Sign a PDF

Digitally sign a PDF with a certificate, from your Windows certificate store or a .pfx / .p12 file, with Sign Document…. To put a picture of your handwritten signature on a page instead, see Add an image to a PDF.

Available in pre-release 3.7

Right-click the page → Document → Sign Document…, pick a certificate, click Sign, then save. At a glance:

Sign Document… (CmdSignDocument) — adds a cryptographic signature (PKCS#7) made with your certificate’s private key.
Certificate: one from your Windows certificate store, or a .pfx / .p12 file and its password.
Where: an empty signature field in the PDF, or a new signature box you draw on the page.
Appearance: choose the lines shown in the signature box, and add a PNG or JPEG image.
Command line: sumatrapdf-tool sign signs the PDF’s signature fields with a .pfx file.

A digital signature shows who signed and whether the PDF changed after signing. To sign you need a certificate with a private key: one issued to you (by your employer, a government ID card, a certificate authority) or one you made yourself. Other PDF readers trust the signature only if they trust the certificate.

Sign a PDF #

Open the PDF.
Start Sign Document… in any of these ways:
- Right-click the page → Document → Sign Document…
- Ctrl + K, then Sign Document in Command Palette
- Click an empty signature field in the PDF. The dialog opens with that field selected.
In the Sign Document dialog, pick the Certificate: (see Choose a certificate).
Optionally fill in Reason (optional): and Location (optional):. They are shown in the signature box.
Pick Where to sign:
- Empty signature field: name (page N) — a signature field the PDF already has. These come first in the list.
- New signature on page N — a new signature on the current page.
Optionally change the Appearance: (see Change how the signature looks).
Click Sign.
- For a new signature, the dialog hides and asks you to Click or drag on the page to place the signature. Drag a box, or click to place a box of the default size (2 × 0.75 inches) centered where you clicked. Esc brings the dialog back.
- If you selected something on the page before opening the dialog, the new signature fills the selection’s rectangle instead.
A save dialog opens. The signature is computed when the file is written, so you save right away. It suggests <name> Copy.pdf; pick the original file name to sign it in place.

The signed PDF opens in SumatraPDF. Signatures already in the document stay valid: the new one is appended to the file.

Cancel or Esc closes the dialog without signing.

Choose a certificate #

The Certificate: drop-down lists the certificates in your Windows Personal certificate store that have a private key, are valid today and may be used for signing, as name (expires yyyy-mm-dd). If there are any, the first one is selected.

To sign with a certificate file:

Pick Certificate file…, the last item in the drop-down.
Type the path, or click Browse… and pick a .pfx or .p12 file.
Type its Password:.

If the password is wrong, you get Wrong password for the certificate file.

Change how the signature looks #

Under Appearance:, check what the signature box shows. All are on by default:

Show labels — “Digitally signed by”, “DN:”, “Date:” and similar labels
Show name — the signer’s name
Show DN — the certificate’s distinguished name
Show date — the signing date and time
Show name as graphic — the name in large letters on the left

Image (optional): click Choose… and pick a PNG or JPEG, for example a scan of your handwritten signature. It is drawn on the left instead of the large name.

SumatraPDF remembers these choices until you close it. If you turn off the name, DN and date and leave reason and location empty, the name is shown anyway so the box isn’t blank.

Check a signature #

Open Properties (Ctrl + D) of a signed PDF: it lists each signature with the signer, whether the certificate is trusted and whether the document changed since signing.

Sign from the command line #

sumatrapdf-tool sign works with signature fields the PDF already has and a .pfx certificate file. It can’t add a new signature field.

List the signature fields and their object numbers:

sumatrapdf-tool sign form.pdf

   12: Signature is not signed.

Sign field 12:

sumatrapdf-tool sign -s me.pfx -P password -o signed.pdf form.pdf 12

Verify the signatures:

sumatrapdf-tool sign -v signed.pdf

Verifying signature 12:
	Distinguished name: cn=Jamie Rivera, o=Example, ou=, email=, c=
	Certificate error: Self-signed certificate.
	The document is unchanged since signing.
	The fields signed by this signature are unchanged.

Without -o the signed PDF is written to out.pdf. All options: sumatrapdf-tool sign.

Tips #

Fill in the form and flatten it before you sign. Baking a signed PDF removes the signature.
Sign into a new file (the suggested <name> Copy.pdf) to keep the unsigned original.
Use a PNG of your handwritten signature as the Image to get a signature that looks signed and is also verifiable.
A self-signed certificate works, but readers show it as not trusted.