How to verify an e-imza signed document in Turkey (PDF, .imz and e-Devlet barcodes)

Turkey was an early adopter of legally binding electronic signatures, and e-imza is used daily in public administration, courts, notaries, company filings and business. Documents arrive in several forms, and each is checked differently.

The short answer

The legal background, briefly

• Law No. 5070 on Electronic Signatures (2004) defines the secure electronic signature (güvenli elektronik imza), created with a secure signature-creation device and based on a qualified electronic certificate (nitelikli elektronik sertifika). A secure electronic signature has the same legal effect as a handwritten signature, with exceptions set out in the law: legal transactions that the law subjects to an official form or a special ceremony, and guarantee contracts. Other than bank letters of guarantee and surety bonds issued by insurers established in Turkey. Cannot be made with it.
• The Information and Communication Technologies Authority (BTK) authorises and supervises the certification service providers that issue qualified certificates.
• The public sector's own certification authority issues certificates to public officials; several private providers issue certificates to citizens and businesses.

PDFs with an embedded e-imza (PAdES)

Many institutions sign PDFs in PAdES form, so the signature lives inside the PDF. To check one:

1. Upload it, exactly as received, to Verify PDF Signature.
2. Look for Signature: Valid and Unchanged since [name] signed it.
3. Read any changes after signing. On a contract or official letter, a changed page is a warning; a later signature is normal.
4. In Certificate details, check the Issued by and Certificate chain: the chain should run from the signer through the provider's certification authority to its root. For qualified certificates, the certificate policy information will reflect that.

Our Trust row may show Not trusted because a Turkish provider's root is not on this service's list, and Adobe may show "validity unknown" for the same reason. That is about the list. For the legal assessment, use a Turkish e-imza verification application.

.imz files

Turkish e-imza software commonly produces .imz files. CAdES containers in which the original document is wrapped inside the signature, like the .p7m files used in Italy. A PDF reader cannot open them directly, and a PDF signature checker cannot read them.

To verify and open an .imz file:

• Use a Turkish e-imza application. The public certification centre, Kamu SM (part of TÜBİTAK), offers İmzager, which opens .imz and .p7s files and validates the signatures in them; creating timestamped or long-term signatures needs its paid edition. Commercial e-imza providers ship their own tools.
• The application shows whether the signature is valid and who signed, and lets you extract the original document.
• The extracted document is an unsigned copy. Keep the .imz as the signed original.

More on these formats in My signed file is .p7m, .p7s, .imz or .xml, not PDF.

Documents from e-Devlet

Documents you obtain through e-Devlet (türkiye.gov.tr): records of residence, criminal-record certificates, student certificates, SGK service records and many others. Carry a barcode and a verification number. The recipient verifies them through e-Devlet's Barkodlu Belge Doğrulama (barcoded-document verification) service, run through the e-Devlet gateway together with the institutions that issue the documents.

How to use it:

1. Open e-Devlet's document verification service on the official site you found yourself.
2. Enter the barcode number printed on the document, usually a code of letters and digits near the barcode.
3. Many documents then ask for a second detail, typically the T.C. identity number of the person the document belongs to. Ask the holder for it if you do not have it.
4. Compare what the service returns with your copy.

On a phone, the e-Devlet mobile app can scan the QR code on the document instead, which saves typing the barcode number.

That check is stronger than any file check: it compares the document you have with the record the state issued. Compare every detail. Reach the service through the official e-Devlet site you found yourself, not through a link.

KEP (registered electronic mail)

Official correspondence between businesses and public bodies often travels by KEP, which proves when a message was sent and received. KEP evidence is about the delivery; any signed attachment still needs its own signature check.

Common real-life situations

"The PDF has an e-imza, but Adobe shows a question mark"

Adobe on your computer does not recognise the Turkish provider's root. Check integrity here or in Adobe; if you need a legal assessment, use a Turkish e-imza application. See Why Adobe says “Signature validity is unknown”.

"I received an .imz but need to send a PDF"

Extract the PDF with an e-imza application for reading, but send the .imz where proof is needed. If the recipient needs a signed PDF, the signer must sign in PAdES form.

"Someone sent an e-Devlet document as a PDF with no barcode"

Documents from e-Devlet normally carry a barcode. Ask for the original, or ask the person to share it in a way you can verify.