Rox Register, Developers

Guides / Trust the signature

Trust the signature

Every stamped PDF is digitally signed by the Rox Register sealing service using PAdES, the open ETSI standard for PDF signatures. Acrobat, Foxit and every serious PDF reader show the signature natively, and any edit to the document after sealing visibly breaks it. One one-time step makes the reader recognize the signer: importing the Rox Register root certificate. This page is that step.

What the signature is

An invisible document-level signature (SubFilter ETSI.CAdES.detached, SHA-256) covering the entire byte range of the file. The signer is Rox Register Sealing Service, issued by the Rox Register Document CA. The sha256 of the signed file is exactly the content_digest_hex the API returns and the digest the record anchors on RoxChain, so the reader's signature check and the public verification check attest the same bytes.

Before and after trusting the root

Before: the reader shows the signature panel with the signer name and reports that the document has not been modified, but flags the signer identity as validity unknown, because the Rox root is not yet in its trust store. The tamper-evidence already works in this state.

After: the signature validates fully. Any modification to the file after sealing flips the panel to invalid in every conforming reader.

1. Download the root certificate

The root certificate is public key material and safe to distribute to anyone who verifies your documents:

rox-register-document-ca.pem (Rox Register Document CA, valid to 2036)

Verify the download out of band before trusting it. Its SHA-256 fingerprint is:

CF:DF:8B:F3:89:80:1B:42:AF:C3:8D:95:31:A0:7D:F0:0A:7A:CB:69:2D:9B:71:51:58:70:9C:A3:5D:FE:8D:98

2. Import it into your reader

Adobe Acrobat / Acrobat Reader: Preferences, Signatures, Identities & Trusted Certificates, More. Under Trusted Certificates choose Import, select the .pem file, then edit its trust and check "Use this certificate as a trusted root" and "Certified documents". Reopen the PDF: the signature validates.

Foxit: Preferences, Signature, Trusted Certificates, Add, select the .pem file and mark it trusted for signing.

Organization-wide: IT can distribute the certificate through normal endpoint policy (Acrobat supports centrally managed trusted identities), so every workstation validates Rox-sealed documents with no per-user steps.

What this does and does not prove

A valid signature proves the file left the Rox Register sealing pipeline and has not changed since, on top of the public verification path, which proves the same bytes are anchored on RoxChain. A broken or missing signature on a document that claims to be Rox-sealed is disqualifying: treat the file as not authentic and verify it on the scan page.

The signature belongs to Rox Register as the sealing operator, not to the issuing business; who sealed a record, and the record's sealed facts, are always shown by the public verification surface.

Next: Seal and stamp a PDF for producing signed stamped documents, or your first seal for the core flow.