Sign a PDF

Digitally sign a PDF with a certificate, from your Windows certificate store or a .pfx / .p12 file, with Sign Document…. To put a picture of your handwritten signature on a page instead, see Add an image to a PDF.

Available in pre-release 3.7

Right-click the page → Document → Sign Document…, pick a certificate, click Sign, then save. At a glance:

Sign Document… (CmdSignDocument): adds a cryptographic signature (PKCS#7) made with your certificate’s private key.
Certificate: one from your Windows certificate store, or a .pfx / .p12 file and its password.
Where: an empty signature field in the PDF, or a new signature box you draw on the page.
Appearance: choose the lines shown in the signature box, and add a PNG or JPEG image.
Command line: sumatrapdf-tool sign signs the PDF’s signature fields with a .pfx file.

A digital signature shows who signed and whether the PDF changed after signing. To sign you need a certificate with a private key, either one issued to you (by your employer, a government ID card, a certificate authority) or one you made yourself. Other PDF readers trust the signature only if they trust the certificate.

The Sign Document dialog, signing with a certificate file

Sign a PDF #

Open the PDF.
Start Sign Document… in any of these ways:
- Right-click the page → Document → Sign Document…
- Ctrl + K, then Sign Document in Command Palette
- Click an empty signature field in the PDF. The dialog opens with that field selected.
In the Sign Document dialog, pick the Certificate: (see Choose a certificate).
Optionally fill in Reason (optional): and Location (optional):. They are shown in the signature box.
Pick Where to sign:
- Empty signature field: name (page N) is a signature field the PDF already has. Existing fields come first in the list.
- New signature on page N adds a new signature on the current page.
Optionally change the Appearance: (see Change how the signature looks).
Click Sign.
- For a new signature, the dialog hides and asks you to Click or drag on the page to place the signature. Drag a box, or click to place a box of the default size (2 × 0.75 inches) centered where you clicked. Esc brings the dialog back.
- If you selected something on the page before opening the dialog, the new signature fills the selection’s rectangle instead.
A save dialog opens. The signature is computed when the file is written, so you save right away. It suggests <name> Copy.pdf. Pick the original file name to sign it in place.

The signed PDF opens in SumatraPDF. Signatures already in the document stay valid, because the new one is appended to the file.

Cancel or Esc closes the dialog without signing.

Choose a certificate #

The Certificate: drop-down lists the certificates in your Windows Personal certificate store that have a private key, are valid today and may be used for signing, as name (expires yyyy-mm-dd). If there are any, the first one is selected.

To sign with a certificate file:

Pick Certificate file…, the last item in the drop-down.
Type the path, or click Browse… and pick a .pfx or .p12 file.
Type its Password:.

If the password is wrong, you get Wrong password for the certificate file.

Change how the signature looks #

Under Appearance:, check what the signature box shows. All are on by default:

Show labels: “Digitally signed by”, “DN:”, “Date:” and similar labels
Show name: the signer’s name
Show DN: the certificate’s distinguished name
Show date: the signing date and time
Show name as graphic: the name in large letters on the left

Image (optional): click Choose… and pick a PNG or JPEG, for example a scan of your handwritten signature. It is drawn on the left instead of the large name.

SumatraPDF remembers these choices until you close it. If you turn off the name, DN and date and leave reason and location empty, the name is shown anyway so the box isn’t blank.

A signature with all of them on, and no image:

A signature showing the signer's name as a graphic, the labels, the DN and the date

Approval and certifying signatures #

Signature type: picks what the signature means:

Approval signature (the default) means you approve the document as it is. It locks nothing, so others can sign after you and every signature stays valid. A chain of signatures by several people works in Acrobat and other readers.
Certify: no changes allowed means the document is final. Any later change, including further signatures and annotations, is reported as a violation of the certification. SumatraPDF asks you to confirm, since nothing can be added afterwards.
Certify: form filling and signing allowed means others may fill forms and add signatures, and nothing else.
Certify: form filling, signing and annotations allowed also allows annotations.
Lock document after signing (last signer) is for the end of a chain, where certifying is for the start. A certifying signature has to come first, and the lock is applied by whoever signs last and forbids any change after it. It is the PDF 2.0 field lock (/Lock /P 1, repeated in the signature’s FieldMDP transform), so readers that only know PDF 1.x ignore it. Acrobat honors it. SumatraPDF also asks you to confirm.

A certifying signature has to be the document’s first one, so the certify entries are only offered while the document has no signature yet. CmdSignDocument certify (a shortcut or toolbar button) opens the dialog already set to Certify: no changes allowed. Technically, a certifying signature carries a DocMDP transform with the allowed changes (/P 1, 2 or 3) and the catalog’s /Perms entry. An approval signature’s FieldMDP transform includes no fields.

Lock form fields after signing (off by default) freezes the form. The signature’s FieldMDP transform locks every form field, so filling a field or adding a signature afterwards invalidates this signature. Use it for a filled-in form whose answers must not change, and leave it off for a document others will sign after you.

Earlier versions locked all form fields with every signature, so a second signature invalidated the first in Acrobat. Signatures made since 3.7 don’t unless you check the box. Signing an existing signature field keeps whatever /Lock the field already has.

Sign from the command line #

sumatrapdf-tool sign works with signature fields the PDF already has and a .pfx certificate file. It can’t add a new signature field.

List the signature fields and their object numbers:

sumatrapdf-tool sign form.pdf

   12: Signature is not signed.

Sign field 12:

sumatrapdf-tool sign -s me.pfx -P password -o signed.pdf form.pdf 12

Verify the signatures:

sumatrapdf-tool sign -v signed.pdf

Verifying signature 12:
	Distinguished name: cn=Jamie Rivera, o=Example, ou=, email=, c=
	Certificate error: Self-signed certificate.
	The document is unchanged since signing.
	The fields signed by this signature are unchanged.

Without -o the signed PDF is written to out.pdf. All options: sumatrapdf-tool sign.

Tips #

Fill in the form and flatten it before you sign. Baking a signed PDF removes the signature.
Sign into a new file (the suggested <name> Copy.pdf) to keep the unsigned original.
Use a PNG of your handwritten signature as the Image to get a signature that looks signed and is also verifiable.
A self-signed certificate works, but readers show it as not trusted.