Digital signature with certificate
Sign a PDF with your own .p12 or .pfx certificate. The certificate, its password and the file stay on this device.
Your certificate
- Issued to
- Issued by
- Valid until
- Key
Signature box
Without a box, the signature is still in the file. PDF readers list it in their signature panel.
Tap the page to move the box.
Reason and place (optional)
Only a fingerprint (hash) of your signature is sent, through pdfMB, to the free time-stamp service FreeTSA. The PDF, the certificate and the password are not sent.
A digital signature shows which certificate signed the file and whether the file changed afterwards. How far others trust it depends on who issued your certificate. pdfMB does not issue certificates and does not claim that a signature made here meets any law or rule.
Signing your PDF…
Working on your device. Nothing is uploaded.
0%
Done
The time-stamp service did not answer, so the file was signed without a time stamp. The signing time comes from your device’s clock.
Download signed PDFDo not edit the signed file with other tools. PDF readers show any change made after signing.
Your certificate stays open in this tab only, so you can sign another file. Closing the tab removes it.
A digital signature shows which certificate signed the file and whether the file changed afterwards. How far others trust it depends on who issued your certificate. pdfMB does not issue certificates and does not claim that a signature made here meets any law or rule.
- No uploadYour file stays on this device.
- Your original stays as it isYou download a new copy. Your file is never changed.
- Free, no sign-upNo account and no daily limit.
What happens to your file and your certificate
Everything below happens inside your browser, on your own device. The PDF, the certificate file and its password are never uploaded, so nobody else, including us, can see them.
- Your browser opens the certificate file with the password you type. The private key is kept in the browser’s own cryptography system, set so it cannot be copied out, and only for as long as this tab is open.
- pdfMB adds the signature to the end of the PDF without rewriting what is already there, so any earlier signatures stay valid.
- The signature uses the PAdES format with a SHA-256 or stronger hash, the format that Adobe Acrobat and the EU signature validator read. With a time stamp it is level B-T, without one it is level B-B.
- Before you get the file, pdfMB checks the new signature again. If the check fails, you get an error instead of a broken file.
- Choose a PDF
- Open your .p12 or .pfx certificate
- Place the signature box
- Sign and download
How to sign a PDF with a certificate
- Choose the PDF you want to sign.
- Choose your .p12 or .pfx certificate file, type its password and press “Open certificate”. Check that the name shown is yours.
- Choose the page and corner for the signature box, or turn the box off. You can add your handwritten signature to the box.
- Press “Sign PDF”, then download the file. Use “Check the signature” to see what other people will see.
When people use it
Documents that ask for a digital signature
Some offices and companies ask for PDFs signed with a certificate instead of a picture of a signature. Sign with the certificate they gave you or accept.
Showing a file has not been changed
Anyone who opens the signed PDF can see whether it was changed after you signed it.
Several people signing one file
Each person signs in turn. Earlier signatures stay valid because each signature is added after the others.
What it can’t do
- pdfMB does not issue certificates. Signatures are only as trusted as the certificate you use: a self-signed certificate proves nothing about who you are.
- Browsers cannot read ID cards, USB tokens or the certificates stored in Windows or macOS. You need the certificate as a .p12 or .pfx file.
- The time stamp comes from FreeTSA, a free service with no guarantee. If it does not answer within 10 seconds, the file is signed without a time stamp. Whether a PDF reader trusts the time stamp depends on whether it trusts FreeTSA.
- Password-protected PDFs, and PDFs certified with “no changes allowed”, cannot be signed.
Questions about digital signatures
What is the difference from the Sign PDF tool?
Sign PDF adds a picture of your signature, which nobody can check. A digital signature is made with your certificate’s private key. PDF readers can check which certificate signed the file and whether it changed afterwards.
Does my certificate or password leave my device?
No. The certificate file, its password and the PDF are handled only inside your browser. pdfMB has no server that receives them.
Is a signature made here legally valid?
pdfMB cannot promise that. It depends on your certificate, on the law where you are, and on who receives the document. Ask them which kind of signature they accept.
Why does Adobe Reader say the signer’s identity is unknown?
Adobe Reader only trusts certificates from authorities on its trusted lists. A self-signed certificate, or one from an authority Adobe does not list, shows as unknown even though the file has not changed.