My organisation, say Acme, is building an e-signature platform where global businesses sign up and use the platform to send out e-signature requests. And when signers in a particular e-sign request sign the document, Acme must digitally sign the document too. Acme needs to do this for all the documents for all the customers that are e-signed through the platform (roughly ~100K per month, for example).

To enable this scenario, I am exploring document-signing certificates and certificate authorities who issue such certificates. Looking at the pricing pages of CAs like entrust and digicert, it appears that they have a cap of x document signing events per year/month.

Speaking with their support, I've learned that they support two types of signing, but both are capped.

  1. Traditionally issued file-based certificate - where the CA provides the HSM with the certificate file, which Acme uses to sign the document.
  2. Cloud-based certificate - where Acme requests them via API with the document hash and the CA issue the certificate.

In both cases, a cap of, say, 10000 signing events annually is applied. How could they track the signing events if Acme digitally signs with the traditional certificate file provided? Shouldn't Acme be able to sign infinite documents within the certificate's validity theoretically? Is there a better feasible way to implement it so that Acme only pays for the certificate and theoretically digitally signs infinite documents?

  • Your company wants to play two roles here: Be a trusted party like a CA of their own. Be a signer without limitation. Seems one to much to me. Basically they want to print money out of thin air.
    – Marcel
    Nov 23, 2023 at 11:10
  • I understand where you are coming from. I'm trying to understand the idea of certificates technically though. If Acme has a certificate file offline rather than cloud, doesn't it mean they can use it to sign infinite documents? How is the 'signing' capped or tracked by the CA? Nov 23, 2023 at 11:21

1 Answer 1


First, a quick review how digital signing works. The signer has a key pair consisting of a private key and a corresponding public key. The signer uses the private key to sign a document. Then, the verifier uses the signer's public key to verify the signature. The public key can be embedded in a certificate, that is signed by a CA, who has authenticated that the public key in fact belongs to the signer.

Both of the scenarios that you described in your question seem to imply that the CA has control of the private key (the first, being in an HSM provisioned by the CA; and the second being in a cloud environment provisioned by the CA). The fact that the CA controls the private key in both of these scenarios enables the CA to restrict its use.

To avoid this problem, you can simply create your own key pair, then request a certificate from a CA which will contain your public key. By doing this, you would maintain control of your private key, and you can use it to sign as many documents as you wish, without restrictions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .