Question 1

What is a CAdES (.p7m) signature?

Accepted Answer

CAdES stands for CMS Advanced Electronic Signatures, an ETSI standard (EN 319 122) built on the Cryptographic Message Syntax (RFC 5652), the modern successor to PKCS#7. It's a binary signature container, usually a .p7m file. Italy's legal digital signature relies on it heavily, so you'll often see a document.pdf.p7m bundle where the original file sits wrapped inside the signature.

Question 2

How is CAdES different from XAdES and PDF (PAdES) signatures?

Accepted Answer

Same cryptography, three different wrappers. PAdES lives inside a PDF, XAdES wraps XML, and CAdES uses the binary CMS format from the PKCS#7 world. You reach for CAdES when the signed thing isn't a formatted document at all, like an email attachment or an arbitrary file, so it shows up wherever a raw byte stream needs a legally binding signature.

Question 3

What's the difference between .p7m and .p7s (enveloping vs detached)?

Accepted Answer

A .p7m is enveloping: the signed content is packed inside the signature, so the file is self-contained and this page can check it on its own. A .p7s is usually detached: it holds the signature only, and the original file lives somewhere else. If you upload a lone detached .p7s, the report may come back indeterminate because the data it signed is missing. To validate a detached signature, add the original file alongside it inside the Chaindoc app.

Question 4

Can I verify an Italian .p7m firma digitale file or an S/MIME email signature?

Accepted Answer

Yes. Italian firma digitale files, the .p7m buste crittografiche you get from PA portals and PEC email, are CAdES signatures and this tool reads them. Signed S/MIME email attachments work too, as long as the signature is self-contained rather than detached from its message.

Question 5

Why might a CAdES signature come back invalid?

Accepted Answer

A few usual suspects: the content changed after signing so the message digest no longer matches, the signing certificate expired or was revoked, or the chain doesn't reach a trusted root. One more that's specific to CAdES is uploading a detached .p7s without its original file. The report names the exact check that failed, so you're not left guessing.

Question 6

Is my file stored after verification?

Accepted Answer

No. The file runs through the check and then it's gone. Only the result and the signature metadata stay in your history for audit, never the file itself.

Question 7

What certificate authorities are trusted?

Accepted Answer

Chaindoc uses the EU Trusted List (EUTL) as the primary trust anchor, which includes all qualified trust service providers under eIDAS. Major commercial CAs are also trusted, and organisations can configure custom trust anchors for internal PKI.

CAdES & .p7m signature verification

Verify CAdES Signature

What CAdES verification checks

CMS structure and digest integrity

Certificate chain and revocation

Timestamps and long-term validity

eIDAS and ETSI compliance

Supported CAdES profiles

CAdES-BASELINE-B

CAdES-BASELINE-T

CAdES-BASELINE-LT

CAdES-BASELINE-LTA

Common questions about CAdES signature verification

CMS signatures and document verification guides