BIZSEAL guide
p7m or p7s: attached and detached signatures explained
Both endings come from the same signature format. The difference is where the document is: inside the signature file, or next to it. Knowing which one you have tells you what you need to read it.
Attached: the .p7m file
A .p7m file carries the document inside it. One file is enough: a reader can show the signature and give you the document. This is the usual form for signed invoices, contracts and filings that travel as a single attachment.
Detached: the .p7s file
A .p7s file holds only the signature. The signed document is a separate file, sent beside it. To check the signature, a reader needs both files, because the signature is computed over the document it does not contain.
If you only have the .p7s, you can still see who signed and the certificate details, but not whether the signature matches a document. Ask the sender for the original file, then choose both.
Signed more than once: the .p7m.p7m file
A name such as contract.pdf.p7m.p7m usually means the file was signed more than once. Some programs wrap the signed file in a second envelope; others add the new signature beside the first one in the same envelope. A reader should show every signature it finds and give you the document from the innermost envelope. Each signature can have a different signer.
Several signers in one file
One envelope can also carry several signatures side by side over the same document. A reader lists each signer with its own certificate and its own check.
What to keep
- The signed file exactly as you received it, not only the extracted document.
- For a .p7s, the original document beside it.
- A note of the SHA-256 of the file and the date you read it, if the file matters for a matter or a claim.
Common questions
Why does a .p7s need the original file?
The signature is a check computed over the document. Without the document there is nothing to check it against, so a reader can show the signer but not whether the signature matches.
Is a .p7m.p7m file damaged?
No. The name usually means the file was signed more than once. A reader shows every signature it finds and gives you the document inside.
Does BIZSEAL read PDF signatures?
No. A PDF signed inside the PDF (PAdES) opens in a PDF reader, which shows its signature panel. BIZSEAL reads .p7m and .p7s files.