An electronic signature drawn with a finger on a touchscreen is legally valid and visually recognizable. But it carries no cryptographic proof of who signed the document. Anyone with access to the file could have drawn that signature. A digital signature backed by a digital certificate solves this problem. The certificate, issued by a trusted certificate authority after verifying your identity, binds your cryptographic key to your real-world identity. When you sign with that certificate, the signature mathematically proves two things: the document has not been modified since you signed it, and the signature came from your private key, which only you control.
Digitally signing a PDF using a digital certificate is the strongest form of PDF signing available. It is the standard for contracts that must be enforceable, regulatory filings that must be verifiable, and legal documents where the signer identity must be provable. This guide covers how to obtain a certificate, how to apply it to a PDF, and how recipients can verify the signature.
According to the ISO 32000 standard, digital signatures in PDFs use public key cryptography. The signer private key creates the signature. The signer public key, distributed through the certificate, allows anyone to verify it. The cryptographic foundation is the same technology that secures HTTPS connections and email encryption.
Types of Digital Certificates for PDF Signing
| Certificate Type | Issued By | Identity Verification | Best For |
|---|---|---|---|
| Self-signed certificate | Created by the signer using PDF software or operating system tools | None. The certificate asserts an identity but provides no third-party verification | Internal documents where the signer identity is already known to all recipients |
| Organization-issued certificate | Issued by the organization IT department through an internal certificate authority | Verified by the organization. Trusted within the organization but not externally | Enterprise documents where recipients are within the same organization |
| CA-issued certificate | Issued by a public certificate authority such as DigiCert, GlobalSign, or Sectigo | The CA verifies the signer identity before issuing. Provides the strongest identity assurance | External contracts, regulatory filings, legal documents requiring third-party verifiable identity |
| AATL-certified certificate | Issued by a CA on the Adobe Approved Trust List. Automatically trusted by Adobe products | CA-verified identity plus automatic trust in Adobe Acrobat and Reader | Documents where recipients use Adobe software and expect the blue ribbon trust indicator |
Obtaining a Digital Certificate
For a CA-issued certificate, select a certificate authority from the Adobe Approved Trust List if recipients use Adobe products, or from any trusted CA for general use. Purchase a document signing certificate. The CA will verify your identity, which may involve providing government identification, confirming your email address, and verifying your organization affiliation. The verification process takes from a few hours to a few days depending on the CA and the level of validation. Once verified, the CA issues your certificate as a downloadable file that you install on your computer.
For a self-signed certificate, create it directly in Adobe Acrobat under Edit, Preferences, Signatures, Identities and Trusted Certificates. The self-signed certificate is created instantly and is ready for use immediately. It is trusted only on your computer and on computers where you have manually distributed and trusted the certificate. The Sign PDF workflow begins with having a certificate ready before the document that needs signing arrives.
Applying a Digital Signature to a PDF
Open the PDF in a signing tool that supports digital certificates. Select the option to digitally sign, as opposed to placing an electronic signature. The tool prompts you to select your certificate. Choose the certificate and enter its password if required. Draw or select the signature appearance, which controls how the signature looks on the page. Position the signature field on the document. Apply the signature. The tool creates a cryptographic hash of the document, signs it with your private key, and embeds the signature and your certificate in the PDF.
WukongPDF signing tools support electronic signatures. For digital signatures with certificates, use a signing tool that specifically supports certificate-based digital signatures. The Digital Signature distinguishes itself from an electronic signature by the cryptographic proof it provides.
Verifying a Digital Signature You Receive
Open the signed PDF in a reader that supports signature verification. Adobe Acrobat and Reader display a signature panel showing the signer name, the signature validity status, and whether the document has been modified since signing. A valid signature shows a green checkmark. A signature that is invalid due to document modification shows a warning icon. Click the signature to view the certificate details, including who issued it and when it expires.
If the signature is invalid, do not rely on the document. An invalid signature means either the document was modified after signing, or the certificate used to sign it is no longer trusted. The PDF Security verification of received signatures is as important as applying your own signatures correctly.
Long-Term Signature Validity
Digital certificates expire. A certificate valid today will not be valid in five years. A signature that verified correctly when applied may show as invalid after the certificate expires unless long-term validation information is embedded with the signature. Long-term validation, or LTV, includes the certificate chain, certificate revocation status, and a timestamp from a trusted time server, all embedded in the PDF alongside the signature. With LTV enabled, the signature can be verified even after the certificate expires because all the information needed for verification is contained within the document.
Enable LTV when signing documents that must remain verifiable for years. The PDF Security long-term validation feature preserves signature verifiability beyond the certificate lifetime.
Managing Certificate Expiration and Renewal
Digital certificates expire. A certificate valid today will not be valid in three years. Before your certificate expires, renew it through the issuing certificate authority. The renewal extends the validity period while preserving your identity binding. After renewal, new signatures use the renewed certificate. Existing signatures made with the old certificate remain valid if long-term validation information was embedded. If LTV was not enabled, old signatures will show as invalid after the certificate expires.
Plan for certificate renewal before expiration. A signature that becomes invalid because the certificate expired cannot be restored without resigning the document. The Digital Signature lifecycle management includes renewal planning from the day the certificate is issued.
Visible vs Invisible Digital Signatures
A digital signature can appear visibly on the document page as a signature field with your name, date, and a graphic representation of your signature. Or it can be invisible, applying the cryptographic protection without any visual indicator on the page. Visible signatures are appropriate when the recipient needs to see who signed. Invisible signatures are appropriate when the cryptographic proof matters but the visual indication is unnecessary or would clutter the document.
The choice between visible and invisible depends on the document type and recipient expectations. A contract typically carries a visible signature. A batch of automatically generated certificates might use invisible signatures to avoid cluttering each page. The Sign PDF visibility setting is configured when the signature is applied.
Signing Multiple Pages or Sections With a Single Certificate
A multi-page document signed with a digital certificate protects every page. The signature covers the entire document content. If any page is modified after signing, the signature becomes invalid for the whole document. This all-or-nothing protection is appropriate for documents where the integrity of the complete content matters. For documents where different sections may need independent signatures from different people, use multiple signature fields, each covering its designated page range.
The Digital Signature coverage of a single signature extends to the entire document by default. Multiple signatures can coexist on the same document, each applied by a different signer to the content as it existed at the time of their signing. The signature panel lists all signatures with their validity status.