P7M or signed PDF: CAdES and PAdES

Two attachments arrive on the same morning. The first is named delibera.pdf.p7m. The second is named delibera-firmata.pdf and the PDF reader shows a “signed by” panel. They are not two ways of saying the same thing. The first is normally a CAdES signature. The second is normally a PAdES signature. Knowing the difference stops you renaming files, uploading the wrong format to a portal, and asking the reader for a check it does not perform.

What the CAdES envelope is

CAdES, CMS Advanced Electronic Signatures, puts the document and the signature in an envelope. In Italy the resulting file often has the extension .p7m. Inside there may be a PDF, XML, a spreadsheet or other content. The signature covers the bytes of that content, not a name chosen later.

It is the usual format of a signed electronic invoice, .xml.p7m, and it often appears in tenders, administrative decisions and documents exchanged by PEC (Italian certified email). The practical limit is clear: to read the content you need a tool that opens the envelope. Preview, the phone’s PDF viewer and a generic double-click are not enough.

The reader on this site opens that envelope. Do it from Lettore P7M, by dragging the file or selecting it. The extension does not decide recognition. The bytes do, including standard Base64 and PEM labelled PKCS7, CMS or SIGNED DATA.

What a PAdES signature is

PAdES, PDF Advanced Electronic Signatures, places the signature inside the PDF. The file stays .pdf and opens in a PDF reader. Programs that understand signatures show a box or a panel with the signer. Further signatures can be added in the same PDF.

The limit is symmetrical. PAdES applies to PDFs, not to an invoice XML and not to an archive. Printing the PDF, or using “Save as PDF” from a print dialog, produces a copy without that signature. The new file can look identical on screen and no longer be the signed document.

How to recognise them without guessing

Signal	More likely reading	What to do
The name ends in .p7m	CAdES envelope	Open it with an envelope reader, not with Preview
The name ends in .pdf and a signature panel appears	PAdES	Read it in a PDF reader and keep that file
The name ends in .pdf and there is no signature	Plain copy	Do not treat it as a signed original
The name is .pdf.p7m	A PDF inside a CAdES envelope	Open the envelope and also keep the .p7m

The name can lie. A PDF renamed .p7m is not an envelope. A .p7m renamed .pdf is still an envelope. That is why the reader ignores the extension. If you upload a pure PAdES file, the message says the file does not look like a P7M. That is not a defect in the signed PDF. It is the wrong format for this tool.

What the reader checks, and what it does not

On delibera.pdf.p7m the reader extracts the PDF, shows the pages and reports the checks on the envelope: integrity, the certificate, the available chain and revocation. Revocation may stay unavailable. Countersignatures are not verified. Nested layers, such as delibera.pdf.p7m.p7m, stay separate. A date claimed by the signer is not a time stamp.

If that extracted PDF itself contains a PAdES signature, the reader does not verify it. It verifies the outer envelope. For the inner signature, use a suitable PDF reader and keep both the PDF and the .p7m if both were delivered to you as originals.

The reader does not sign documents, does not issue certificates and does not turn PAdES into CAdES. Signing the same PDF again in CAdES creates a new signature. It does not “convert” the previous signature.

Which format you are asked for

When you are the one signing, the choice depends on who receives the file.

• A PDF for someone who does not use a dedicated tool is often more convenient as PAdES, because it opens in a PDF reader.
• XML, a spreadsheet or a file that is not a PDF needs CAdES if the signature must cover that file.
• A tender portal, an electronic court filing or a public body states the format in the rules or the specifications. Follow that text, not the habit of the office.

The eIDAS regulation distinguishes electronic, advanced and qualified signatures. A qualified signature is the type to which the regulation attaches specific legal effects. CAdES and PAdES are ways of holding the signature, not an automatic judgement on that type. The reader does not make that judgement and does not replace a qualified validation. To obtain a certificate, the guide How to get a digital signature in Italy stays on the practical side of issuance, without naming a preferred provider.

Mistakes that drop the signature

Renaming does not extract. The correct procedure for a .pdf.p7m is extraction, described in Extract a PDF from a P7M file. The extracted PDF does not contain the envelope. It is fine for reading. Do not upload it in place of the .p7m if the recipient asked for the signed file.

Compressing, editing or reassembling pages after the signature can break integrity. If you must correct the text, correct the unsigned original and have it signed again.

In a tender, a .p7m and a PAdES PDF may both be allowed, or the rules may admit just one format. The checklist is in the guide to P7M files in public tenders. In electronic court filings the Ministry specifications remain the source. That is covered in P7M files in Italian court filings.

One morning with both files

The office receives delibera.pdf.p7m by PEC and, an hour later, delibera-firmata.pdf from the same body, sent “for convenience”. Do not treat them as duplicates until you have opened both.

On the .p7m, use the reader, read the pages and note the envelope signer. On the PDF, use a PDF reader and see whether a signature panel exists. You may find three different situations. The PDF is the extraction of the same envelope, with no inner signature: it is a reading copy and the original remains the .p7m. The PDF has a PAdES signature by someone else, added later: there are two signatures in two containers, and the envelope reader sees only the CAdES. The PDF has no signature and is a different version, with a changed date or amount: do not archive it in place of the envelope.

In none of these cases should you rename the PDF to .p7m. If you must send the body “the signed file”, ask which of the two originals it wants, or send the one named by the rules or by the PEC message. The copy you export for a meeting should be named differently, so that on upload day it does not land in the place of the signed file.

Frequently asked questions

Does the reader also verify a PAdES signature?

No. The reader opens CAdES envelopes in CMS format. A PDF signed with PAdES, uploaded on its own, is not treated as a P7M.

Do CAdES and PAdES have the same legal effect?

The effect depends on the type of signature, in particular whether it is qualified, not on the format name alone. The reader does not declare the legal validity of the document.

Can I turn a PAdES file into a .p7m?

You can sign the same PDF again in CAdES. That is a new signature, not a conversion of the signature already present in the PDF.

Can a .pdf.p7m itself contain a signed PDF?

Yes. The reader extracts the PDF bytes and checks the CAdES envelope. It does not verify a PAdES signature inside the PDF.

Keep the two originals apart

Keep the file you received, with its original name, and a reading copy in a separate folder. If you are unsure of the format, open it in the reader only if it is a .p7m envelope. If it is a PDF with an inner signature, use a PDF reader and do not expect a PAdES result from this site. For a first look at envelopes, the guide How to open a P7M file summarises the common checks.