Sign PDF with Digital Certificate

Add a cryptographic digital signature to your PDF using X.509 certificates. Supports PKCS#12 (.pfx, .p12) and PEM formats. Your private key never leaves your browser.

Internet connection required

Signing may need to fetch certificate chain information from your certificate issuer's server to validate the signature.

Click to select a file or drag and drop

PDF Documents

Your files never leave your device.

What Is a Digital Signature?

A digital signature is not a picture of a signature. It is a cryptographic value computed over the exact bytes of your PDF using a private key, and it can be checked by anyone holding the matching certificate. If a single byte of the document changes afterwards, verification fails. That is what separates a digital signature from a scanned squiggle, which proves nothing at all.

This tool takes your existing X.509 certificate - a PKCS#12 file (.p12 or .pfx) or a PEM certificate with its private key - and uses it to sign the document. You can attach a visible stamp showing the signer, the reason, the location and the date, or sign invisibly and let the signature live in the file structure.

Signing happens entirely in your browser. Your private key is read into memory, used, and released. It is never uploaded, and no third party ever sees it.

What a digital signature gives you

  • Tamper evidence: any later edit to the document breaks verification
  • Signer identity: the certificate names who signed, as vouched for by a certificate authority
  • Trusted time: add an RFC 3161 timestamp so the signing moment is independently attested
  • Workflow acceptance: many contract, procurement and public-sector portals require a signed PDF
  • Long-term validity: with a timestamp, signatures stay verifiable after the certificate expires

Key Features

  • ✓ X.509 / PKCS#12 support
  • ✓ PEM certificate + key
  • ✓ Visible or invisible
  • ✓ RFC 3161 timestamping
  • ✓ Certificate preview
  • ✓ Private key stays local

How to Digitally Sign a PDF

1

Upload the PDF

Select the document you want to sign. If the file is password-protected, you will be asked for its password and it will be unlocked locally.

2

Load your certificate

Add your PKCS#12 file and its password, or a PEM certificate with its private key. The signer, issuer and validity dates are shown so you can confirm it is the right one.

3

Sign and download

Optionally add a visible stamp and a timestamp, then sign. The signed PDF downloads with the signature embedded.

Signing Correctly

Recommended practice

  • Sign last: finish every edit before signing, since any change invalidates it
  • Add a timestamp: it fixes the signing moment and keeps the signature valid after the certificate expires
  • Use a visible stamp when the reader may not have a signature panel
  • Keep the signed copy exactly as downloaded, without re-saving it

Where to get a certificate

  • Commercial CAs (DigiCert, Sectigo, GlobalSign) issue document-signing certificates
  • A self-signed certificate works for internal use but will show as untrusted to outsiders
  • Free personal certificates exist for some countries and academic networks
  • The certificate must be valid for digital signatures, not just for TLS

Frequently Asked Questions

It never leaves your computer. The certificate file is read into browser memory, the signature is computed locally, and the key is released when you close the page. There is no server component that could see it.
PKCS#12 files (.p12 or .pfx) protected by a password, and PEM files containing a certificate together with its private key. PKCS#12 is what most certificate authorities issue, so it is the usual choice.
This tool applies a cryptographic signature backed by an X.509 certificate - it proves integrity and, through the certificate, identity. The Sign PDF tool draws a handwritten signature image onto the page, which looks right on screen but proves nothing cryptographically. Use this one for anything that matters.
A timestamp proves the signature existed at a specific moment. That matters because certificates expire: without a timestamp, a signature made today stops verifying once the certificate lapses. With one, verification stays valid indefinitely. You can also timestamp a file on its own with the Timestamp PDF tool.
Yes. PDF supports multiple signatures, and each one covers the state of the document at the time it was applied. Signing a file that already carries a signature does not invalidate the earlier one, provided the earlier signature was made before the edit you are adding.
The signature itself is standard and verifiable everywhere. Whether a reader shows a green check depends on whether it can build a trust path to the certificate authority - which is why certificates from a public CA look better than self-signed ones. Uncertainty about the root does not mean the document was altered.
Yes. When you upload an encrypted file, the tool asks for the password and unlocks it locally before signing. The unlocked document is the one that gets signed, so the output is not password-protected.
It adds a new visual element on top of the page - nothing underneath is modified. If you would rather not alter the appearance at all, leave the visible stamp switched off and the signature will only exist in the file structure.

Related PDF Tools

Timestamp PDF

Add an RFC 3161 timestamp

Validate PDF Signature

Check existing signatures

Sign PDF

Draw a handwritten signature

Create Fillable Form

Build a form to sign

Flatten PDF

Lock a finished form

Sanitize PDF

Remove hidden data first

PDF Editor

Finish edits before signing

Merge PDF

Combine before you sign

Extract Pages

Sign only part of a file