How to verify a digitally signed PDF in Bangladesh

Bangladesh has had a legal framework for digital signatures since the Information and Communication Technology Act, 2006, and a national root of trust operated by the Office of the Controller of Certifying Authorities (CCA). Use is growing in banking, public procurement, and company and government documents. At the same time, many official documents still prove themselves with QR codes and online lookups rather than digital signatures. This guide covers both.

The short answer

1. Is there a digital signature? Check with Verify PDF Signature.
2. If yes: confirm it is intact, see what changed after signing, and confirm the certificate chains through a licensed Certifying Authority to the Bangladesh Root CA.
3. If no, or in addition: verify the document with the issuing office. Most commonly by QR code or reference number on the office's official website.

The legal background, briefly

• The ICT Act, 2006 (amended in 2009 and 2013) gives legal recognition to electronic records and digital signatures and provides for the licensing of Certifying Authorities.
• The Office of the Controller of Certifying Authorities was set up by the government in support of the ICT Act. It licenses and regulates CAs and manages and operates the Root CA of Bangladesh. Under the Root CA's published practice statement, the root's private key is used only to sign licensed CAs' certificates and its revocation lists. Never to sign an individual's certificate directly.
• The Information Technology (Certifying Authority) Rules, 2010 set out how licensed CAs operate, alongside the CCA's own policies and standards.
• Licensed CAs include the Bangladesh Computer Council's CA (BCC CA) and Dohatec CA, among others. The CCA publishes the current list of licensed CAs; check it rather than relying on any list in a document.

What a genuine Bangladeshi chain looks like

In a certificate chain from the licensed system, you should see, from bottom to top:

1. The signer: a person, or an organisation's authorised signatory.
2. A licensed CA: for example BCC CA or Dohatec CA.
3. The Bangladesh Root CA, operated by the CCA.

Because the root never issues certificates to individuals, a signer's certificate that claims to come straight from the Bangladesh Root CA, with no licensed CA in between, is a warning sign.

Step 1: check the file

Upload the PDF, exactly as received:

• Signature: Valid and Unchanged since [name] signed it: the signed content has not changed.
• Changes after signing: listed in plain words. A changed page on a bank letter, tender document or certificate is a warning sign.
• Compare the changed pages and Download the version that was signed show exactly what was signed.
• No digital signature found: the signature and seal are pictures. That is common for Bangladeshi documents; go to Step 3.

Step 2: check the certificate chain

In Certificate details, the Certificate chain for a Bangladeshi digital signature should run from the signer through a licensed CA's certificate up to the Bangladesh Root CA.

• A certificate that is self-signed or chains to an unrelated root is not a certificate from the licensed Bangladeshi system.
• Revocation: Revoked is a red flag.
• Trust: Not trusted can appear because the Bangladesh Root CA is not on this service's list, and Adobe may show "validity unknown" for the same reason. That describes the list.

To make Adobe recognise the chain, you can add the Bangladesh Root CA to your trusted certificates, but only after comparing its SHA-256 fingerprint with the root certificate the CCA publishes on its official site. The steps are in Why Adobe says “Signature validity is unknown”.

Step 3: verify with the issuing office

Many Bangladeshi official documents are verified online rather than by digital signature: certificates, registrations and tax documents often carry a QR code or a reference number that you check on the issuing office's own website.

• Scan the QR code, then check the address it opens. It should be the issuing office's official domain. Forgers print QR codes that lead to lookalike pages.
• Compare every detail: name, number, date: with the document.
• If there is no QR code, contact the issuing office through contact details you found yourself.

The general approach is in How to verify a government certificate or university degree PDF.

Common real-life situations

A bank or employer asks you to "validate" a signed PDF

Show them the verification result or a report. Download report (PDF) in Verify PDF Signature records each signature, the checks, any changes after signing and the file's SHA-256 fingerprint.

A tender or procurement document

Electronic procurement systems check signatures when documents are submitted. For documents sent to you directly, check integrity and the chain as above.

"The PDF had a signature, but now it doesn't"

It was scanned, printed to PDF or re-saved. Ask for the original file.

What our checker does and does not tell you

Verify PDF Signature reports integrity, changes after signing, the certificate and chain, revocation, timestamps and whether long-term validation data is present. It does not confirm a CA's current licence status, and it does not look up records in government systems. Use the CCA and the issuing office for those.