Security

How to verify a digitally signed document in Saudi Arabia

Check the PDF for a digital signature, confirm it is intact and nothing was added after signing, and confirm the certificate chains to a certification service provider licensed under the Saudi national PKI. For government documents, use the issuing platform's own verification (usually a QR code or document number); for e-invoices, use ZATCA's official VAT app. A “not trusted” result elsewhere often reflects the tool's trust list, not the signature.

5 min read

Verify SignatureCheck a PDF's digital signatures

Saudi Arabia's digital-government programme means a great many official documents are now issued and signed electronically: certificates, contracts, commercial registrations, employment records and invoices. Knowing how to check them protects against the forged PDFs that inevitably follow.

The short answer

  1. Check the file with Verify PDF Signature: is there a digital signature, is it intact, what changed after signing, who issued the certificate?
  2. Check the chain reaches a provider licensed under the Saudi national PKI, rooted at the Saudi National Root CA.
  3. Check the record with the issuing platform: most government documents carry a QR code or document number for verification on the issuing platform; e-invoices are verified with ZATCA's official app.
  • The Electronic Transactions Law (Royal Decree No. M/18 of 1428H, 2007) gives electronic records and signatures legal effect and sets rules for certification service providers. Its implementing regulations add detail.
  • The National Center for Digital Certification (NCDC) was established to manage the national public-key infrastructure, including the Saudi National Root CA, and licenses certification service providers. Responsibilities in the Saudi digital-government landscape have been reorganised over time, so check the current authority for the specific service you need.
  • Some matters may have their own requirements; confirm with the receiving entity which form of signature it accepts.

Step 1: check the file

Upload the PDF exactly as received:

  • Signature: Valid and Unchanged since [name] signed it: the signed content has not changed.
  • Changes after signing: listed in plain words, with Compare the changed pages and Download the version that was signed.
  • No digital signature found: the signature or stamp is a picture. Many genuine documents are issued this way with a QR code instead; go to Step 3.

Step 2: check the certificate chain

In Certificate details, look at the Certificate chain. For a certificate issued under the national PKI, the chain should lead from the signer through a licensed provider's certification authority up to the Saudi National Root CA.

  • If the chain ends at an unrelated root, or the certificate is self-signed, it is not a certificate from the national PKI, whatever name it carries.
  • Revocation: Revoked is a red flag.
  • Trust: Not trusted may appear because the Saudi root is not on this service's list. That is about the list, not the signature. In Adobe, you may see "validity unknown" for the same reason. See Why Adobe says “Signature validity is unknown”.

Step 3: check the record with the issuer

  • Government documents: many carry a QR code or verification number that opens the issuing platform's verification page. Use it, but check the address it opens is the official one. Forgers copy QR codes.
  • Commercial registrations and licences: confirm details on the official business services platform rather than trusting a PDF alone.
  • Employment and residence documents: confirm through the relevant official platform where the employer or authority offers verification.

The general routine is in How to verify a government certificate or university degree PDF.

E-invoices: verify with ZATCA, not the PDF

Saudi e-invoicing (FATOORA) requires a QR code on invoices. In the integration phase (Phase 2), standard tax invoices are cleared by ZATCA before they are issued and simplified invoices are reported within 24 hours, and the QR code carries cryptographic elements linking it to the invoice data. Scan the QR code with ZATCA's official VAT app, which shows the QR code's contents and the verification result, and compare the seller name, VAT number, date and amounts with the invoice in front of you.

What to compare, field by field:

  1. Seller name: exactly as printed on the invoice.
  2. VAT registration number: the seller's 15-digit number, digit for digit.
  3. Invoice date and time: a mismatch suggests the PDF was re-created.
  4. Invoice total, including VAT, and the VAT amount: the figures a forger most often changes.

If any field differs, the PDF does not match the invoice the seller's system produced. A PDF signature check tells you only whether that PDF copy was altered. See How to verify a signed e-invoice.

Common real-life situations

A contract signed by the other party

Check it for changes after their signature. If they signed with a picture and you need stronger evidence, ask them to sign digitally with a certificate from a licensed provider or through an approved platform.

A salary certificate or bank letter for a visa or loan

Check whether it has a digital signature; if not, confirm with the issuer. Lenders and embassies increasingly verify directly with the issuing platform.

A supplier invoice with changed bank details

This is the classic fraud. Confirm by phone, using a number you already had. A signed PDF with a text box added after signing over the bank details is exactly what the changes-after-signing list is designed to catch.

What our checker does and does not tell you

Verify PDF Signature reports integrity, changes after signing, the certificate and chain, revocation, timestamps and whether long-term validation data is present, with a downloadable PDF report. It does not determine whether a certificate meets a particular Saudi regulatory requirement. The issuing platform or the national PKI's own validation is the authority for that.

Common questions

How do I verify a digital signature in Saudi Arabia?

Check that the PDF's signature is intact and nothing was added after signing, and that the certificate chains to a licensed provider under the Saudi National Root CA. For government documents, also use the issuing platform's QR code or document-number verification.

How do I verify a ZATCA e-invoice?

Scan the invoice's QR code with ZATCA's official VAT app and compare the details with the invoice. The PDF itself is only a copy.

Why does the signature say “not trusted”?

Because the Saudi national root may not be on the checker's list of recognised roots. Check who issued the certificate; the signature may still be intact and valid.

Is an electronic signature legally valid in Saudi Arabia?

The Electronic Transactions Law gives electronic signatures legal effect, subject to its conditions and exceptions. Confirm with the receiving entity what form of signature it accepts for the specific document.

Related guides

SecurityWhat is a digital signature in a PDF, and why does my signed PDF say it has none?A signature you can see on a page (drawn, typed, scanned or stamped) is a picture. A digital signature is invisible proof, made with a certificate, that the document has not changed since it was signed and who signed it. A PDF can show a signature and still contain no digital signature at all.SecurityWhat is a digital certificate (.pfx / .p12), and do I need one to sign a PDF?A digital certificate is a digital ID: a small file, usually ending in .pfx or .p12, that holds your verified name and a secret key. It is issued to you by an organisation that has checked who you are. You need one to make a digital signature, but not to simply put your signature on a PDF.SecurityWhat is a trusted timestamp, and why does a signature need one?A trusted timestamp is an independent record of when you signed, made by an outside service that nobody involved in the document controls. Without one, the only proof of the signing time is your own computer's clock, and a clock can be wrong, or changed on purpose.