Learn · 2 min read

Future-proofing signed contracts: why long-term validation matters

A signature that’s perfectly valid today can become unverifiable in a few years, not because anything was tampered with, but because the certificate behind it expired.

TL;DR

Signing certificates expire, typically within a few years, and revocation records aren’t kept forever either. A basic signature checked years later can fail to validate for that reason alone. PAdES-B-LTA (long-term availability) embeds a timestamped snapshot of the validation evidence at signing time, so the signature stays checkable long after the certificate itself has expired.

The problem: certificates don’t last as long as contracts do

A signing certificate is typically valid for one to a few years. Many contracts, leases, loan agreements, long-term service agreements, need to remain provable for far longer than that. If a signature’s validity depends only on its certificate still being within its validity window, and on the certificate authority’s revocation records still being queryable, a document signed correctly today can become impossible to validate cleanly a decade from now, through no fault of the signer or the document itself.

What actually goes stale

Two things age out: the certificate’s own validity period, and the revocation information (OCSP responses or CRLs) that a validator needs to confirm the certificate wasn’t revoked at signing time. Certificate authorities aren’t obligated to keep serving that revocation data indefinitely. Once it’s gone, a basic signature format has no way to prove it was checked correctly at the time.

The fix: baking in the evidence at signing time

PAdES defines several baseline profiles of increasing durability. PAdES-B-LTA (Long-Term Availability and integrity) is the one built for this exact problem: it embeds a timestamp and the full validation material, certificate chain, revocation status, as it existed at the point the document was signed, directly into the file. A validator checking the document years later doesn’t need to go back to a certificate authority that may no longer answer; the evidence needed to confirm the signature was legitimate at signing time already travels with the file.

Who actually needs this

Not every signed document needs decade-scale durability, a one-off delivery acknowledgment probably doesn’t. It matters most for anything with a long lifecycle or a plausible future dispute window: loan and financing agreements, leases, insurance contracts, employment agreements, and anything in a regulated industry with long retention requirements. If a document might need to prove itself five or ten years from now, the signature format it was created with is worth checking today, not when the dispute happens.

What to check

A validator that reads a PAdES signature’s profile level can tell you whether a given document is built for long-term durability or not. If it isn’t, that’s not necessarily a problem today, but it is a fact worth knowing before the certificate behind it expires, not after.

Was this helpful?