Documentation
What Cachet does, what each signature level actually guarantees, and how to sign a batch of documents from start to finish.
Cachet is a batch PDF signer built for Belgian administrative workflows. You point it at a folder, choose how the documents should be signed, place the visible mark once, and it applies the same signature to every file in the batch.
It runs either as a step-by-step graphical wizard or as a console tool, from the same core. Cryptographic signatures follow the PAdES baseline standard (ETSI EN 319 142-1) up to level B-LTA: a trusted RFC 3161 timestamp, revocation data embedded in the document, and an archival timestamp chain — with trust anchors taken from the EU Trusted List for eID signatures, or from your organisation's internal CA for Azure signatures.
Every signed file is re-opened and validated immediately after writing, and the level actually achieved is reported. If the requested level cannot be reached, the document is marked failed. Cachet never silently produces a weaker signature than the one you asked for.
The eID mode uses the card's non-repudiation certificate, which is legally equivalent to a handwritten signature.
Documentation on GitHub
The repository carries the canonical technical documentation, kept in step with the code.
Sections
Each section is its own page. Read straight through, or go to the one you need.
- Features What Cachet does, point by point: whole batches at once, three signing modes, PAdES levels, template validation and output verified on the spot.
- The three modes The eID card, an Azure Key Vault certificate or a plain image stamp — what each one requires, and what legal weight it carries.
- Signing a batch, step by step The eight steps of the graphical wizard, from choosing a template to reading the report, with a screenshot of each.
- Command line The console tool: the commands most batches need, and the options behind them.
- Signature levels PAdES b-b, b-t, b-lt and b-lta — what each level adds, and which ones need network access.
- AES or QES? Simple, advanced and qualified signatures under eIDAS, and which one your documents actually need.
- Requirements What each mode needs at runtime: middleware and a card reader, outbound network access, or nothing at all.
- Installation Download a standalone build for Linux or Windows, or run Cachet from source.
- Glossary The terms Cachet uses, from PAdES and LTV to the national register number embedded in every eID signature.
- Sources The standards and services the signatures rest on, with links to the original documents.
- Things to know What to know before you sign: the national register number, free versus qualified timestamps, and the limits of an advanced signature.