signNow introduces PKI technology: Enable advanced authentication for your signed documents with PKI certificates

Everything you need to know about digital signatures and PKI certificates

Businesses that operate in highly regulated industries such as legal, healthcare, finance, and others, are expected to satisfy rigorous requirements for the security, legality, and compliance of document transactions. With that in mind, signNow has empowered organizations to send documents for digital signature via the PKI (Public Key Infrastructure) security protocol, ensuring the highest level of data protection and authentication.

The PKI certification is used to identify users when communicating over untrusted networks, to sign documents and encrypt data. The idea behind the PKI authentication is to have one or more trusted parties capable of digitally signing documents certifying that a specific cryptographic key belongs to a specific user or device.

But how does that relate to eSignature technology? What makes electronic signatures different from digital signatures? In what cases should a business consider using digital signatures?

In this blog, we will explain how the PKI infrastructure technology works and what makes it so secure. And most importantly, you will learn how to collect digital signatures using signNow.

Electronic signatures vs. digital signatures: what’s the difference?

Most people confuse the terms “digital signature” and “electronic signature” or see them as one and the same. However, these are two different technologies with different types of applications.

• Electronic signatures (or eSignatures) are used to represent a person’s intent to approve or agree with the terms of a document. Essentially, eSignatures are direct electronic counterparts of traditional wet-ink signatures.
• Digital signatures are also used to approve and validate documents in electronic form. However, they use complex cryptographic mechanisms to authenticate digital documents and messages, confirm the identity of signers, and protect data in transit from tampering and falsification.

Digital signatures are equipped with backend tools to ensure that only an authorized person can sign a document and prevent any changes after a signature is placed. A digital signature is generated using a unique digital ID referred to as a “digital certificate” or “public key certificate.” Digital certificates are issued by accredited Certificate Authorities (CA) after validating the requestor’s identity.

From a technical standpoint, each digital signature generated for a specific document is unique, making it extremely hard to falsify. The ability of digital signatures to ensure the integrity and authenticity of electronic records while also indicating the signer’s consent allows businesses, contractors, and customers to interact online and exchange information securely.

Where are digital signatures used?

Offering more capabilities for auditing, validation, and authentication, digital signatures are typically used in industries with strict security regulations and high compliance standards such as:

• Legal services
• Banking
• Insurance
• Healthcare
• Life sciences
• Transportation
• Construction
• Telecommunications
• Energy
• Agriculture
• Defense
• Postal services, etc.

In a narrower sense, digital signatures are most commonly used for financial transactions, contract management, licensing, approval and authorization, accounting, tax management, and so on.

If your business processes are subject to rigorous controls on the part of auditors, compliance officers, judges, or other regulators, digital signatures would be a more appropriate choice for you as they provide additional proof of the origin and legal standing of electronic records.

What is PKI?

And now, let’s focus on the PKI meaning. Public Key Infrastructure, or PKI, is an umbrella term for everything used in public-key (PKI) encryption – the security technology that underlies and enables digital signatures. It includes hardware, software, roles, policies, processes, and procedures required to generate, administer, distribute, use, store, and revoke digital certificates and public keys.

Public-key cryptography relies on unique pairs of keys to encrypt and decrypt electronic messages. PKI facilitates the distribution of public keys and enables identity validation of individuals and organizations through digital certificates issued by Certificate Authorities (CA).

• A Certificate Authority is an entity authorized to issue digital certificates. It functions as a trusted third party that validates the identity of a certificate’s owner. A CA also certifies one’s ownership of a public key.
• A digital certificate is an electronic passport that identifies the participant of a PKI-secured conversation, allowing individuals and institutions to safely exchange data online. The encryption and decryption of data are fulfilled using a pair of public and private keys. 
• A public key is a unique numerical identifier used to encrypt data or verify digital signatures. It is issued by a Certificate Authority to an individual or organization and is publicly available to anyone who requires it.
• A private key is known only to its owner. It is used to decrypt data created with the corresponding public key or to generate digital signatures.

How do digital signatures work?

Now that you know the basic principles of PKI technology let’s see how they apply to digital signatures. Here’s how the signing process works in a nutshell:

1. The signer obtains a digital certificate with a unique key pair from a Certificate Authority.
2. The signer adds a digital signature to a document using their private key.
3. The digital certificate is cryptographically bound to a document.
4. The signed document is sent to the recipient.
5. The recipient uses the signer’s public key to verify the digital signature.
6. If the public key matches, it decrypts the digital certificate ensuring the authenticity and validity of the signature.

Technically speaking, a digital signature is a unique numerical code attached to a document or message. This code serves as proof that the document hasn’t been modified on its way from the sender to the recipient. Altering any part of a document – on purpose or by accident – changes the code, rendering the signature invalid.

How to send a document for digital signature using signNow?

Public-key cryptography may seem complicated to a general user. Luckily, signNow makes it easy to request a digital signature and ensure the authenticity of your signed documents:

1. Upload a document to your signNow account and open it in the editor. Drag and drop fillable fields and assign roles.

2. Click SAVE AND INVITE once your document is ready for sending.

3. Add recipient emails, set the signing order, and check the box Send using GlobalSign PKI signature.

Please note that only eligible organizations can send documents using PKI technology. Contact us to learn more.

How to add a secure digital signature under PKI requirements?

Once you receive a signature request, open the document and click on the signature field to digitally sign it in seconds. You can draw, type, or upload an image of your signature.

How to view a digital certificate?

Once every signer has signed your document, you can download it and view the digital certificate. To see it, open your signed document in Adobe Acrobat Reader®. Click on the digital signature and select Signature Properties > Show Signer’s Certificate. 

Ready to raise the bar for business security and compliance? Don’t hesitate to contact our sales team and activate digital signatures for your signNow Organization.