# ASiC-E certificate verification: reading the signer's certificate

> Every signature in a container carries the signer's certificate. ASiC-E certificate verification means reading that certificate and asking two questions: whose is it, and was it valid at the moment of signing?

Source: https://asiceviewer.com/en/blog/asice-certificate-verification/
Published: 2026-11-10 · Digixy

## In short

- The certificate binds a public key to a person or organisation.
- What matters is validity at signing time, not today.
- Proof of that validity is an OCSP response stored in the signature.

## What a signing certificate contains

| Field | Example | Meaning |
| Subject common name | `MÄNNIK,MARI-LIIS,47101010033` | Surname, given name, personal code |
| Serial number | `PNOEE-47101010033` | Unique identifier of the person |
| Organisation | A company name | Present on e-seal certificates |
| Issuer | `ESTEID2018` | The certificate authority |
| Valid from / to | Five-year period | When the certificate may be used |
| Certificate serial | Long hexadecimal number | Identifies this certificate at the issuer |

[ASiCE Viewer](https://asiceviewer.com/en/#tool) decodes these fields from the certificate embedded in each signature and lists them under **Details**.

## Person or organisation?

A personal certificate names a human being and yields a signature. An organisation's certificate yields an **e-seal**: proof that a document comes from a company or authority, without naming an individual. In the signer field an e-seal shows an organisation name and a registry code instead of a personal code.

## Valid then, expired now

Certificates expire, typically after a few years, and people replace their ID-cards. That does not undo earlier signatures. The rule is:

> A signature is judged by the certificate's status at the time of signing, proven by a time stamp and a revocation response.

So a contract signed in 2019 with a certificate that expired in 2022 remains valid, provided the container holds that proof. The viewer shows the line "Certificate valid at signing time" for exactly this reason.

## How revocation is proven

At signing time the software asks the issuer's OCSP service: "is this certificate good right now?" The signed answer is embedded in the signature. Together with the time stamp it lets anyone confirm, years later and offline, that the certificate was neither revoked nor suspended.

## What a viewer checks and what it does not

- **Checked:** the fields are displayed, and the signing time is compared with the validity period.
- **Not checked:** the chain from the certificate to a trusted root, and the authenticity of the OCSP response.

The second group is the job of a validator; see [ASiC-E signature verification](https://asiceviewer.com/en/blog/asice-signature-verification/).

## Certificates from other countries

Latvian, Lithuanian and other EU certificates follow the same structure with different issuers and identifier prefixes. The viewer displays them all; trust evaluation again belongs to a validator with the EU trusted lists. The [Android app](https://play.google.com/store/apps/details?id=com.digixy.asiceviewer&hl=en&referrer=utm_source%3Dasiceviewer.com%26utm_medium%3Dblog-md) shows the same certificate details on a phone.

## Frequently asked questions

**The signer's certificate has expired. Is the signature invalid?**

No, as long as the certificate was valid when the signature was made and the container holds a time stamp and revocation data proving it.

**What is the difference between a signature and an e-seal?**

A signature is made by a named person. An e-seal is made with an organisation's certificate and proves the document's origin, not an individual's approval.

---

Open your .asice file now: https://asiceviewer.com/en/
ASiC-E Viewer on Google Play: https://play.google.com/store/apps/details?id=com.digixy.asiceviewer