How to digitally sign a PDF with a certificate

Digital signing in PDF by Zaweba starts from the Sign menu. Choose to sign in a box you draw, invisibly, or in an existing signature field, then pick your digital ID: a .pfx or .p12 file, a certificate in the Windows store, or a self-signed ID made in the app. The signature is added to the file, and anyone can check who signed and whether the document has changed since. The app is free and works offline on Windows.

A digital signature is not a picture of handwriting. It's a cryptographic seal tied to a certificate, which is why it can prove things a scanned signature can't.

Getting a digital ID

You need a digital ID, which is a certificate with its private key. There are three sources.

A .pfx or .p12 file is the usual form when an employer, a professional body or a certificate provider issues you an ID. You open it with its password when signing.

A certificate in the Windows store is one already installed on your PC, perhaps by your organisation. The app can use it directly.

A self-signed ID is one you make in the app. It's fine for signing your own records, internal paperwork, or where the other person agrees to trust it. It won't be trusted automatically by strangers, because no outside body vouches for it. Export my certificate saves your public certificate as .cer or .pem, so you can send it to people who want to trust your signatures.

Signing step by step

Open the document and finish every change first. Then choose the Sign menu. To show the signature on the page, draw a box where it should appear, or use a signature field if the form has one. To sign without anything on the page, choose to sign invisibly.

Pick your digital ID and enter its password if it has one, then save. The signature is written as an incremental update, which means earlier signatures in the document stay valid. That's what allows several people to sign the same file one after another.

Standards and strength

Signatures are PAdES or PKCS #7, using SHA-256, 384 or 512. PAdES is the European standard for PDF signatures and is widely accepted. The higher SHA numbers are stronger hashes; SHA-256 is the common default and is accepted almost everywhere.

Before you sign

Preview the document for signing lists any dynamic content, such as scripts, XFA, automatic actions, media and layers. The app never runs scripts or media and shows the static document, so you sign what you can actually see.

If the document should allow only certain changes afterwards, such as filling in forms, sign it as a certifying signature instead. For signatures that must stand up years from now, add a trusted timestamp and long-term validation information.

After signing

View, Signatures panel shows each signature as valid, unknown or invalid, lists changes made after it, and shows the signed version and the certificate. Check your own signature there before you send the file.

PDF by Zaweba keeps your digital ID on your own PC and never sends the document anywhere to be signed.