CAdES vs XAdES Digital Signatures in Java: The Differences That Matter When Your CA Asks for One and You've Built the Other
A digital signature is basically a wax seal with DNA: it doesn't matter if the envelope travels by train, plane, or stuffed in someone's backpack — if the recipient breaks the seal or tampers with the contents, you'll know. The problem is there are two types of wax seal in the CMS/XML world. They share the same name on the brochure ("ETSI advanced signature"), but you can't swap one for the other. And when the Certification Authority hands you back a validation error, the fix isn't in the error message — it's three steps back, in having picked the wrong format from the start.
My position is concrete: CAdES and XAdES are not variants of the same standard. They're formats built for different domains, with different data structures and different trust assumptions baked in. Choosing wrong isn't a technical inconvenience you patch later — it's a document that fails validation on the receiving end, even when the cryptographic signature itself is perfectly valid. I've seen the confusion come from the same place every time: someone reads "advanced signature" in a spec sheet and assumes that's the whole answer.
