XAdES-Inspektor

XML signatures with legal weight

XAdES — XML Advanced Electronic Signatures, ETSI EN 319 132-1 — is how XML documents are signed under the EU's eIDAS regulation: the trusted lists that tell browsers and PDF readers which trust service providers are qualified, e-invoices in many countries, tax filings, court documents. It is an ordinary XML signature with qualifying properties attached: who signed (a reference to the signing certificate), when (a claimed signing time), under which rules (a signature policy), what was signed (the data object formats), and — added later as unsigned properties — time-stamps and the certificates and revocation data needed to validate the signature years from now.

Baseline levels

EN 319 132-1 defines four baseline levels, each building on the previous one:

The older forms of ETSI TS 101 903 — BES, EPES, T, C, X, X-L, A — are still common, and the inspector names both the baseline level and the legacy form it recognises from the properties present.

What the inspector verifies

For every ds:Signature in the document:

1. The XML signature itself — every Reference resolved and digested after its transforms, and the signature value over the canonical SignedInfo — with the same code as the SAML inspector. References to content outside the document are digested from files you choose, read in the page.
2. SignedProperties is covered. A reference of type #SignedProperties must point at the signed properties; otherwise everything XAdES adds is unsigned decoration.
3. The signing-certificate reference: the digest and issuer/serial in SigningCertificate or SigningCertificateV2 must match the certificate that actually verifies the signature — the protection against substituting another certificate of the same key.
4. The signing time — a valid xs:dateTime with a time zone, not in the future, inside the certificate's validity.
5. The signer's certificate: subject, issuer, validity, and its QC statements (EN 319 412-5): whether it is an EU qualified certificate, whether the key is on a qualified signature creation device, its type (e-signature, e-seal, website) and the legislation it is qualified under. With trusted certificates you paste, the path from the signer to them is built and checked.
6. The policy and data object formats, and the level, with notes when the properties present are inconsistent (validation data without a time-stamp, an archive time-stamp without validation data).

The example is the real EU List of Trusted Lists, an enveloped XAdES B-B signature by the European Commission with RSA-SHA512 and SigningCertificateV2, published on 15 October 2026. The XML-DSig pitfalls it shares with SAML are covered in SAML signature validation: what to check and why.