Verify a signed PDF

Upload a completed PDF to confirm whether this instance generated and signed the exact file.

Verify independently with open-source tools

You can verify a BoomPay-signed PDF entirely on your own computer. The PDF is not uploaded and this website does not need to be available after you save the public trust anchor.

Download PDF verification trust anchor

SHA-256 certificate fingerprint

34:93:4E:1B:13:95:24:9F:E3:05:9A:41:44:CC:2A:71:A0:75:C5:75:87:C9:74:E0:93:5C:DC:62:4E:CD:0A:71

Confirm this fingerprint through an independent BoomPay source or administrator before trusting it.

1. Install the tools

macOS with Homebrew:

brew install poppler nss qpdf jq

Ubuntu or Debian:

sudo apt install poppler-utils libnss3-tools qpdf jq

2. Trust the downloaded public certificate

Save the download as pdf-verification-root.pem, then run:

mkdir -p ./boompay-pdf-trust
certutil -N --empty-password -d sql:./boompay-pdf-trust
certutil -A -d sql:./boompay-pdf-trust -n "PDF signing root" -t "C,," -i ./pdf-verification-root.pem

3. Verify the PDF offline

pdfsig -nssdir ./boompay-pdf-trust ./signed-document.pdf

Check that the signature is valid, its certificate is trusted, and the signature covers the entire document.

Inspect the signed document assertion

After validating the signature, this command displays the assertion stored inside the signed PDF:

qpdf --json ./signed-document.pdf | jq '.. | objects | .["/BoomPayAssertion"]? // empty | sub("^u:"; "") | fromjson'

Offline verification proves the PDF signature and signed assertion. The upload form above additionally checks the live document record and submission audit chain held by this instance.