Need raw certificate/key to sign PDFs via Java app. But vendors seem to only sell HSMs for this. What to do?

Question

Our organisation wants to purchase a digital signature certificate for signing financial PDF documents. We want to automate this process, so we'll be having Java code do the signing work. For that the only way, supposedly, is to keep the certificate as a file on the server.

I've contacted many digital certificate vendors and with none it was possible to get a basic certificate file. All were issuing a hardware token such as pen drive, USB dongle etc. which contain certificate file in non-extractable format. None give the option to download.

Why is that? Is there some regulation that digital signature certificate can only be given in form of hardware token for security reasons? If not, then which vendors allow to download certificates on system?

Any suggestion or reference is appreciated.

Answer 1

Is there some regulation that digital signature certificate can only be given in form of hardware token for security reasons?

I'm not sure what Adobe requires of you but it seems to hint in the "secure hardware only" direction.

If you want to use Adobe Certified Document Services, then indeed, you must fulfill some requirements:

6.1.5 Key Sizes

CDS Subordinate CAs shall use an RSA key pair with at least 2048 bits.
CDS Subscriber certificates shall use an RSA key pair with at least 2048 bits.

And further on this: (line breaks added for readability)

6.2 Private Key Protection
6.2.1 Standards for Cryptographic Module
Standards for cryptographic modules to be adhered to in the CDS PKI are decided by the Adobe Policy Authority.

CDS Subordinate CAs must use cryptographic hardware modules that meet or exceed FIPS 140-1 Level 3 standards.

CDS Subscribers must use cryptographic hardware modules that
(a) meet or exceed FIPS 140-1 Level 2 standards or
(b) for which the cryptographic hardware module manufacturer has applied for FIPS 140-1 Level 2 status within the previous year without receiving a notice of noncompliance or other communication indicating that such device fails to meet such standard.

But: I don't know if "Adobe Certified Document Services" is indeed the only way to get a PDF signed so that it will be recognized by Adobe Reader out of the box.

There may be other ways. I don't know. But we now know this: if you want Adobe CDS, then you need special key storage hardware.