How to sign a PDF with a digital certificate on a Mac

Signing a PDF with a digital certificate on a Mac takes three things: the certificate in your keychain, an app that knows how to use it, and a minute to check the result. The first is where most people get stuck. The second has a catch, because the app that opens PDFs by default on macOS doesn’t sign with certificates at all.

Most of what follows applies on Windows too. What changes is where the certificate lives: there’s no keychain, there’s the system certificate store.

What a signing certificate is

A digital certificate says who you are, and a trust service provider vouches for it. It comes with a private key, and the key is what actually signs. The result is a digital signature: it identifies you and detects any change made to the document after signing, which a picture of your handwriting can’t do.

Who issued the certificate matters as much as the cryptography. Anyone can create a certificate in their own name — Acrobat will do it for you, as we’ll see — but a self-signed one proves nothing about who you are, because nobody checked. For a signature that someone else can trust, you need a certificate from a provider they recognise:

• In the EU, every member state publishes a trusted list of its qualified providers, and the European Commission gathers them in its trusted list browser.
• Elsewhere, Adobe runs its own programme, the Adobe Approved Trust List, whose members issue signing certificates that Acrobat trusts.
• In Spain, most people use the free FNMT certificate. Which certificate do you need to sign covers the Spanish options and what each one is worth.

How it gets into the keychain

Providers usually deliver a certificate in one of two ways: installed from the browser you requested it with, or as a file. The file is almost always a .p12, sometimes called .pfx, which is the same format under another name. It holds the certificate and the private key, protected by a password.

If it went through the browser, open Keychain Access and search for your name first: it may already be there. Firefox is the exception, because it keeps certificates in a store of its own that other apps don’t see. You export it from Firefox’s certificate manager as a backup file; Spain’s FNMT, which walks its users through this, notes that on a Mac you have to type the .p12 extension yourself.

If you have a file, Apple’s Keychain Access guide gives the steps: open Keychain Access, choose File > Import Items, select the file, pick the destination keychain and click Open. You’ll be asked for the file’s password, which is the one set when it was exported, not your Mac’s.

Keep that .p12 and its password somewhere safe: you’ll need them when you change computers.

Preview won’t do it

Preview signs by placing your handwriting on the page, drawn on the trackpad, held up to the camera or sketched on an iPhone or iPad. Apple’s guide doesn’t mention certificates or digital IDs, and Preview has no way to make a digital signature. What it produces is a visual signature, and anyone holding the file can move or copy it without leaving a trace.

Signing with Adobe Acrobat

Acrobat, including the free Acrobat Reader, signs with a certificate from the keychain. In Adobe’s help on digital signatures, the path is:

1. Open the PDF and choose All tools > Use a certificate > Digitally sign.
2. Drag a rectangle where the signature should go.
3. Choose your digital ID from the list, click Continue, then Sign.
4. Save the signed copy under a new name, so you keep the unsigned original.

The first time, macOS asks whether Acrobat may use what’s in your keychain; as Apple’s guide explains, Always Allow stops it asking again.

Two things worth knowing. If your ID isn’t in the list, Acrobat offers Configure New Digital ID, but an ID you create there is self-signed. And to add a trusted timestamp, you set up a timestamp server under Preferences > Signatures > Document Timestamping, as Adobe explains in its page on time stamps. Why your signature needs a third party’s clock explains what that buys you.

If it’s the subscription that puts you off, Acrobat alternatives you buy once compares the options with the vendors’ own prices.

Signing with PDFsigna

The Windows version is on the Microsoft Store. The Mac version is in Apple’s review and will reach the Mac App Store once Apple approves it; we won’t give a date, because it isn’t ours to give. On the Mac, signing works like this:

1. Open the PDF and click Sign in the toolbar.
2. Under Sign with, choose your certificate. The app lists the ones in that Mac’s keychain. If you have a .p12 or .pfx file instead, Import a .p12 File… adds it to your login keychain, and the file’s password isn’t stored.
3. Drag a visual signature from your library onto the page, or draw the box where the signature goes.
4. Click Sign and Save. You get a new copy next to the original, “Contract signed.pdf”, with your handwriting inside the digital signature. The original isn’t touched.

Before you sign, a band above the document shows which of the five legal levels you’re about to get. With a certificate from a recognised provider, the Mac shows “Advanced”: it doesn’t yet check certificates against the European trusted list, so it treats none as qualified, as Support explains. With a self-signed certificate it shows “Simple (identity not verified)” and says why. The Free plan signs in PAdES B-T, timestamped by the ACCV’s public timestamping authority, up to ten documents a day.

Smart cards aren’t part of version 1, national ID cards and PIV cards included. Details are in Support.

Check that the signature holds

Signing isn’t the last step. Open the signed PDF in a validator: the European Commission’s DSS demo, Acrobat itself, or, for Spanish certificates, the Spanish government’s VALIDe. How to use each one, and what each result means, is in how to check whether a PDF signature is valid.

If the answer isn’t “valid”, read the reason before you sign again. A validator that doesn’t know your certificate’s issuer, or can’t finish checking revocation, hasn’t found anything wrong with your signature. It just couldn’t confirm it. Acrobat in particular judges a signature by the issuers it trusts, so a self-signed ID will look unverified to everyone you send it to.

This article was written with the help of artificial intelligence.

This article is general information, not professional advice. Laws, prices and how software works change over time: before you decide, check the official, up-to-date documentation from each authority or vendor.