Sign PDF with Digital Certificate — Legally Binding & 100% Private

Apply a certified PKCS#7 digital signature to any PDF using your X.509 certificate. Works with .pfx, .p12, and PEM files. No uploads, no servers — everything happens in your browser.

Internet connection required

Signing may need to fetch certificate chain information from your certificate issuer's server to validate the signature.

Click to select a file or drag and drop

PDF Documents

Your files never leave your device.

How to Digitally Sign a PDF Online

1

Upload Your PDF Document

Drag and drop or click to select the PDF you need to sign. Your file stays entirely on your device — nothing is sent to any server.

2

Provide Your Certificate

Upload your .pfx, .p12, or .pem certificate file. Enter the password to unlock your private key. The key is used locally and never transmitted.

3

Configure & Apply Signature

Optionally add a visible signature image, position it on the page, and include custom details (reason, location, contact). Click to embed the cryptographic PKCS#7 signature.

4

Download Signed PDF

Your signed PDF is generated instantly in the browser. Download it and verify the signature in Adobe Reader, Foxit, or any standards-compliant PDF viewer.

Related PDF Tools

Sign PDF

Draw, type, or upload your signature.

Validate PDF Signature

Verify digital signatures in your PDF files. Check certificate validity, view signer details, and confirm document integrity. All processing happens in your browser.

Encrypt PDF

Lock your PDF by adding a password.

PDF Form Filler

Fill in forms directly in the browser. Also supports XFA forms.

Sanitize PDF

Remove metadata, annotations, scripts, and more.

Frequently Asked Questions

What exactly is a digital signature in a PDF?

A digital signature is a cryptographic stamp that proves who signed a document and guarantees it has not been altered since signing. Unlike a handwritten or drawn signature, it relies on public-key cryptography (X.509 standard): your private key creates a unique hash of the document, and anyone with your public certificate can verify both your identity and the document's integrity.

Which certificate formats does ZentoPDF support?

ZentoPDF supports three standard certificate formats: PKCS#12 (.pfx and .p12) — the most common format issued by certificate authorities, which bundles your certificate and private key together in a single password-protected file — and PEM (.pem), a text-based format that may contain the certificate and private key separately or combined. If your PEM file is encrypted, you will be prompted for the passphrase.

Is my private key ever uploaded or shared?

Never. All cryptographic operations run entirely inside your browser using the Web Crypto API and JavaScript. Your certificate file, private key, and PDF document are never transmitted to any server. You can even disconnect from the internet after loading the page and the signing will still work.

Will PDF readers recognise and validate the signature?

Yes. ZentoPDF produces a standard PKCS#7 detached signature embedded in the PDF according to the PDF specification. It is recognised by Adobe Acrobat Reader, Foxit PDF Reader, Preview (macOS), and all other major viewers. For the signature to show as Trusted, your certificate must be issued by a Certificate Authority (CA) already trusted by the reader, such as Adobe's Approved Trust List (AATL) members.

What is a visible signature and how does it work?

A visible signature is an optional graphical element placed on a specific page of the PDF, showing that the document has been signed. You can upload your company logo or handwritten-signature image (PNG, JPG, or WebP), add a custom text overlay (signer name, date, role), and precisely position the box using X/Y coordinates and width/height values. The underlying cryptographic signature is always embedded regardless of whether you enable the visible element.

Why does signing require an internet connection?

During signing, the tool may need to fetch the full certificate chain from your CA's Online Certificate Status Protocol (OCSP) server or Certificate Revocation List (CRL) endpoint to embed chain validation data in the signature. This makes the signature Long-Term Validation (LTV) compliant. If the CA server is unreachable, the signature is still applied but may not include chain data. Your PDF file itself is never sent online.

Can I sign a PDF that is already digitally signed?

Yes, you can add a new signature to a PDF that already contains one or more digital signatures. Each signer creates an incremental revision, and PDF readers display a list of all signatures. Note that if the previous signer chose to lock the document against future changes, adding a new signature will break their signature's integrity check — this is normal and expected PDF behaviour.