Which certificate do you need to sign, and how to get one

To make a digital signature — not just a visual signature — you need a certificate in your name issued by a trust service provider. The certificate says who you are; the private key that comes with it is what actually signs.

Two separate questions decide what your signature is worth:

• Who issued it. If the provider is qualified, the certificate is qualified. Each EU country publishes a trusted list of its qualified providers, and the European Commission gathers them all in its trusted list browser.
• Where the key lives. In a file or your computer’s certificate store (a software certificate), or inside a qualified device such as a smart card or a national ID card.

A qualified certificate in software gives you an advanced signature with a qualified certificate. For a qualified signature — the one the eIDAS Regulation treats as equivalent to a handwritten signature in Article 25 — the key must also sit in a qualified signature creation device (Article 3(23)). The five levels are on the legal levels page.

In Spain: the FNMT personal certificate

The FNMT (Fábrica Nacional de Moneda y Timbre, the Spanish Royal Mint) issues the certificate most people in Spain sign with, and it is free. Anyone of age, or an emancipated minor, with a Spanish ID card or foreigner’s identity number (NIE) can request it. The FNMT’s website offers four ways to prove your identity: video identification, in person at an office, with the national ID card, or with a mobile device.

It is a software certificate: you install it on the computer you requested it from, or keep it as a .p12 file.

Signing for a company: representative certificates

To sign on behalf of a company or organisation, the FNMT issues representative certificates for sole or joint directors, for legal entities, and for representatives of entities without legal personality. Conditions and prices are on that page, in Spanish.

The ACCV citizen certificate

The ACCV (Agencia de Tecnología y Certificación Electrónica), another Spanish qualified provider, issues citizen certificates that are generally free. You verify your identity at one of its registration points, by video, or online if you already hold a national ID card or an ACCV certificate.

It comes in two forms, and the ACCV itself spells out the difference: in software it produces an advanced electronic signature; on a smart card, a qualified one.

The Spanish national ID card (DNIe)

The Spanish electronic ID card carries a chip with your certificates and the key inside — a qualified device, so it produces qualified signatures. You need your PIN and a card reader, or an NFC phone for version 3.0 and later.

PDFsigna doesn’t support the DNIe in version 1, on any platform. On macOS it can’t be done cleanly today: the system doesn’t recognise the card on its own, and the vendor’s module can’t be loaded by a Mac App Store app. On Windows it would work, but it is left out of version 1 so that both platforms follow the same policy. The same goes for every other smart card: none is promised for version 1, standard PIV cards included, until they’ve been tested with a real one. See Support.

Outside Spain

Look up a qualified provider in your country in the Commission’s trusted list browser, and follow that provider’s own steps to prove your identity.

How PDFsigna uses it

Once installed, PDFsigna finds the certificate in the system keychain (macOS) or the certificate store (Windows). If you have it as a .p12 or .pfx file, on the Mac the app imports it from the signing panel, and the file’s password is not stored; on Windows you install it by double-clicking the file and following the system’s wizard.

One limit today: the Mac app doesn’t yet check certificates against the European trusted list, so until it does it treats none as qualified and shows them as “Advanced”. The short version of all this is in how to get a digital certificate.

This article is general information, not professional advice. Laws, prices and how software works change over time: before you decide, check the official, up-to-date documentation from each authority or vendor.