We would like to digitally sign DOC (MS-Word) and PDF documents using PKI. Is this possible using an internally deployed CA?

I've found lots of articles getting email digitally signed but almost no reference for Word documents.


A simple Google search points to this page which explains how to sign Word documents, with Word itself. The signer must own a certificate, and the signature will be considered as valid by any Word instance only if that certificate has been issued by one of the CA that the host Windows system trusts. Most commercial CA can sell certificates which will be appropriate; see for instance that page.

For PDF files, using Adobe's product, you need the "standard" Acrobat to sign documents. However, signatures can be verified with the free Adobe Reader. Note that the Reader uses its own list of trusted CA, not that of the underlying OS; and it is more restricted. There again, some commercial CA can sell you the relevant certificates; e.g. see this page.

(For some reason, Globalsign's pages come up first in my Google searches, which is the only reason why I use them as examples.)

There also are free tools to generate PDF signatures (the format is sufficiently open for that), e.g. PortableSigner. You still need a certificate that will be considered as "valid" by whoever will verify your signatures.


Disclosure: I work for CoSign.

Word includes the ability to digitally sign and verify Word documents via the Microsoft CAPI NG API which is in Windows. Americans use the term "Digital Signature." Europeans say "Advanced Electronic Signature" or "Qualified Electronic Signature," depending on the source of the signer's certificate.

Word is a client of the CAPI API. You also need a supplier. It is possible but not very secure to install a digital signing certificate on the Windows machine. Better is to use a secure CAPI supplier. They are provided by my company, CoSign and others.

For example, if you install CoSign, you can digitally sign the Word doc from within Word. The CoSign appliance includes a secure CA reached over the network--the digital certificates are not installed on the Windows machine itself.

Word knows how to verify a signed document. It uses the Microsoft OS certificate store to verify the trust relationship that you have with the signer's certificate. (Or signers' certificates.)

CoSign signs Word, Excel, and PDF files out of the box.

Word docs can be signed from Windows, from a browser/mobile/tablet, from SharePoint Server (on-prem) and from Office 365 (SharePoint Online).

Our typical customer self-signs a certificate for the organization (the private key is kept securely inside the CoSign appliance). The signers' certs are then chained from the organization's cert. The organization's cert can be published on the organization's web site.

The appliance's internal CA can also be chained (as a sub-CA) from an organizational's cert. Via special arrangement with some general Certificate Authorities, we can chain from them as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.