What should I use for digital signatures in PDFs with audit logs?

For PDF digital signatures with audit logs, the best choice is usually:

Use a PKI-based digital signature + timestamping + immutable audit logs

Recommended setup

• Digital signature standard: PAdES for PDFs
• Signature mechanism: X.509 certificate-based cryptographic signatures
• Audit log: an append-only, tamper-evident log storing who signed, when, what version, and verification results
• Timestamping: a trusted RFC 3161 timestamp authority (TSA) so signatures remain verifiable over time
• Key storage: ideally in an HSM or cloud KMS with signing support

Why this is the right fit

• Legally recognized in many jurisdictions
• Verifiable integrity: detects any change to the PDF after signing
• Strong identity binding: ties a signer to a certificate
• Auditability: audit logs can show full signing history and validation events
• Long-term validation: PAdES + timestamps helps with archival and expiration of certificates

If you need “approved sign-off” workflows

You can combine:

• e-signature workflow system for approvals and notifications
• cryptographic PDF signature for the final signed document
• audit trail for every action before and after signing

Good formats/standards to look for

• PAdES for the signed PDF
• X.509 / PKI certificates
• RFC 3161 TSA timestamps
• LTV (Long-Term Validation) support if documents must remain verifiable for years

Tools/libraries

Depending on your stack:

• Adobe Acrobat Sign or DocuSign for managed workflows
• iText, Apryse (PDFTron), DigiCert, GlobalSign, Entrust for enterprise signing
• Open-source libraries can work too, but for audit/compliance, managed or enterprise-grade tooling is usually safer

Practical recommendation

If you’re building this yourself, aim for:

PDF signed with PAdES + certificate in HSM/KMS + RFC 3161 timestamp + append-only audit log + hash of each signed revision

If you want, I can also suggest:

1. a specific architecture,
2. open-source libraries, or
3. a solution based on your compliance needs like eIDAS, HIPAA, SOC 2, or legal admissibility.