Pular para o conteúdo
ecdsa.com

Inspetor de XAdES (XAdES Inspector)

Cole ou abra um documento XML com assinaturas XAdES. O inspetor verifica cada assinatura XML, determina o nível baseline dela e confere as propriedades das quais uma parte confiável depende.

100% local — tudo roda no seu navegador, nada é enviado a nenhum servidor

Lista de listas de confiança da UE (XAdES baseline B-B)

Fonte: A lista de listas de confiança da UE tal como publicada pela Comissão Europeia em 15/10/2026, sem alterações (Decisão 2011/833/UE da Comissão). Verificada em 20/10/2026.

Até 10 MB
Confiança
Certificados de CA raiz ou emissora: PEM ou DER em base64
Quando a assinatura não traz o próprio certificado
Momento da verificaçãoOs horários estão em UTC.

O que não é verificado

  • Os tokens de carimbo do tempo (SignatureTimeStamp, ArchiveTimeStamp) são encontrados, contados e atribuídos a um nível, mas não são abertos: o horário, a assinatura da TSA e o resumo da mensagem (message imprint) deles não são verificados.
  • Os dados de revogação incorporados para validação de longo prazo são contados, mas não avaliados, e nada é buscado na rede: o status atual do certificado do signatário não é verificado online.
  • A política de assinatura é identificada e o hash dela é informado, mas o documento da política não é obtido nem aplicado.

XML signatures with legal weight

XAdES — XML Advanced Electronic Signatures, ETSI EN 319 132-1 — is how XML documents are signed under the EU's eIDAS regulation: the trusted lists that tell browsers and PDF readers which trust service providers are qualified, e-invoices in many countries, tax filings, court documents. It is an ordinary XML signature with qualifying properties attached: who signed (a reference to the signing certificate), when (a claimed signing time), under which rules (a signature policy), what was signed (the data object formats), and — added later as unsigned properties — time-stamps and the certificates and revocation data needed to validate the signature years from now.

Baseline levels

EN 319 132-1 defines four baseline levels, each building on the previous one:

LevelAddsWhat it gives you
B-Bsigned properties: SigningCertificateV2, SigningTime, DataObjectFormat…a signature bound to its signer's certificate
B-Ta SignatureTimeStamp from a time-stamping authorityproof the signature existed at that time
B-LTcertificates and revocation data (CertificateValues, RevocationValues)validation without contacting anyone, after certificates expire
B-LTAarchive time-stamps over all of itprotection against weakened algorithms, renewable

The older forms of ETSI TS 101 903 — BES, EPES, T, C, X, X-L, A — are still common, and the inspector names both the baseline level and the legacy form it recognises from the properties present.

What the inspector verifies

For every ds:Signature in the document:

  1. The XML signature itself — every Reference resolved and digested after its transforms, and the signature value over the canonical SignedInfo — with the same code as the SAML inspector. References to content outside the document are digested from files you choose, read in the page.
  2. SignedProperties is covered. A reference of type #SignedProperties must point at the signed properties; otherwise everything XAdES adds is unsigned decoration.
  3. The signing-certificate reference: the digest and issuer/serial in SigningCertificate or SigningCertificateV2 must match the certificate that actually verifies the signature — the protection against substituting another certificate of the same key.
  4. The signing time — a valid xs:dateTime with a time zone, not in the future, inside the certificate's validity.
  5. The signer's certificate: subject, issuer, validity, and its QC statements (EN 319 412-5): whether it is an EU qualified certificate, whether the key is on a qualified signature creation device, its type (e-signature, e-seal, website) and the legislation it is qualified under. With trusted certificates you paste, the path from the signer to them is built and checked.
  6. The policy and data object formats, and the level, with notes when the properties present are inconsistent (validation data without a time-stamp, an archive time-stamp without validation data).

The example is the real EU List of Trusted Lists, an enveloped XAdES B-B signature by the European Commission with RSA-SHA512 and SigningCertificateV2, published on 15 October 2026. The XML-DSig pitfalls it shares with SAML are covered in SAML signature validation: what to check and why.