Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
If a certificate authority (CA) asks for CAdES but your Java service creates XAdES, changing the file extension or swapping a cryptographic provider will not solve the mismatch. CAdES is built on Cryptographic Message Syntax (CMS), while XAdES is built on XML signatures. The correct choice depends on the document, the CA’s required profile and packaging, and the validator that will consume the signature.
For general guidance, the European Commission suggests XAdES for XML, PAdES for PDF, and XAdES or CAdES for binary files; several documents may belong in an ASiC container. Those are starting points, not a replacement for the receiving CA’s technical specification. In Java, the European Commission’s open-source Digital Signature Services (DSS) library supports creation, validation and augmentation of both XAdES and CAdES.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →At a glance
| Name | Best for | Key spec | Platforms | Checked |
|---|---|---|---|---|
| CAdES | Binary files and CMS-based workflows | CMS/PKCS#7 structure with CAdES properties | Java through DSS or CMS-compatible tooling | Oct 2026 |
| XAdES | XML documents and XML-aware workflows | XML Signature structure with XAdES properties | Java through DSS and XML-signature tooling | Oct 2026 |
The row that appears to fit your document can still be wrong for a particular CA. Treat the CA’s profile, packaging, policy identifier, algorithms and validation rules as the final interface contract.
What is the difference between CAdES and XAdES?
CAdES and XAdES are advanced electronic-signature formats that attach different structures and properties to a cryptographic signature. They can use certificates and similar cryptographic algorithms, but they are not interchangeable representations.
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
CAdES: CMS for signed bytes
CAdES extends Cryptographic Message Syntax (CMS), also encountered as CMS/PKCS#7. The signature is a CMS object containing signed data, signer information and CAdES attributes. It is a natural fit when the signed payload is treated as an opaque byte sequence rather than parsed as XML.
A CAdES deployment can carry the payload inside the signature or keep it outside as a detached object. The exact encoding, signed attributes and baseline level still have to match the receiving system; “CAdES” by itself does not identify one complete wire format.
XAdES: XML Signature for structured XML
XAdES extends XML Signature. It can identify XML elements or other referenced data and place signature material in an XML structure that XML-aware software can process. That makes it suitable when the recipient needs to select, transform or validate particular XML elements rather than only verify a byte stream.
XAdES can be enveloped (the signature is inside the signed XML), enveloping (the signed object is inside the signature), or detached. Namespace handling, canonicalization, reference URIs and transforms therefore become part of interoperability, in addition to the XAdES properties and baseline level.
How should the document type determine the format?
Start with the object being signed, then check whether the CA overrides the general recommendation. The European Commission’s eSignature FAQ states: “XML documents are suggested to be signed/sealed using XAdES signature format (either with enveloped or enveloping packaging); PDF documents are suggested to be signed/sealed using PAdES signature format; Binary files are suggested to be signed/sealed with XAdES or CAdES signature formats (with enveloping packaging).”
| Input or use case | General suggestion | What to confirm with the CA |
|---|---|---|
| XML document | XAdES, usually enveloped or enveloping | Which XML element is signed, reference and transform rules, and the required XAdES level |
| PDF document | PAdES rather than either CAdES or XAdES | Whether the CA accepts a separate signature object or requires an embedded PDF signature |
| Binary file | XAdES or CAdES, with enveloping packaging suggested by the Commission | Whether the payload must be embedded, detached or internally detached, and which format the validator parses |
| Several documents | ASiC container | Container profile, manifest rules and whether each member also needs an individual signature |
The Commission explicitly describes these as basic-usage suggestions. A sector-specific CA, government gateway or procurement portal can require a different combination.
Also popular on Amazon
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Why does a CA reject a signature even when the certificate is valid?
A valid certificate proves only part of the contract. The receiving service may reject the signature because its format, packaging, profile, signed properties, policy or algorithm constraints differ from what your application produced.
Format and packaging
A validator expecting an XML Signature cannot consume a CMS object as XAdES merely because both contain a certificate. Conversely, a CMS endpoint may reject an XML signature. Within one format, an enveloped, enveloping, detached or internally detached arrangement can also be significant: the validator must know where to find the signed bytes and how to resolve references.
Baseline profile and level
The DSS documentation describes baseline profiles for XAdES and CAdES and the levels commonly named B, T, LT and LTA. The level indicates the class of signature and the evidence or augmentation material expected by the validation policy. Selecting a higher-sounding level without supplying the required timestamps, certificate material or revocation evidence does not make a signature acceptable.
Ask the CA for the exact baseline level, any profile-specific constraints and the policy identifier it uses. If the specification names a profile version or an ETSI standard part, preserve that wording in your implementation requirements.
Properties, policy and algorithms
CA rules can require particular signed or unsigned properties, a policy identifier, certificate-chain material, OCSP responses or CRLs, and permitted digest or signature algorithms. These details are independent of the broad CAdES-versus-XAdES label. A signature can therefore be structurally correct yet fail policy validation.
Which Java library should handle CAdES and XAdES?
For an application that must create, validate or augment both formats, the European Commission’s Digital Signature Services (DSS) project is a concrete Java option. Its documentation covers XAdES and CAdES, ETSI standards, baseline profiles, packaging, trust management, certificate-chain building, OCSP and CRL handling, validation policies, creation, validation and augmentation.
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Check the current DSS release and required modules in the project documentation before adding dependencies. Keep the selected modules aligned with the format and profile you actually need; a library that can parse one format does not automatically create every profile of the other.
Read the DSS documentation and the DSS project overview for the supported standards and capabilities.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Where does Bouncy Castle fit?
Bouncy Castle’s interoperability material documents CMS/PKCS#7 support, which is relevant to a CMS-based CAdES path. That page alone does not establish support for every CAdES baseline profile, XAdES creation, packaging variant or validation policy.
A cryptographic provider supplies primitives and container operations; a complete signature service also has to build format-specific properties, manage profiles, assemble evidence and apply trust and validation rules. Adding a provider is therefore not a substitute for selecting a signature library and configuring the CA’s contract.
See Bouncy Castle’s specification and interoperability information for the CMS/PKCS#7 scope it documents.
How do I change a Java application from XAdES to CAdES, or the reverse?
Make the change as a contract migration, not as a one-line algorithm switch. The following sequence keeps the document, profile and validation decisions explicit.
Also popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Widely Compatible: Transform any USB-C port into a USB-A port and USB-A port into a USB-C port, and connect up a wide range of USB-C(including MacBook, iPad Pro/Air/Mini, iPhone models with USB C ports, Samsung Galaxy series, and Google Pixel series. ) and USB A devices(including external hard drives, phones, mice, printers, and more)
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Capture the CA specification. Record the required format, baseline level, packaging, policy identifier, algorithms, certificate-chain rules, revocation evidence, timestamp requirements and any sample signature or test endpoint. If the CA is unnamed or its guide is unavailable, those values cannot be inferred from general guidance.
- Classify the payload. Decide whether the input is XML, PDF, one binary file or multiple files. For XML, identify the element or document node that must be signed. For a binary payload, determine whether the recipient expects the bytes embedded in the signature or delivered separately.
- Select the matching DSS capability. Use the XAdES path for an XML-signature contract and the CAdES path for a CMS contract. Include the modules needed for creation and, separately, validation or augmentation if your workflow adds timestamps or revocation evidence later.
- Set packaging deliberately. Configure enveloped, enveloping, detached or internally detached packaging exactly as the CA specifies. Do not rely on a library default, because two signatures with the same format name can place the payload and references differently.
- Set the baseline level and properties. Map the CA’s requested B, T, LT or LTA level to the corresponding DSS profile configuration. Supply the mandated signed properties, policy identifier, certificate chain and validation evidence; do not add or omit properties merely because another validator accepts them.
- Provide trust and revocation inputs. Configure the trust anchors and certificate-chain building rules used by the CA’s policy. If the required level calls for OCSP or CRL evidence, make sure the signing and augmentation stages can obtain and embed the responses in the expected form.
- Generate a deterministic test artifact. Keep the original payload unchanged, record the signature format and packaging, and retain the resulting signature plus validation report. This gives the CA a reproducible artifact without implying that local validation guarantees remote acceptance.
- Validate against the CA contract. Run the DSS validator with the applicable validation policy, then submit the artifact to the CA’s stated test endpoint or compare it with the CA’s known-good sample. Resolve the first structural or policy error before changing cryptographic algorithms.
- Deploy with format-specific monitoring. Log the selected profile, packaging, policy identifier and validator result, while protecting private keys and signed content. A later profile or certificate-policy change should be treated as a controlled configuration update.
What should be checked before production?
Use a two-layer acceptance check: first verify that the artifact has the intended structure, then verify that it satisfies the receiving policy.
Structure checklist
- The signature is actually CAdES/CMS or XAdES/XML Signature as required, rather than the other format wrapped in a similarly named file.
- The payload is present in the expected location and can be recovered without ambiguity.
- XML references, canonicalization and transforms resolve to the intended bytes, or CMS signed content matches the detached payload exactly.
- The certificate chain and signer information are included in the locations and forms expected by the profile.
- The selected baseline level and required properties are present.
Policy checklist
- The trust anchor and certificate policy are accepted by the CA.
- Digest and signature algorithms meet the CA’s current constraints.
- Timestamp, OCSP and CRL evidence meets the requested level and freshness rules.
- The policy identifier and any mandated signing-time or commitment properties match the CA guide.
- The artifact passes the CA’s validator or test service, not just a local parser.
What are the practical trade-offs between CAdES and XAdES?
| Decision factor | CAdES implication | XAdES implication |
|---|---|---|
| Payload model | Convenient for opaque bytes and CMS-oriented gateways | Useful when XML structure and references must remain visible to XML processors |
| Packaging sensitivity | Detached versus embedded CMS content must match the consumer | Enveloped, enveloping and detached XML arrangements affect references and parsing |
| Interoperability target | Best when the CA specifies CMS/CAdES and its profile | Best when the CA specifies XML Signature/XAdES and its profile |
| PDF input | Neither is the Commission’s general suggestion; PAdES is suggested | Neither is the Commission’s general suggestion; PAdES is suggested |
| Multiple files | May be placed in a container if the CA supports it | May be placed in an ASiC container if the CA supports it |
These are format-level trade-offs, not a ranking of cryptographic strength. In a regulated workflow, acceptance by the designated validator is the deciding criterion.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What are the common migration failures and their fixes?
“The CA says CAdES, but the output is an XML file.”
Inspect the actual signature object rather than its filename. If it is an XML Signature, configure a CMS/CAdES profile and regenerate the artifact; renaming the extension cannot change its internal structure.
“The CAdES object verifies locally but is rejected remotely.”
Compare the baseline level, packaging, policy identifier, certificate chain and revocation evidence with the CA guide. A generic CMS verification result may not apply the CA’s policy rules.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems“XAdES validation fails after an XML transformation.”
Check the signed references, canonicalization and transforms against the exact XML sent to the validator. Whitespace, namespace changes or moving the signed element can alter the referenced bytes even when the document appears equivalent to a human reader.
“A provider upgrade changed acceptance.”
Separate provider changes from profile configuration. Reproduce the artifact with the same payload, profile and packaging, then inspect algorithm identifiers and encoded signed attributes; a provider can affect CMS operations without supplying the complete XAdES or CAdES policy layer.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
“The CA gives no profile or sample.”
Do not guess. Request a technical specification or known-good signature that states format, packaging, baseline level, algorithms, policy and evidence requirements. Until those values exist, only the general document-type suggestions can be stated with confidence.
How do long-term validation levels affect the design?
Baseline levels are a lifecycle choice as well as a creation choice. A basic level may be sufficient for immediate verification, while higher levels require additional validation material or archival evidence and often a later augmentation step.
Recommended Free Tools
Plan who obtains timestamps, OCSP responses or CRLs, when they are embedded, how trust lists are updated and how archived signatures are revalidated. The CA’s policy determines the exact evidence, timing and retention rules; the labels B, T, LT and LTA should not be treated as interchangeable presets.
Which official references explain the format choice?
The European Commission eSignature FAQ provides the document-type suggestions and the ASiC guidance for multiple documents. The DSS documentation explains supported XAdES and CAdES standards, profiles, packaging, trust management and validation. The DSS project page describes the Java service, while Bouncy Castle’s interoperability page documents its CMS/PKCS#7 scope.
Frequently Asked Questions
Can a CMS signature over an XML file count as XAdES?
No. CMS can sign the bytes of an XML file, but the resulting object remains CMS/CAdES rather than an XML Signature/XAdES object. The receiving system’s required format determines which structure must be generated.
Do I need CAdES or XAdES for a PDF?
The European Commission’s general suggestion for PDF is PAdES. Use CAdES or XAdES only when the receiving CA explicitly specifies one of them for the PDF workflow.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can I convert an existing XAdES signature into CAdES without resigning?
Usually not as a format-preserving conversion: the signature container, signed attributes and payload references are different. Preserve the original evidence, then create a new signature in the CA-required format with the appropriate key and policy.
What information should I ask a CA for before coding?
Request the exact format and baseline level, packaging mode, policy identifier, accepted algorithms, certificate and revocation requirements, timestamp rules, validation endpoint and a known-good sample. Those details turn a broad request such as “send CAdES” into an implementable Java contract.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
