I'm working on a LAMP environment (Linux-Apache-MySQL-PHP) and I need to sign documents (PDF, but maybe in a future, I'll use other formats so I'm interested in a general answer).

These documents are uploaded by the admin users, signed (internal process, transparent to admin) and the client users could download the files anywhere, anytime using any web browser.

We need to sign these documents so neither the admin users or the clients may claim the files were modified. The idea is to ensure that the document the admin uploaded in a given date is the document that the client downloaded in a later date without any tamper.

How do I enforce non-repudiation given these constraints?

  • Please see my edit to your question. As stated it was a bit broad and opinionated: "what is the best way to implement this system?" when the real concern is "how do I enforce non-repudiation?" per your third paragraph.
    – user22815
    Jun 12, 2015 at 17:08
  • Thanks @Snowman, I'm not english native and sometimes I need some help to make me understand :)
    – Ivan
    Jun 12, 2015 at 17:57
  • 1
    You are welcome, I just wanted you to review my edit to make sure I accurately captured your intent.
    – user22815
    Jun 12, 2015 at 17:58

1 Answer 1


The easiest way to enforce these guarantees is using PKI.

PDFs allow signatures, but to enforce non-repudiation you need to have certificates for each person and some central way to manage them.

You could use a truly public key infrastructure where you purchase certificates from e.g. VeriSign or another root CA (certificate authority) for each user, but that can be expensive.

Depending on the size of your organization and the clients involved, you may be able to run your own CA making the cost of issuing certificates zero. However, this would be cumbersome if you have a lot of external clients.

Running your own CA, at a very high level, means you have one root certificate that is self-signed and installed on client machines (this is similar to the certificates installed in your web browser so you can validate e.g. that your bank's web site is who they say it is). You then sign each individual certificate using that root certificate. Clients can validate signatures by checking the signature matches the client certificate, and validating the client certificate against the root certificate.

  • My organization is small and the number of clients will be less than 50 in any case. If I understand correctly you are suggesting to self-sign my own certificates (one per each admin panel) and then use some tools to sign the document. Could you give any clue about what tools should I use to sign files using PKI?
    – Ivan
    Jun 12, 2015 at 18:03
  • 1
    Tool recommendations are explicitly off-topic on this site. I recommend searching the web to see what is available, learn about them, etc. and if you need help you can ask on SoftwareRec.SE
    – user22815
    Jun 12, 2015 at 18:04
  • 1
    Please see my most recent edit which explains the high-level design for your own PKI infrastructure.
    – user22815
    Jun 12, 2015 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.