My signed file is .p7m, .p7s, .imz or .xml, not PDF: how do I verify it?

You were told the document is "digitally signed". What arrived is contract.pdf.p7m, or invoice.xml, or a PDF plus a small .p7s file, or (in Turkey) an .imz file. Your PDF reader will not open it, and a PDF signature checker says there is nothing to check.

Nothing is broken. There are three families of digital signature in common use, and only one of them lives inside a PDF.

The short answer

Verify PDF Signature checks the first row: signatures inside PDFs. For the others you need a validator built for that format. The good news: most countries where these formats are common provide one, and the EU provides a general one too.

PAdES: signed PDFs

A PAdES signature is stored inside the PDF itself. You open the PDF normally; the signature is checked by any PDF signature validator. This is the most convenient format for people who just need to read the document, which is why many schemes are moving towards it.

CAdES .p7m: the document is inside the signature

A .p7m file is an envelope: the original file (often a PDF, sometimes a Word or XML file) is inside a signed container. The name usually keeps the original extension. contratto.pdf.p7m: because opening the envelope gives you back contratto.pdf.

It is very common in Italy, where firma digitale has long used this format for official and business documents, and it is used in several other countries.

To verify and open it:

• Use a signature verification application that understands CAdES. In Italy, the national digital agency publishes a list of free verification software, and certification providers ship their own. In the EU, the European Commission's DSS demonstration validator also accepts CAdES files.
• The tool checks the signature and then lets you extract the enclosed document.
• Renaming .p7m to .pdf does not work properly. The file still starts with the signature wrapper. Some PDF readers cope, most don't. Extract it with a proper tool.

Important: once you extract the enclosed PDF, it no longer carries the signature. The .p7m is the signed original; the extracted PDF is a copy. Keep the .p7m.

.p7s: a separate signature file

A .p7s is a detached signature: the document stays as a normal file and the signature sits next to it. To verify, the validator needs both: the document and the .p7s, because the signature is a fingerprint of the document's exact bytes.

If you only received the .p7s, you have nothing to verify; ask for the document too. If the document was re-saved or converted since signing, the signature will not match.

(A .p7s is also what signed emails carry as smime.p7s. That signs the email, not any attached PDF.)

Turkey's .imz files

Turkish e-imza tools commonly produce .imz files, which are CAdES containers. The same idea as .p7m. İmzager, the application from the public certification centre Kamu SM, can open and verify them, and so can many commercial Turkish e-imza tools. Turkish public bodies can also produce PAdES-signed PDFs, which any PDF signature checker reads. See How to verify an e-imza signed document in Turkey.

XAdES and signed XML

Signed XML appears wherever the document is really data: electronic invoices in several countries, tax filings, public procurement submissions and some national signature services. The signature is part of the XML structure.

• Poland's free trusted signature (podpis zaufany) can produce signatures in a PDF-embedded form or an XML form, depending on the file signed; government services exist to verify both.
• Spain's administration uses XAdES alongside PAdES, and its official validation platform accepts both.
• Mexico's CFDI e-invoices are XML documents carrying the issuer's digital seal and the SAT's certification. The PDF you receive with them is only a printed representation. See How to verify a signed e-invoice.

ASiC containers

ASiC (.asice, .asics, and older .sce/.bdoc in some countries) bundles one or more files with their signatures into a single zip-based container. It is common in the Baltic states and Nordic countries. National signing apps open and verify them; so does the EU's DSS validator.

Why would anyone choose these over a signed PDF?

• Any file type. CAdES and ASiC can sign a Word document, an image or a spreadsheet, not only a PDF.
• Established practice. Some schemes adopted CAdES before PAdES was widespread.
• Machine processing. XAdES suits data that software reads, like invoices.

The drawback is exactly what brought you here: ordinary people cannot open the file with the software they have.

Converting a signed file to PDF

If you need a PDF to read or print, extract or convert it, but understand you now have an unsigned copy. For anything formal, keep the original signed file and provide it alongside the PDF. If a recipient needs a signed PDF, the signer must sign the PDF itself in PAdES form; a signature cannot be moved from one format to another.