How to Sign a PDF With a Digital Certificate Without Adobe

You do not need Adobe to sign a PDF. You need two things: a certificate file, usually ending in .pfx or .p12, and any tool that can apply a PKCS#7 signature.

Before the how, one distinction that trips up most people searching for this — and getting it wrong is the difference between a document that holds up and one that does not.

A drawn signature is not a digital signature

Pasting an image of your handwriting onto a page, or typing your name in a script font, produces a picture. It proves nothing. Anyone who opens the file can move it, copy it onto another document, or delete it, and nothing in the file records that this happened.

A digital signature is a cryptographic operation. It takes a hash of the document contents, encrypts that hash with the private key inside your certificate, and embeds the result. Two things follow:

• Tamper evidence. Change one character after signing and the hash no longer matches. Every reader will say so.
• Identity. The signature carries the certificate, which names who signed and who vouched for them.

If a client, an authority or a contract asks for a "digitally signed PDF", they mean the second kind. An image will be rejected, sometimes after a delay that costs you more than the signing did.

Where the certificate comes from

Three routes, and they are not equivalent.

A commercial certificate authority. You buy a document-signing certificate, prove who you are, and receive a .pfx. Readers trust it automatically because the authority is already in their trust store. This is what you want if the signature is going to someone outside your organisation.

Your employer's PKI. Large firms and public bodies issue their own. Internally trusted, externally usually not. Ask your IT department rather than buying your own — you may already have one sitting in the Windows certificate store.

Self-signed. You generate it yourself, free, in a few minutes. It provides the full tamper-evidence benefit and none of the identity benefit: readers will show the signature as valid but of unknown origin, with a yellow warning. Fine for internal use and for proving a file has not changed. Not fine for a formal submission.

Signing without Adobe

TorReader PDF (Windows). Open the document, choose the signing tool, select your .pfx or .p12 and enter its password. The signature is written as PKCS#7 detached with SHA-256, which is the format readers expect. Free, and no installation — TorReader PDF runs from the folder you unzip it into.

One limitation stated plainly: signing is on the Windows build only. The Linux build reads, merges, splits and annotates, but does not sign yet.

Adobe Acrobat Reader. Worth knowing that the free Reader can do this too, under the certificate signing tool. It is a large install with background services, but if it is already on your machine it is a legitimate answer.

LibreOffice. Can sign PDFs it exports, using certificates from the system store. Convenient if the document originated in LibreOffice, awkward otherwise.

Command line. For batch work, the Python library pyHanko signs and verifies PDFs and is the practical choice for scripting a signing step into a process. Overkill for one document, ideal for two hundred.

How to check a signature is real

Whether you signed it or received it, verify rather than assume.

• Open the file and find the signature panel. Every serious reader has one.
• Look for two separate statements: the document has not been modified since signing, and the signer's identity is valid. They fail independently, and only the first is about the file.
• A yellow or "unknown" identity warning usually means self-signed, or an authority your machine does not trust. It does not mean the document was altered.
• A red or broken indicator means the content changed after signing. Do not accept the file.

If you need certainty about a file someone else sent, verify it in a second tool as well. Agreement between two independent readers is worth more than a green tick in one.

Things worth knowing before you sign

• Sign last. Merging, extracting pages or adding annotations after signing invalidates the signature — that is the entire point of it. Assemble the document, then sign.
• Protect the .pfx like a key, because it is one. Anyone with the file and the password can sign as you. Do not email it to yourself.
• Certificates expire. A signature made while the certificate was valid normally stays valid afterwards, but only if it carries a trusted timestamp. If your work has a long life, ask your certificate provider about timestamping before you need it.
• A scanned wet signature is a picture. If the requirement is legal, scanning a printed page and emailing it is not the same thing, whatever the office habit is.