pdfpix

Create a digital signature

A digital signature needs a certificate, which is a file that ties a key you hold to your name and is vouched for by somebody a reader already trusts. This guide covers where a certificate comes from, what a self-signed one is worth, and what the signature does and does not cover once it is applied.

What you need before you start

Three things: a private key, a certificate that carries the matching public key and your name, and software that can apply the signature. The free Acrobat Reader can sign with a certificate, and LibreOffice can sign a PDF it exports.

The visual signing tool supplies none of this certificate machinery. Use software that can reach the certificate store on your machine when the recipient needs a verifiable signer.

Where a certificate comes from

A certificate authority issues it after checking who you are, and the check is the product you are paying for. Readers ship with a list of authorities they trust, so a certificate from one of those verifies on somebody else's machine without any setup.

In the European Union the strongest tier comes from a qualified trust service provider, which is the requirement behind a qualified electronic signature. Many countries also put a certificate on a national identity card, which is often the cheapest route if you have one.

Self-signed certificates

You can generate a certificate yourself in minutes and sign with it. The cryptography is identical, so the file is still sealed and any change still breaks the seal. What is missing is the vouching.

A reader that has never seen your certificate shows the signature as untrusted, and the recipient has to install your certificate to clear that warning. Inside a company that is workable. With an outside counterparty it usually is not.

Signing with the certificate

Open the finished document, choose the signing command, pick the certificate, and place the visible box if the software offers one. That box is decoration. The signature exists in the file whether or not anything is drawn on the page.

Some workflows sign invisibly on purpose, which confuses recipients who look for a mark and see none. If the person receiving it is not familiar with signature panels, place a visible box and tell them where to look.

What the signature covers

The whole file, as it stood at that moment. Add a page, rotate one, crop a margin, run it through a compressor, and the hash no longer matches. The reader reports the document as changed since signing.

That is the feature, not a bug, and it is why every tool on this site has to run first. Merging, reordering, rotating and compressing all write a new document out of copied pages.

Keeping the key safe

Whoever holds the private key can sign as you. Keep it in the system keystore or on a hardware token rather than in a folder called certificates, and never mail it to yourself for convenience.

If it leaks, the answer is revocation. The authority publishes that the certificate is no longer valid, and readers checking against that list stop trusting new signatures. Anything signed before the revocation gets murky, which is a good reason not to lose it.

If a certificate is more than you need

Most documents do not need one. A drawn signature settles ordinary agreements every day, and the signature guide covers getting a clean one onto the page in about a minute.

The comparison guide is the one to read first if you are not sure which the other party wants. Guessing wrong in that direction costs a week of email.

Questions people ask

Where do I get a certificate for signing?
From a certificate authority, which verifies who you are before issuing it. In the European Union the strongest tier comes from a qualified trust service provider, and many national identity cards already carry a usable certificate.
Can I make my own certificate?
Yes, and the cryptography works identically. What is missing is trust: readers show a self-signed signature as untrusted until the recipient installs your certificate, which is fine inside one company and awkward outside it.
What happens to the signature if I change one page?
It breaks. The signature covers a hash of the entire file, so any later edit makes the reader report the document as changed since signing. Finish every change before you sign.
Is a certificate signature free?
A self-signed one is. A certificate from a recognised authority is not, because the identity check is what you are paying for. Prices vary by country and by tier, so check the provider directly.
What does a reader show when a certificate signature is valid?
A signature panel with the signer name, the time of signing, and a statement about whether the document changed after that point. If any byte changed, the panel says so. That report is what a certificate buys you, not the appearance of the ink on the page.

Where to go next