhaar, as confirmed at the time of signing.
Sources
Topics
- Digital Signature
- CCA India
- Root Certificate
- DSC
- IT Act 2000
myutils.me
Written by the team behind myutils.me, a free, independent app that brings ITR status, refunds and AIS/TIS for each PAN into one dashboard. Check anything important against the Income Tax portal before you act on it.
