PKI Service Integration Guidelines (For Developers) Public Key Infrastructure (PKI) services keep digital systems secure and trustworthy. RISA provides essential services for certificate validation and timestamping, which form the foundation of a secure digital signature service. Any system that uses digital signatures or other PKI services must follow these guidelines. They ensure that signatures are authentic, documents stay intact, and the services remain reliable. This guideline covers: certificate revocation, certificate expiration, signature validation, password management, timestamp validation, processing time, signature appearance, protection of signed documents, prevention of untrusted signatures, prevention of unauthorized changes, and verification after signing. Certificate Revocation Objective: Make sure your system checks whether a certificate is still valid and has not been revoked. Guidelines:  Your system must check that a certificate has not been revoked before accepting it. Use one or both of these standard protocols: OSCP (Online Certificate Status Protocol) — checks the status of a single certificate in real time. CRL (Certificate Revocation List)—a published list of revoked certificates. If a certificate has been revoked, your system must reject it and record the event in a log for auditing. Show the user a clear, easy-to-understand message when a revoked certificate is used—for example: "This certificate has been revoked and can no longer be used." Certificate Expiration Objective  Prevent expired certificates from being used in your system. Guidelines Automatically check the certificate's validity period (start and end dates) every time you validate it. Never accept an expired certificate for any operation. Show the user a clear message when they try to use an expired certificate — for example: "This certificate has expired. Please renew it before signing." Signature Validation Objective: Confirm that digital signatures are authentic (made by the right person) and that the signed document has not been changed. This includes Long-Term Validation (LTV) and time-based validity. Guidelines: Build validation into your system so that every digital signature is verified against trusted certificates. Enable Long-Term Validation (LTV) so that signatures can still be verified even after the signing certificate expires. Password Management Objective: Keep user certificate passwords safe. Guidelines: Never store user certificate passwords in a database or in any file that others could access. Always use HTTPS so that passwords are encrypted while travelling between the user's browser and your server. This stops attackers from intercepting them. Timestamp Validation Objective: Make sure the date and time attached to a digital signature are accurate and can be trusted. Guidelines: Use a trusted Time Stamping Authority (TSA) to attach accurate, synchronized timestamps to digital signatures. Using a centralized timestamp is mandatory . RISA-GovCA provides the centralized TSA system. Signature and Certification Processing Time Objective Set clear expectations for how long signing and certification operations should take. Guidelines Under normal operating conditions, a signature or certification operation is expected to complete within this range: Expected processing time Minimum about 300 milliseconds (0.3 seconds) Maximum about 1.5 seconds Treat this range as the normal processing window for signing and certification. If your system regularly takes longer than this, investigate—it may point to an integration, network, or configuration problem. Signature Appearance Objective Make sure the visible signature on a document looks professional and never hides the document's content. Guidelines When a signature image is placed on a document: The image must have a transparent background. It must not have a solid white (or any opaque) background that covers the text or content underneath. The signature must not cover or block important content on the document. The goal: a professional-looking signature that still lets everyone clearly read the original document. Protection of Signed Documents Against Unauthorized Modification Objective Once a document is signed or certified, protect it so that any later change can be detected. Guidelines After a document has been digitally signed or certified: Any change to the document must cause the signature validation to fail or clearly show that the document was modified. Your system must be able to detect unauthorized changes made after signing. No one should be able to add, remove, or change content without that change being detectable. It must be possible to verify the document's integrity at any time — today, next month, or years from now. Prevention of Additional Untrusted Signatures Objective Stop anyone from quietly adding an unauthorized or untrusted signature to a document that was already signed by the system. Guidelines A document signed through the PKI system must be protected so that extra, untrusted signatures cannot be added without detection. Example: Someone should not be able to take a document signed by your system, add their own signature using an untrusted certificate, and have it appear legitimate.  Prevention of Unauthorized Document Changes Objective Protect signed documents from any action that could damage their integrity or trustworthiness. Guidelines Signed documents must be protected against: Adding new content. Removing existing content. Modifying existing content. Adding annotations or other objects. Adding unauthorized signatures. Replacing or manipulating parts of the document. Any other change intended to weaken the document or make it untrustworthy. Document restriction settings In addition to the digital signature itself, apply the appropriate document security settings (for example, PDF permissions), such as Disable printing. Disable saving changes to the document. Disable editing of content. Disable inserting, deleting, or rotating pages. Important: These restriction settings are helpful extras, but they can be bypassed by some tools. The digital signature is the primary and reliable way to detect unauthorized changes—never rely on viewer restrictions alone. Verification After Signing Objective Every system that integrates with the PKI service must offer a way to verify a document after it has been signed. Guidelines At a minimum, the verification must confirm: The digital signature is cryptographically valid. The document has not been changed since it was signed. The signing certificate is trusted. The certificate was valid at the time of signing. Closing: Compliance and Integration Assessment By following these guidelines, developers can be confident that their PKI integration meets the required standards for security and reliability. Build these practices into your development process from the start.