How to digitally sign a PDF with a .pfx certificate
Open Digital signature, add the PDF, choose your .pfx or .p12 certificate file, type its password and press Sign it digitally.
Digital signatureFree. Nothing is uploaded.
How to do it
- Open Digital signature and add the PDF.
- Choose your certificate file, a .pfx or .p12.
- Type the certificate’s password.
- Leave Show the signature on the page ticked for a visible box, choose the first or last page, and add a reason and a place if you like.
- Press Sign it digitally and save the signed PDF.
How it differs from a drawn signature
A drawn signature is a picture: anyone can copy it onto another page. A digital signature is worked out from the document’s exact contents with a key that only the certificate’s owner holds. A PDF reader can then show who signed it, which authority issued their certificate, and whether even one character has changed since.
DSC on a USB token
In India, a Digital Signature Certificate (DSC) is issued by a licensed certifying authority, and Class 3 is the kind most government portals ask for. Most Class 3 DSCs live on a USB token whose key cannot be copied out. A web page cannot reach a token, so this tool cannot use one: sign with the utility that came with the token.
This tool needs the certificate as a file: a .pfx or .p12, as issued by some employers and organisations, or exported from your own computer. The file and its password stay on your device and are forgotten when you leave the page.
Sign last
Any change after signing breaks the signature, so finish the document first. Fill it in, add page numbers, or make an archive copy with Archive copy (PDF/A), then sign. A locked PDF must be unlocked with Remove a password before it can be signed. An earlier signature on the document stays valid when you add yours.
Getting a .pfx file
Some organisations issue certificates as a .pfx or .p12 file with a password. If a certificate is installed on your own computer, the system’s certificate manager may let you export it with its private key as a .pfx, protected by a password you choose; whether it allows that depends on how the certificate was installed. A certificate on a USB token is built so that its key cannot be copied out at all, which is exactly what makes a token safe.
Checking the signature
Open the signed file in Adobe Acrobat Reader and look at its signature panel. It shows who signed, when, and whether the document has changed since. If it says the signer’s identity is unknown or not trusted, the document can still be unchanged: Acrobat simply does not trust the authority that issued the certificate yet, which the person receiving can change in their own Acrobat settings.
Questions people ask
Will Adobe Acrobat show it as valid?
Acrobat will show that the document has not changed since signing. Whether it also shows your identity as trusted depends on whether it trusts the authority that issued your certificate.
My certificate has expired. Can I still use it?
No. Readers would mark the signature not valid, so the tool refuses and shows the date it ran out. Renew it with whoever issued it.
Is my certificate uploaded?
No. The .pfx and its password are read in your browser, used once, and forgotten. They are never stored or sent anywhere.
Can I just draw my signature instead?
Yes, with Sign, for documents that do not need a certificate.
Can I sign several PDFs in one go?
One at a time. Sign the first and save it, then add the next PDF and sign it the same way.
Can I sign on a phone?
Yes, if the .pfx file is on the phone. Choose it from the phone’s files, type its password, and sign just as on a computer.
Your file stays on your device. Foolscap does the work inside your browser, so nothing is uploaded and there is nothing for anyone to keep. How you can check