Certificate signing

Seal your PDF with your digital identity.

Sign locally with an RSA certificate and private key from your P12/PFX file. Your key and password stay on this device. Certificate trust is determined by the recipient’s PDF reader. No remote signing or timestamp service.

How to use Certificate signing

1. Open your document from your device.
2. Adjust the settings and preview the result.
3. Read text results on screen or download your file. Your original remains untouched.

Local by design

Your documents are processed on your device. No account, payment or document upload is required.

Enable JavaScript to use the document workspace.

Sign final document bytes with a supported certificate

Certificate signing uses an RSA private key and certificate from a P12/PFX bundle to sign a PDF locally. It is useful when the receiving process accepts that kind of signature and you already have the appropriate credential. Your private key and password stay in the browser session rather than being uploaded to a signing service.

Signature creation is only part of the workflow. The recipient’s reader determines certificate trust under its own validation settings. SandboxPDF does not establish issuer trust, check revocation or add a trusted remote timestamp. It does not provide remote signing or identity verification. Confirm the required certificate and profile before relying on this feature.

Finalise the PDF before signing

1. Complete all intended edits, page organisation, form filling and cleanup.
2. Open the final PDF and select your supported P12/PFX certificate bundle.
3. Enter the bundle password and any accurate display name or signing reason.
4. Create and download the signed output.
5. Open the result in a reader with a signature-validation panel.

The signature is inspected through the reader’s signatures panel; this operation does not automatically add a handwritten graphic to the page. If a visual appearance is also required, prepare it before the final certificate operation and follow the recipient’s procedure. Do not confuse a visible name with the actual cryptographic signature.

Protect the private key

The P12/PFX bundle is sensitive because it can contain the signing private key. Store it and its password according to your credential-management policy. Local processing avoids a remote signing upload, but it cannot protect against a compromised device or inappropriate browser-extension access.

Never send the bundle or password through the contact form. For troubleshooting, describe the certificate type and error without sharing production key material. A test-only certificate is appropriate for a demonstration; a real credential should not be copied into public examples or unapproved environments.

A wrong password should be rejected, and an already signed input is not silently rewritten by this workflow. If your process needs multiple signatures or incremental revisions, use a system designed and approved for that requirement. Do not treat a general single-signature feature as a complete signing platform.

Validate integrity, trust and time separately

In the downloaded result, check that the signed content is intact, inspect the signer certificate and read any trust warnings. A cryptographically intact signature from an unknown certificate is different from a trusted identity. Do not instruct recipients to trust an unfamiliar certificate simply to remove a warning.

Check the time evidence as well. A local clock value is not a timestamp from a trusted authority. If long-term validation or a particular timestamp service is required, this local workflow alone is insufficient. Follow the approved process rather than replacing independent evidence with a printed date.

Do not edit, compress or sanitize the signed file afterwards and assume validation remains unchanged. Preserve the exact signed output and verify that it is the file you send. Read the certificate-signing checklist and security-control distinctions for the full handoff routine. A successful result is a correctly signed intended document that satisfies the recipient’s actual validation requirements.

Frequently asked questions

Which key bundles are supported?

The workflow accepts supported RSA certificates and private keys in P12/PFX bundles, with the correct bundle password.

Does it add a handwritten signature image?

No. The certificate signature is available in the PDF reader’s signature panel. Visual signing is separate.

Why does my reader show an unknown signer?

It may not trust the certificate chain. Mathematical integrity and identity trust are separate checks.

Is a trusted timestamp included?

No. This feature does not contact a timestamp authority or perform revocation checking.

Can I edit the signed output later?

Edits change the document and can invalidate the signature. Finalise content before signing and follow the required correction process.