I've created a few certificates to use myself, but I find myself stumped when it comes to creating a certificate which contains a digital signature. First, how would I go about creating a standard certificate which no longer contains only common fields, but ones containing a digital signature as well. And second, how could I manually append this certificate as data to the corresponding pdf file?


5 Answers 5


According to your comments to other answers, you actually want to

sign a pdf file with [your] certificate, then have this signature saved and appended to the pdf [you]'ve just signed.

(BTW, you sign with the private key associated with the public key in your certificate, not with the certificate itself, but that's a detail.)

I assume you want to "append" the signature to the PDF in a way that a standard conform PDF viewer (e.g. Adobe Reader) will recognize, display, and validate as an integrated PDF signature.

In that case you already started wrong by signing the original PDF as is and expecting to now have to merely somehow append that signature to the file. Instead you have to build a new revision of the PDF document which includes a PDF AcroForm signature field whose value is a signature dictionary whose /Contents entry contains the signature of the whole new revision with the exception of the /Contents entry contents.

Signature embedded in PDF

If multiple signatures are to be integrated into a PDF, this is done by means of incremental PDF updates (explicitly not by adding multiple SignerInfo structures to a single integrated CMS signature container!):

Multiple signatures and incremental updates

This is explained quite graphically and in more detail in the Adobe document Digital Signatures in a PDF. It furthermore is specified in the PDF specification ISO 32000-1:2008 made available here by Adobe in section 12.8 Digital Signatures.

Be aware, though! The specification says:

A byte range digest shall be computed over a range of bytes in the file, that shall be indicated by the ByteRange entry in the signature dictionary. This range should be the entire file, including the signature dictionary but excluding the signature value itself (the Contents entry). Other ranges may be used but since they do not check for all changes to the document, their use is not recommended.

This seems to allow that you first create a signature for the original PDF and then append a new revision holding that signature indicating that range of signed bytes only contains that original revision, not the extended revision without only the signature.

In reality, though, PDF viewers (especially Adobe Reader) will only accept signatures which follow the recommendation that the signed range should be the entire file, including the signature dictionary but excluding the signature value itself.

Newer specifications, e.g. the ETSI PAdES specification ETSI TS 102 778 (cf. section 5.1 item b in part 2 and section 4.2 item c in part 3) even make this recommendation officially a requirements, and so will ISO 32000-2.

Depending on your programming context, there are many PDF libraries supporting the creation of integrated PDF signatures and also many products using these libraries. Some of them are even available for free subject e.g. to the AGPL.

  • Great answer and an interesting read. Ironically I just finally got around to hooking my personal cert up to Acrobat the other day, so seeing how they actually handle it in the file format is quite fascinating. May 1, 2013 at 4:18
  • Does incremental updates mechanism allow you to add a new page of content in a new revision to an already signed PDF file and add a second signature?
    – AlexandruC
    Oct 18, 2016 at 15:44
  • Or is that prohibited in approval type signatures ?
    – AlexandruC
    Oct 18, 2016 at 16:04
  • The incremental updates mechanism allows effectively any kind of changes to the document. But only a very few types of changes to a signed document are allowed by the signature! For some details cf. the stackoverflow documentation page on Allowed and disallowed changes to a signed document.
    – mkl
    Oct 18, 2016 at 16:59
  • How can you make sure, only the allowed changes are made, and even more only the signature appearance has been added between revisions. You can get the added stuff between revisions using the byte range from the signatures i've seen that here would the next step be to parse that whole thing and search for forbidden structures or something?
    – AlexandruC
    Oct 19, 2016 at 15:44

As the certificate is registered to you and fields completed with your details, the certificate is your digital signature. You don't add a digital signature to the certificate.

You need a certificate to be issued by a CA (which you could create). Then add the certificate to your trusted certs (if self-signed or not from an standard recognised CA). When you create PDF files you have the option to sign the file with that certificate. That certificate signing is your digital signature...

There's a decent HowTo here which is from 2009 but is still valid: http://blog.didierstevens.com/2009/01/04/howto-add-a-digital-signature-to-a-pdf-file/

  • Sorry I just realized I left out a big part. I mean to sign a pdf file with my certificate, then have this signature saved and appended to the pdf I've just signed. Apr 30, 2013 at 20:29
  • @romancanada you can try to edit your question to clarify the rest of your points.
    – Eric G
    Apr 30, 2013 at 23:31

A certificate always contains a signature, but on itself, not on some PDF document. This signature is an integral part of the certificate and has been computed by the CA which issued the certificate; this is by verifying this signature that any software can gain some trust in the contents of the certificate. All of this happens independently of any PDF file, and possibly ages before the PDF file ever exists.

When you sign a document "with a certificate", you are actually computing a signature over the PDF with your private key -- the private key is not in your certificate, but the certificate contains the corresponding public key. Then, the signature itself, and a copy of your certificate, should be included in the PDF file.

Adobe documents that signatures can be computed with their Reader and Acrobat products. It can apparently be done with free software, too.


Your question is really two different questions. A certificate only needs to be signed by another certificate if there needs to be a chain of trust. For example, a root CA will sign the certificates they issue so that anyone trying to verify the certificate will know that it is trusted by the CA. You can do this kind of chaining with any certificate that permits Certificate Signing.

For documents on the other hand, you only need a certificate that is approved for Client Authentication. If you are running your own CA, your certificate is probably approved for any purpose, but is going to lack trust by anyone other than you. To sign a PDF, you simply need to import the certificate in to Acrobat and then use the identity to sign the document.

  • Sorry, when I said containing a digital signature I didn't mean the signature of the CA validating my certificate. I meant it as the the signature which is a result of me using my certificate to sign the document. For the document, I'm looking to sign the pdf outside of the reader by hashing the file and signing the hash. Then having this as my signature. I just don't know how to append this appropriately back within the file. Apr 30, 2013 at 20:34
  • @Romancanada - you don't append it back with the file. A signature is just an encryption of the hash using your private key. The file format itself would have to specify how you store the information so that another user can read it. It doesn't even have to be the same file. Apr 30, 2013 at 20:41
  • Actually not, when you talk about documents you need to consider also how this signature is displayed. So the digital signature is the digital certificate + the digital signature appearance. Check this: adobe.com/content/dam/Adobe/en/devnet/acrobat/pdfs/…
    – yucer
    Apr 6, 2017 at 13:57
  • I mean the digital signature is a digital signature appearance + signed hash of the document content
    – yucer
    Apr 6, 2017 at 14:05
  • 1
    @yucer - not sure if you were responding to me or roman. For doing a signature within Acrobat, I agree and that's why I said "the file format itself will specify how to store the information". I was also trying to address roman's comment about wanting to sign the file outside of Acrobat (presumably without using acrobat's signature handling). Apr 6, 2017 at 16:40

If you want to sign a PDF, most PDF writers, and some versions of the reader-only will have a built in mechanism for signing, and some even for timestamping. It will ask you to provide your certificate file and then it will apply the digital signature into the file. PDFs in particular have this mechanism built into the format, but it is also possible to sign any type of file. One things that is important to note for newcommers to PDF signing is that you can sign a PDF without a visible marking on the page. The signature is actually metadata, and any type of marking on the page is optional.

Adobe provides a video tutorial on how to sign a PDF. You can also read more documentation at the Adobe site.

You can also do digital signing of files with command line tools, but if you are new to the process, a program like PortableSigner or maybe j4sign might work out well for you. You can browse through SourceForge and Github to look for other applicable projects that may meet your needs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .