PDF Signer User Manual

Digitally sign PDF documents with your certificate, create eIDAS electronic signatures and seals (including qualified ones, with a qualified certificate on a smart card or token), add qualified time stamps, and sign a whole folder at once. No technical knowledge needed; developers find PowerShell, C# and VB.NET examples at the end.

1. What is PDF Signer?

A PDF document (an invoice, a contract, a report) can be changed by anyone who has it. A digital signature solves two problems:

• Who signed it? The signature is created with your personal digital certificate, so it proves your identity.
• Was it changed? If even one character of the document is modified after signing, the signature is reported as not valid.

PDF Signer adds one or more digital signatures to PDF documents. You can sign a single document, several documents selected together, or select an input folder and an output folder and sign all the PDF documents of the folder at once (bulk signing). The signature can be visible on the page (with your name, the date, the reason and the place of the signing, even with your own image) or invisible.

PDF Signer creates PAdES signatures (PDF Advanced Electronic Signatures, ETSI EN 319 142-1), the format of the advanced and qualified electronic signatures of the eIDAS Regulation (EU) No 910/2014, and the older PKCS#7 signatures, for the PDF readers that do not know PAdES. When the document is signed with a qualified certificate on a QSCD (a qualified signature creation device, such as a smart card or a USB token), the result is a qualified electronic signature, with the legal effect of a handwritten signature in the whole European Union. The same applies to electronic seals (the signatures of a company or of an institution) and to qualified time stamps. Section 7 explains this in detail.

What you can do with PDF Signer

• Sign one or several PDF documents, or all the documents of a folder, with a certificate from the Windows certificate store, from a smart card or USB token (the Windows store shows its certificates), or from a PFX / P12 file.
• Choose the signature format from a short list of four, explained in plain words: Standard signature (recommended), Long-term signature, Archive signature and Compatibility signature for older programs (section 7.3).
• Add a time stamp from a time stamp server, also a qualified time stamp (section 7.5).
• Choose the appearance of the signature: the page (first, last, all pages or the pages you list), the position, the text, the font and an image.
• Certify a document (the signature of the author) and encrypt the signed document with passwords and restrictions (for instance, to allow printing but not copying).
• Sign documents that are protected with a password, and rebuild documents with a damaged structure.
• Save your settings in files, and sign automatically, without any window, from the command line (section 16).

Who is this manual for?

• Users — sections 1 to 16 explain, step by step, how to install the product, register it, choose a certificate, sign documents and check them.
• Developers and administrators — sections 17 to 19 explain that PDF Signer is built on the Signature Library (SignLib) and show how to create and verify the same PDF signatures from Windows PowerShell, C# or VB.NET.

PDF Signer and PDF Signer Server

PDF Signer is the program with a window, for people who sign documents. PDF Signer Server is a separate product, for companies that need a signing service: it watches a folder and signs the new documents automatically, sends the signed files by e-mail, uploads them to an FTP server, archives the originals, writes logs and also works with devices that use the PKCS#11 interface (smart cards, tokens and HSMs). If you need these functions, see the product page of PDF Signer Server.

Useful links

2. Product installation

We recommend installing the product with an Administrator account. After the setup file is verified, the operating system might ask for your permission to install the program: click Yes.

What you need

• Windows 8 or later (including Windows 10, Windows 11 and Windows Server 2022).
• Microsoft .NET Framework 4.6.2 or newer. It is already part of the current versions of Windows 10 and of Windows 11; for the other versions of Windows you can download it from the Microsoft site.
• A digital certificate to sign with. If you do not have one yet, you can create a test certificate (section 14).

Installation steps

1. Download the setup file. Get PDFSigner.msi from the product page (direct link: https://www.signfiles.com/apps/PDFSigner.msi) and run it.
2. If Windows SmartScreen appears, allow the program to run. You may see the window Windows protected your PC. Click More info and then Run anyway. See the explanation below.
3. Read the license agreement. Read the EULA (End-User License Agreement). If you want to continue, select I Agree and click Next.
4. Select the installation folder. Keep the proposed folder, or click Browse... to choose another one. Choose Everyone to install the program for all the users of the computer, or Just me for your account only. Click Next.
5. Wait for the setup to finish. When Installation Complete appears, click Close. The program is now installed.

By default the program is installed in the folder Secure Soft\PDF Signer of Program Files (on a 64-bit Windows: C:\Program Files (x86)\Secure Soft\PDF Signer), and the program is PDF Signer.exe.

Where to find the program

After the installation, the icon of PDF Signer appears on the desktop and in the Windows Start menu. Double-click it to start the program.

What is Windows SmartScreen?

SmartScreen is a protection built into Windows. When you run a program you downloaded, Windows compares it with a list of programs that are known and were already downloaded by many people. A program that Windows does not know yet, for example a new version that was published recently, is shown as an unrecognized app, and the window below appears.

This message does not mean that the file contains a virus. It only means that Windows has no reputation data about it yet. To continue:

1. Click More info. The name of the file and of the publisher are displayed.
2. Click Run anyway and the setup starts.

3. Trial period and product registration

A new, unregistered installation works for a trial period of 31 days. The title of the window shows how much is left, for example PDF Signer - Expires in 30 days, and the buttons Register Now and Buy Now! are visible.

How to register the product

1. Get a serial number. To register the product you need a serial number (also called license code). You can buy it online directly from the product page, https://www.signfiles.com/pdf-signer/. You can also click Buy Now! in the program, which opens the same page.
2. Open the registration window. Open PDF Signer and click the Register Now button (or Help → Register Now...).
3. Type the license code. Enter the received serial in the first box. The second box, Licensed to (optional), is for a name: if you type one, it is shown in the title of the window.
4. Click Register. If the serial number is correct, the product is successfully registered.

4. Sign your first document

This is the whole process. It takes less than a minute once you have a certificate.

1. Choose the document. Keep One or more PDF documents selected. Click the ... button under Source and select the PDF document you want to sign. The Destination file is filled in for you: the same name with [signed] added.
2. Check where to save the signed document. If you want another place or name, click the ... button under Destination file. The destination must be a different file from the source.
3. Select your digital certificate. Click Select the Digital Certificate.... Choose the certificate from the Windows store (the certificates of a smart card or of a token are there too) or a .pfx file, and click OK (details in section 6).
4. Leave the format on the recommended value. Standard signature (recommended) is already selected and is the right choice for most documents: invoices, contracts, reports (see section 7.3).
5. Click Apply Digital Signature. After a moment you see the message The document was digitally signed successfully, with the place of the signed document. Click Yes to open it in your PDF reader.

5. The main window

The hash algorithm of the signature (SHA256 by default) is set in the certificate window, in the Advanced group (section 6.3). The validation data that the long-term signatures store in the document is chosen by the program, in the recommended way (section 7.3).

Menus

6. Digital certificates

A digital certificate is your electronic identity card, issued by a certification authority. To sign with PDF Signer you need one. This section explains where certificates are kept and how to select the one you want to sign with.

6.1 Where the certificates are stored

A certificate that can sign documents has two parts: a public key (the part other people see, inside the certificate) and a private key (the secret part, which only you have). The digital signature is created with the private key. PDF Signer can use certificates from:

• the Windows Certificate Store (the list of the certificates of Windows). The certificates of a smart card or of a USB token are in this list too, when the token is connected;
• a PFX (or P12) file.

(Directly through the PKCS#11 interface of a device, without the Windows store: this is available in PDF Signer Server.)

The Windows Certificate Store

The Windows Certificate Store is the place where Windows keeps the certificates of the computer and of each user. PDF Signer shows its certificates in the window Digital Certificates, in the group Windows certificates.

To see the certificates of your account, open the Windows Run window (press Win + R), type certmgr.msc and press Enter:

Then open Personal → Certificates.

To create digital signatures, the certificates of the Personal store are used. They must have a public and a private key. You can check this by opening a certificate: in the General tab Windows writes You have a private key that corresponds to this certificate.

The private key itself can be stored:

• on the file system of the computer (for example, an imported PFX file);
• on a cryptographic smart card or USB token — see section 6.2;
• on an HSM (Hardware Security Module), a device that keeps keys for a company.

The certificates are listed per store location: Current User (your own certificates, the usual case) or Local Machine (certificates installed for all the users of the computer).

PFX and P12 files

Another way to keep a digital certificate is a PFX (or P12) file. The file contains the public and the private key of the certificate, and it is protected by a password, to keep the key pair safe.

6.2 Certificates stored on smart cards or USB tokens

If your certificate is stored on a smart card or on a USB token (like Aladdin eToken or SafeNet), the private key never leaves the device: it signs inside the device. This is the kind of device used for qualified certificates (QSCD, see section 7).

PDF Signer uses such a certificate through the Windows Certificate Store. When the token is inserted in the USB port, its driver or middleware (the software delivered with the token) usually imports the certificate in the store automatically. If the certificate does not appear in the store, it cannot be used: ask your vendor how to add it, and look at the options of the middleware (for example, an option that copies the certificates of the token to the local Windows store).

When you sign, the token asks for its PIN. The window belongs to the middleware of the token, for example:

If the token is not connected, its certificate is not in the Windows store and PDF Signer tells you so, with the name of the certificate:

6.3 Select the digital certificate for creating signatures

To digitally sign a document, a digital certificate must be selected first. Click Select the Digital Certificate... (or Tools → Select the Digital Certificate...). The certificate can be in the Windows store or in a PFX file.

Option A: a certificate installed in Windows

Certificates installed on the computer, or stored on a USB token or smart card that Windows knows, appear in Windows Certificate Store.

1. Select Windows Certificate Store.
2. In Certificate Store choose Current User (your own certificates, the usual case) or Local Machine (certificates installed for the whole computer).
3. Pick your certificate from the list. Each line shows the name of the owner and the expiry date; a certificate that declares itself qualified is marked (qualified certificate), and an expired one is marked EXPIRED. The issuer is written in Certificate Information, under the list. Details... displays the full certificate.
4. If your token was inserted after the window was opened, click Refresh: the list is read again from Windows and your selection is kept.
5. If the certificate is on a smart card and you want to avoid the PIN window, tick Save the PIN (no PIN prompt) and type the PIN. This is possible only for a certificate on a token or a smart card (section 6.2).
6. Click OK.

The list shows only the certificates that can create signatures: they have a private key and are not meant only for encrypting or for web servers. The most suitable certificate is the first one of the list: a valid one, a qualified one, one with the non-repudiation usage of the signature certificates (a token often has also a certificate used to log in), the one that expires last. When no certificate was selected before, this one is selected for you. The expired certificates (and those that are not valid yet) are at the end of the list, so that you see why they cannot be used: when you select one, PDF Signer warns you, and OK does not accept it.

A certificate that is not meant to sign documents

Some certificates are issued for another purpose, for example only for time stamping. They are still in the list, because they have a private key, but PDF Signer adds a Warning line to Certificate Information and a short one under the certificate button of the main window. The warning appears when the usage of the certificate allows neither the digital signature nor the non-repudiation, or when its extended key usage lists only other purposes (here, Time Stamping).

The warning does not stop the signing: you can use the certificate and the document is signed. But the programs that validate the signature, such as Adobe Reader or the European validator, can report it, so use a certificate issued for signing documents for your real documents. When you sign from the command line (section 16), the same warning is written in the command window and in the log.

Option B: a PFX file

Some certificates are delivered as a file with the extension .pfx (or .p12), protected by a password.

1. Select PFX digital certificate file.
2. Click ... and pick your .pfx file (or type its path).
3. Type the PFX file password. The Details... button next to it displays the certificate so you can check you picked the right one; the Certificate Information box summarizes it.
4. Click OK.

Certificate Information

In the middle of the window, Certificate Information summarizes the selected certificate: to whom and by whom it was issued, until when it is valid, and where its private key is stored. The same summary is shown under the certificate button of the main window.

Both RSA and ECDSA (elliptic curve) certificates are supported.

Advanced

This is the only setting of the group, because the others have only one good value. For instance, the validation data of the long-term signatures (the proofs that the certificate was valid) is always collected in the recommended way, and a list of cancelled certificates larger than 1 MB is not stored. The advanced users can change these two values in the configuration file (section 16).

7. eIDAS electronic signatures, seals, time stamps and signature formats

PDF Signer creates the signatures that the European Union uses for electronic signatures on PDF documents: PAdES signatures (ETSI EN 319 142-1). This section explains how they relate to the eIDAS Regulation (EU) No 910/2014, what you need to obtain a qualified electronic signature or a qualified electronic seal, why a qualified time stamp is useful, which format to choose, and how to check the result with the tools of the European Union.

7.1 The levels of electronic signatures in the eIDAS Regulation

The same rules apply to electronic seals. A seal is the signature of a legal entity (a company, an institution), created with a certificate for electronic seals. A qualified electronic seal enjoys the presumption of integrity of the data and of correctness of the origin of the data (Article 35). PDF Signer signs with a seal certificate in the same way as with a signature certificate.

A qualified electronic time stamp, issued by a qualified time stamping service, enjoys the presumption of the accuracy of the date and the time it indicates and of the integrity of the data to which they are bound (Article 41). Section 7.5 explains how to use it.

7.2 What you need for a qualified signature or seal

The level of a signature is given by the certificate and by the device that holds its private key, not by the software. PDF Signer creates the signature in the PAdES format that the validators expect, and it works with all the kinds of certificates:

When the selected certificate declares itself as a qualified certificate, PDF Signer writes (qualified certificate) after its name, in the main window and in the certificate window. This mark is only an indication that is read from the certificate: the qualified status itself is given by the EU Trusted Lists (see section 7.4).

7.3 Signature formats

The format decides how much information is stored inside the signature, and for how long the signature can be verified. You do not need to know the technical terms: the list Signature Format of the main window has four choices, in plain words, and it explains the selected one. If you are not sure, keep the first one.

The technical names

Rest the mouse on the list to see the technical name of the selected format. The first three are the baseline profiles of PAdES (ETSI EN 319 142-1), the formats recognised for the advanced and qualified signatures of the eIDAS Regulation; the validators use these names in their reports.

A signature with a time stamp only (PAdES-B-T) is not a separate choice: the Long-term signature already includes the time stamp, and it adds the proofs that make it verifiable in the long term.

7.4 The EU Trusted Lists and the validation of the signature

The EU Trusted Lists are the lists published by the Member States with the qualified trust service providers and their services (browse them here). The programs that validate signatures read them to decide whether a certificate is qualified and whether its key was on a QSCD.

Adobe Reader uses the European Union Trusted Lists too: a signature made with a certificate of a provider that is listed there is shown as valid, without any setting, and a qualified signature is marked as such:

For a certificate that is not in the Trusted Lists (for instance a certificate of your company, or a test certificate) Adobe Reader reports the validity as unknown, until its user trusts the certificate (section 13).

Validate the signature with the European validator

The European Commission publishes an open validation tool, DSS (Digital Signature Service, part of the eSignature building block), that checks signatures according to the eIDAS rules. You can use it to confirm that a document signed with PDF Signer carries a correct PAdES signature and to see its level:

1. Open the validation page. Go to ec.europa.eu/digital-building-blocks/DSS/webapp-demo/validation.
2. Select the signed document. Choose the signed PDF document.
3. Validate. Keep the default validation policy and start the validation. Read the Simple Report; the Detailed Report and the Diagnostic data explain every check.

The report shows, for each signature:

• the signature format, for example PAdES-BASELINE-B, -T, -LT or -LTA;
• the signer and the certificate chain;
• the signing time or the time of the time stamp;
• the indication of the validation (passed, failed or indeterminate);
• the qualification of the signature. The validator reads the EU Trusted Lists and tells you whether the certificate is qualified and whether its key was on a QSCD. A qualified signature is reported as a qualified electronic signature (QESig); a qualified seal as a qualified electronic seal (QESeal).

Do not upload documents with private content to a public service. For confidential documents use a validation tool installed on your own computer, or the Adobe Reader.

7.5 Qualified time stamps: qtsa.eu

A time stamp proves that the document existed at a given moment and was not changed since. A qualified time stamp is issued by a qualified trust service provider that is listed in the EU Trusted Lists, and it enjoys, in all the Member States, the presumption of the accuracy of the date and the time (Article 41 of the eIDAS Regulation). Together with a qualified signature or seal it proves both who signed the document and when, with the legal effects described in section 7.1.

PDF Signer can use any time stamp server that follows the RFC 3161 standard, so the product works with certificates, seals and time stamps that are qualified. To add a qualified time stamp to your signatures:

1. Get the access data. The provider of the qualified time stamps gives you the address of the server and, usually, a user name and a password.
2. Open the time stamp settings. Select a format that uses a time stamp (the Long-term signature or the Archive signature) and click Time Stamping Settings... (section 8).
3. Type the address and the access data. Write the address in Time Stamp Server URL; tick Time Stamp Server requires authentication and type the user name and the password.
4. Test the server. Click Test the Server. The program asks for a time stamp and shows who issued it. If the time stamp declares itself as a qualified one, the message says (qualified time stamp).
5. Sign. Click OK and sign as usual. Every signature gets a time stamp from the server you set.

8. Time stamp settings

A time stamp is issued by a Time Stamp Authority (TSA), an independent service. It proves that your signature existed at a given moment and cannot be back-dated. It is used by the Long-term signature and by the Archive signature. Open the window with Time Stamping Settings... (also in the Tools menu).

9. The appearance of the signature

When Visible signature box is ticked, the signature is drawn on the page: by default in the lower right corner of the last page, with the name of the signer, the reason, the place and the date. Click Signature Appearance... to change it.

10. Reason, certification and encryption

Signing reason and location

In the main window, Signing reason offers five usual reasons: I am the author of this document, I have reviewed this document, I am approving this document, I attest to the accuracy and authenticity of this document and I agree to specified portions of this document. You can also type your own reason. Signing location is the place where you sign, for example the name of your city. Both are optional. They are saved in the signature and appear in the signature properties of the PDF reader; they appear in the signature box too, if the options Reason and Location are ticked in the appearance window (section 9).

Certify the document

When you certify a document, you indicate that you are its author and that you approve of its content. You also set which changes are still allowed for the document to remain certified. According to the PDF standard, a certifying signature must be the first signature of a document, and a document can have only one: use Certify only for documents that are not signed yet. PDF readers show a certifying signature with a blue ribbon in the signature panel.

Tick Certify in the main window and choose the level:

Encrypt the signed document

If you want to protect the signed document, for instance to prevent the copying of its content, you can encrypt it. Tick Encrypt document: the encryption window opens (it opens by itself when no password is set yet), and the document is signed and encrypted in the same operation, so the signature stays valid.

At least one of the two passwords is required, and they must be different (with the same password, the recipients could remove the restrictions). The open password is asked by the PDF reader when the document is opened; the restrictions are shown in the security settings of the document.

11. Protected, damaged and already signed documents

Documents protected with a password

Some PDF documents are protected with a password. To sign such a document, tick Owner password of encrypted PDFs in the main window and type the password. It must be the owner password (the permissions password): signing changes the document, and only the owner password allows it. The password that only opens the document is not enough. The signed document keeps the protection of the original: the same passwords, the same restrictions and the same encryption.

If the password is missing or wrong, PDF Signer does not sign the document and explains why:

• The PDF document is protected with a password and it cannot be opened: the password is not set or it is not correct. Enter the owner password of the document in 'Owner password of encrypted PDFs'.
• The PDF document is protected and it can be signed only with its owner password (the password of the document permissions), not with the password that only opens it. Enter the owner password in 'Owner password of encrypted PDFs'.

The password of the main window is used for all the documents you sign in the same operation. When you sign a folder of documents that have different passwords, the documents with another password are not signed and are listed at the end (section 12); sign them separately.

Documents that are already signed

You can sign a document that already has signatures. The new signature is added after the existing ones, which remain valid. Do not use Certify for such a document: a certifying signature must be the first one (section 10).

Documents with a damaged structure

Some PDF documents have a damaged internal structure (a wrong table of the positions of the objects, for example after a faulty export or download). The PDF readers repair such a document silently when they open it, and you do not notice anything. A document like this cannot be signed by simply adding a signature at the end, so PDF Signer rebuilds it before signing:

• A damaged document that has no signature is rebuilt and signed, without any question. The content of the pages does not change, and a protected document keeps its passwords and permissions.
• A damaged document that is already signed can be signed only after the rebuild, and the rebuild makes the existing signatures invalid. PDF Signer asks you first and explains it. The default answer is No.

When a folder is signed, the question is asked for each such document, and a document for which you answer No is listed among the errors at the end. When the signing is made from the command line (section 16), nobody can answer the question, so these documents are not signed and the result code is 1.

12. Signing several documents or a whole folder

Several documents selected together

Click ... next to Source and select several documents in the file window (Ctrl + click, or Shift + click for a range). You can also drag the documents from Windows Explorer onto the window. The box lists the selected documents, and Destination becomes a folder: by default the folder of the first document. Each document is saved in the destination folder with the same name plus [signed], for example invoice-001.pdf becomes invoice-001[signed].pdf; the originals are not touched.

All the documents of a folder

To sign all the PDF documents of a folder at once, select A folder with PDF documents.

1. Under Source choose the folder with your documents (or drag the folder onto the window).
2. Under Destination choose another folder. Every PDF document of the source folder is signed and saved in the destination folder with the same name: invoice-001.pdf remains invoice-001.pdf. The source and the destination must be different folders, otherwise the originals would be overwritten. Only the documents of the folder itself are signed, not those of its subfolders.
3. Click Apply Digital Signature. While it works, the bottom bar shows the progress and a Cancel button. When it finishes you see how many documents were signed.

A problem with one document does not stop the others. At the end the message lists the documents that failed and why (the first ten). If the PIN of your smart card is rejected, the operation stops at once, so the card is not locked by repeated wrong attempts.

13. Checking a signed document

In PDF Signer: Document Properties

Open File → Document Properties.... If a document is selected in the Source box, it is shown; otherwise the program asks you to select one. The window shows the number of pages, the size of the page and, for each signature of the document (choose it from the list; the ... button next to the list shows the certificate of the signer): the reason and the place of the signature, the hash algorithm, the integrity of the signature, the date and the time stamp server.

For a document that is protected with a password, tick Owner password of encrypted PDFs in the main window and type the password before you open the properties.

In Adobe Reader

Open the signed document in Adobe Reader and look at the bar above the document and at the Signatures panel. For a certificate that is not in the lists that Adobe trusts, for example the certificate of your company or a test certificate, Adobe says that the validity is unknown:

This is not an error of the signature or of PDF Signer: Adobe uses its own lists of trusted authorities. A signature made with a qualified certificate, or with a certificate of an authority that Adobe trusts, is shown as valid without any setting. For the other certificates, the person who receives the document can tell Adobe that it trusts the certificate:

1. Open the Signature Properties and click Show Certificate....
2. Select the topmost certificate of the chain, open the Trust tab and click Add to Trusted Identities....
3. Tick all the boxes, click OK, and open the document again.

The steps for the different versions of Adobe Reader, the time stamps and the revocation checks are described in the guide Validating Digital Signatures in Adobe.

With the European validator

To check the level of the signature (advanced or qualified), use the validation tool of the European Commission, described in section 7.4.

14. Creating a test certificate

If you do not have a certificate yet and only want to try the program, PDF Signer can create a self-signed one. Open Tools → Create a self-signed Digital Certificate...

1. Choose where to save it: On Microsoft Certificate Store (the certificate is installed for your Windows account) or On a password protected PKCS#12 PFX file (you will be asked for the file name and a password).
2. Type Issued to (your name, required) and, if you wish, the organization, the unit, the title, the e-mail address and the country code (two letters, for example US).
3. Choose the Validity period (3, 5 or 10 years, default 3 years), the Key Algorithm (RSA 2048, 3072 or 4096 bits, or ECDSA with the curves P-256, P-384 or P-521; default RSA 2048) and the Hash Algorithm (SHA256, SHA384 or SHA512; default SHA256). The defaults are fine.
4. Keep Set as current digital certificate ticked to use it right away, then click OK and confirm the question that explains what a self-signed certificate is.

15. Saving your settings

The program remembers your choices (certificate, signature format, appearance, time stamp server, encryption...) the next time you start it. You can also keep several sets of settings in files — for example one for invoices and one for contracts:

• File → Save Configuration (Ctrl+S) saves the current settings now. They are also saved when you close the program.
• File → Save Configuration As... saves the current settings in a file you name.
• File → Load Configuration... loads them again.
• Tools → Restore Defaults returns everything to the original values: the selected certificate, the appearance of the signature and the time stamp server too. The program asks you to confirm first.

The settings are kept in the file configuration.xml, in the folder %APPDATA%\Secure Soft\PDF Signer\12.0 of your Windows account. A saved configuration file is also what the command line uses to sign documents automatically.

16. Automatic signatures from the command line

PDF Signer can also sign without showing its window, for example from a scheduled task, from a script or from another program. Nobody has to click anything: the program reads the settings from a configuration file, signs and closes.

By default, PDF Signer is installed in the folder C:\Program Files (x86)\Secure Soft\PDF Signer (on a 32-bit Windows: C:\Program Files\Secure Soft\PDF Signer) and the program is PDF Signer.exe.

Command line parameters

"PDF Signer.exe" <source file> <destination file> [<configuration file>]
"PDF Signer.exe" <source folder> <destination folder> [<configuration file>]

• source folder: all the PDF documents of the folder are signed, with the same names, in the destination folder. The destination folder must exist.
• configuration file: a file saved with File → Save Configuration As.... When it is not given, the current configuration of your Windows account is used.
• Do not end a path written between quotes with a backslash: write "C:\Folder", not "C:\Folder\". Windows would read the last backslash and quote as one character and the parameters would be mixed up.
• An error on one document of a folder does not stop the other documents.

Sign one document

c:\Program Files (x86)\Secure Soft\PDF Signer>"PDF Signer.exe" C:\Demo\Invoices\invoice-001.pdf C:\Demo\Signed\invoice-001.pdf
The file was digitally signed successfully.

Sign a folder

c:\Program Files (x86)\Secure Soft\PDF Signer>"PDF Signer.exe" C:\Demo\Invoices C:\Demo\Signed
The PDF documents of the source folder were digitally signed successfully. Number of signed documents: 3

Custom configuration

In some cases you need a different signature configuration (for example a different certificate, signature format or appearance) for different documents or folders. To save a specific configuration, open the window, set everything you want, and go to File → Save Configuration As... Save the configuration in a file. Later you can use that file in the command line to apply a different signature configuration:

"PDF Signer.exe" C:\Demo\Invoices C:\Demo\Signed C:\Demo\invoices.config

Advanced values of the configuration file

The configuration file is a text file (XML) that you can also read and change with a text editor. Most of its values are the choices of the window. These ones are written in the file with technical names, and two of them have no place in the window:

Result codes

The messages are written in the command window. Examples:

The destination folder does not exist.                          (code 2)
The destination cannot be the same as the source.               (code 2)
The source file or folder does not exist.                       (code 2)
The configuration file does not exist.                          (code 2)
The configuration file contains values that are not valid (C:\Demo\invalid.config):
SignatureFormat: 'PAdES-BB' is not valid (valid values: PAdES-B, PAdES-LT, PAdES-LTA, PKCS7).    (code 2)
Operation finished with errors. Signed files: 1 of 2. Last error: ...    (code 1)

When the certificate is not meant to sign documents (section 6.3), the program writes a warning before the signing starts, and it writes it in the log too. The warning does not change the result: the documents are signed and the code is 0.

Warning: the certificate is not intended to sign documents (its extended key usage is only Time Stamping). The validators can report the signatures created with it.

PDF Signer is a Windows application, so the command prompt does not wait for it. To wait and read the result code:

cmd:         start "" /wait "PDF Signer.exe" C:\Demo\Invoices C:\Demo\Signed C:\Demo\invoices.config
             echo %errorlevel%

PowerShell:  (Start-Process "PDF Signer.exe" -ArgumentList '"C:\Demo\Invoices" "C:\Demo\Signed" "C:\Demo\invoices.config"' -Wait -PassThru).ExitCode

Every signed document, and every error, is also written in the log files log.txt and errorlog.txt of the folder %APPDATA%\Secure Soft\PDF Signer\12.0.

17. The Signature Library behind PDF Signer

PDF Signer is an application built on the Signature Library (SignLib), a library for .NET that creates and verifies digital signatures: PDF (PAdES), CAdES / PKCS#7, XML (XAdES), Office and more. Everything PDF Signer does is available to your own programs and scripts through the library:

• Library page: https://www.signfiles.com/signature-library/
• Download (library, samples and PowerShell scripts): https://www.signfiles.com/sdk/SignatureLibrary.zip
• Code samples: sign a PDF document, automatic signature (bypass the PIN), PowerShell

The library works with Windows PowerShell, C#, VB.NET and ASP.NET, and it supports certificates from PFX files, from the Windows store and from smart cards, USB tokens and HSMs.

From the window to the code

PDF signatures are created with the class SignLib.Pdf.PdfSignature. The table shows what each setting of PDF Signer is in the library.

The library can do more than the window: an explicit signature policy, the signing of an existing empty signature field, a document time stamp without a signature, and the deferred signing with an external signer (HSM, cloud). Section 19 shows the main cases.

18. Digitally sign PDF documents using Windows PowerShell

The main functions of PDF Signer are available in the SignLib library, which you can download from this link: https://www.signfiles.com/sdk/SignatureLibrary.zip

To digitally sign a PDF document using Windows PowerShell, simply download the library above and inspect the Signature Library\PowerShell Scripts folder. The script below creates a test PFX certificate on the fly, signs the document in the PAdES-B-B format (SHA256) and verifies the result.

The script

Save it as signPdf.ps1, in the same folder with SignLib.dll and iTextSharp-4.1.6.dll.

#digitally sign a PDF document with a PFX certificate created on the fly (PAdES-B-B, SHA256) and verify the result
#the script can be configured to use an existing PFX file or a certificate loaded from the Windows certificate store (smart card certificate)

if ($args.Length -eq 0)
{
    echo "Usage: signPdf.ps1 <unsigned file> <signed file>"
}
else
{
    #SignLib.dll and iTextSharp-4.1.6.dll must be in the same folder as the script
    $DllPath = Join-Path $PSScriptRoot 'SignLib.dll'
    [System.Reflection.Assembly]::LoadFrom($DllPath) | Out-Null

    #create a PFX digital certificate
    $generator = new-object -typeName SignLib.Certificates.X509CertificateGenerator("serial number")
    $pFXFilePassword = "tempP@ssword"
    $generator.Subject = "CN=Your Certificate, E=useremail@email.com, O=Organization"
    $generator.Extensions.AddKeyUsage([SignLib.Certificates.CertificateKeyUsage]::DigitalSignature)
    $generator.Extensions.AddEnhancedKeyUsage([SignLib.Certificates.CertificateEnhancedKeyUsage]::DocumentSigning)

    echo "Create the certificate..."
    $certificate = $generator.GenerateCertificate($pFXFilePassword)

    #digitally sign the PDF document (PAdES-B-B, SHA256)
    $sign = new-object -typeName SignLib.Pdf.PdfSignature("serial number")
    $sign.LoadPdfDocument($args[0])
    $sign.DigitalSignatureCertificate = [SignLib.Certificates.DigitalCertificate]::LoadCertificate($certificate, $pFXFilePassword)
    $sign.SignatureStandard = [SignLib.Pdf.PdfSignatureStandard]::Pades

    $sign.SigningReason = "I approve this document"
    $sign.SigningLocation = "Accounting department"
    $sign.SignaturePage = 1
    $sign.SignaturePosition = [SignLib.Pdf.SignaturePosition]::TopRight

    echo "Perform the digital signature..."
    [System.IO.File]::WriteAllBytes($args[1], $sign.ApplyDigitalSignature())

    #verify the signature
    $verify = new-object -typeName SignLib.Pdf.PdfSignature("serial number")
    $verify.LoadPdfDocument($args[1])
    echo ("Signatures: " + $verify.DocumentProperties.DigitalSignatures.Count)
    echo ("Valid: " + $verify.DocumentProperties.DigitalSignatures[0].SignatureIsValid)
}

How to run it

How to run the Windows PowerShell script from the command line:

powershell -executionPolicy bypass -file d:\signPdf.ps1 d:\invoice.pdf d:\invoice-signed.pdf

The result in the window:

Create the certificate...
Perform the digital signature...
Signatures: 1
Valid: True

19. Digitally sign PDF documents using C# or VB.NET

The main functions of PDF Signer are available in the SignLib library (download). To digitally sign a PDF document using C# or VB.NET, download the library, add a reference to SignLib.dll in your project, make sure that iTextSharp-4.1.6.dll, delivered with it, is in the same folder as your program, and inspect the sample projects of the package and the code samples: sign a PDF document, automatic signature, PowerShell.

PDF documents are signed with the class PdfSignature (namespace SignLib.Pdf). It creates PAdES and PKCS#7 signatures, with or without a time stamp and long-term validation data, visible or invisible, and it reads the signatures of a document (DocumentProperties.DigitalSignatures). All the examples below use these namespaces. Every example was run with the library to check the result.

using System;
using System.Collections.Generic;   // List<int>
using System.IO;
using System.Security.Cryptography.X509Certificates;
using SignLib;                 // HashAlgorithm
using SignLib.Certificates;    // DigitalCertificate
using SignLib.Pdf;             // PdfSignature, SignaturePosition, PdfSignatureStandard...

19.1 Sign a document and verify the signature

The smallest program: load a certificate from a PFX file, sign, save the signed document and verify it. The signature format is PAdES-B-B (PdfSignatureStandard.Pades) and the hash is SHA256, like the defaults of PDF Signer. ApplyDigitalSignature returns the bytes of the signed document: you choose where to save it. The PdfSignature object that verifies is a new one, loaded with the signed document.

// "serial number" is the serial number of the library
PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Invoices\invoice-001.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

ps.SignatureStandard = PdfSignatureStandard.Pades;      // PAdES-B-B
ps.HashAlgorithm = HashAlgorithm.SHA256;
ps.SigningReason = "I am approving this document";
ps.SigningLocation = "Springfield";
ps.SignaturePage = int.MaxValue;                        // the last page
ps.SignaturePosition = SignaturePosition.BottomRight;

// apply the digital signature: the original document is not changed
byte[] signed = ps.ApplyDigitalSignature();
File.WriteAllBytes(@"C:\Demo\Signed\invoice-001-code.pdf", signed);

// verify the signature
PdfSignature check = new PdfSignature("serial number");
check.LoadPdfDocument(@"C:\Demo\Signed\invoice-001-code.pdf");

Console.WriteLine("Pages: " + check.DocumentProperties.NumberOfPages + ", signatures: " + check.DocumentProperties.DigitalSignatures.Count);
foreach (PdfSignatureInfo info in check.DocumentProperties.DigitalSignatures)
{
    Console.WriteLine("Signer: " + info.SignatureCertificate.GetNameInfo(X509NameType.SimpleName, false));
    Console.WriteLine("Hash: " + info.HashAlgorithm);
    Console.WriteLine("Reason: " + info.SigningReason + ", location: " + info.SigningLocation);
    Console.WriteLine("Valid: " + info.SignatureIsValid);
    Console.WriteLine("Time: " + info.SignatureTime);
    Console.WriteLine("Time stamped: " + info.SignatureIsTimestamped);
}

The result:

Pages: 1, signatures: 1
Signer: Elaine Smith
Hash: SHA256
Reason: I am approving this document, location: Springfield
Valid: True
Time: 10/8/2026 7:04:42 PM
Time stamped: False

(X509NameType is in the namespace System.Security.Cryptography.X509Certificates.) The same example in VB.NET:

Imports System
Imports System.IO
Imports System.Security.Cryptography.X509Certificates
Imports SignLib
Imports SignLib.Certificates
Imports SignLib.Pdf

Module Module1
    Sub Main()
        ' "serial number" is the serial number of the library
        Dim ps As New PdfSignature("serial number")
        ps.LoadPdfDocument("C:\Demo\Invoices\invoice-001.pdf")
        ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate("C:\Demo\elaine.pfx", "123456")
        ps.SignatureStandard = PdfSignatureStandard.Pades
        ps.HashAlgorithm = HashAlgorithm.SHA256
        ps.SigningReason = "I am approving this document"
        ps.SigningLocation = "Springfield"
        ps.SignaturePosition = SignaturePosition.BottomRight

        'apply the digital signature and save the signed file
        File.WriteAllBytes("C:\Demo\Signed\invoice-001-vb.pdf", ps.ApplyDigitalSignature())

        Dim check As New PdfSignature("serial number")
        check.LoadPdfDocument("C:\Demo\Signed\invoice-001-vb.pdf")
        Console.WriteLine("Signatures: " & check.DocumentProperties.DigitalSignatures.Count)
        For Each info As PdfSignatureInfo In check.DocumentProperties.DigitalSignatures
            Console.WriteLine("Valid: " & info.SignatureIsValid)
        Next
    End Sub
End Module

19.2 Signature formats, time stamp and long term validation

The format is chosen with SignatureStandard, and the signature is time stamped (PAdES-B-T) when you set the address of a time stamp server (section 8):

A signature with time stamp (PAdES-B-T), and its verification:

PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Invoices\invoice-002.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

ps.SignatureStandard = PdfSignatureStandard.Pades;      // PAdES-B-T: PAdES-B-B plus a time stamp
ps.TimeStamping.ServerUrl = new Uri("https://ca.signfiles.com/TSAServer.aspx");
ps.TimeStamping.UseNonce = true;                        // a random number that protects the request
ps.TimeStamping.HashAlgorithm = HashAlgorithm.SHA256;   // the hash of the time stamp request
// ps.TimeStamping.UserName = "user"; ps.TimeStamping.Password = "password";   // only if the server requires them

File.WriteAllBytes(@"C:\Demo\Signed\invoice-002-code-t.pdf", ps.ApplyDigitalSignature());

PdfSignature check = new PdfSignature("serial number");
check.LoadPdfDocument(@"C:\Demo\Signed\invoice-002-code-t.pdf");
PdfSignatureInfo info = check.DocumentProperties.DigitalSignatures[0];
Console.WriteLine("Time stamped: " + info.SignatureIsTimestamped);
Console.WriteLine("Time stamp authority: " + info.TimestampInfo.TsaCertificate.GetNameInfo(X509NameType.SimpleName, false));
Console.WriteLine("Time stamp altered: " + info.TimestampInfo.IsTimestampAltered);

The result:

Time stamped: True
Time stamp authority: Free TSA Server
Time stamp altered: False

For long term validation, set SignatureStandard to PdfSignatureStandard.PadesLT; the signing adds the certificates and the revocation data of the signer to the document. PdfSignatureStandard.PadesLTA adds, in addition, the document time stamp. The time stamp server can be the server of a qualified time stamp authority (section 7.5).

PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Invoices\invoice-003.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

ps.SignatureStandard = PdfSignatureStandard.PadesLT;    // PAdES-B-LT (PdfSignatureStandard.PadesLTA for PAdES-B-LTA)
ps.TimeStamping.ServerUrl = new Uri("https://ca.signfiles.com/TSAServer.aspx");

File.WriteAllBytes(@"C:\Demo\Signed\invoice-003-code-lt.pdf", ps.ApplyDigitalSignature());
Console.WriteLine("Signed: " + new FileInfo(@"C:\Demo\Signed\invoice-003-code-lt.pdf").Length + " bytes");

19.3 A certificate from the Windows store or a smart card

When the certificate is in the Windows store (for instance, a qualified certificate on a smart card, section 6.2), load it with a search criterion. No window is shown, so the code can run without a user.

PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Invoices\invoice-001.pdf");

// the first certificate of the current user whose common name (CN) is "Elaine Smith"
// true = only the valid certificates (issued by a trusted authority); false = any certificate, also a self-signed test one
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(false, DigitalCertificateSearchCriteria.CommonNameCN, "Elaine Smith");

// only for a certificate on a smart card or on a token: the PIN, to avoid the PIN window. It applies to the next
// signature, made on this thread (a software certificate, like this one, does not use a PIN)
// DigitalCertificate.SmartCardPin = "1234";

File.WriteAllBytes(@"C:\Demo\Signed\invoice-001-code-store.pdf", ps.ApplyDigitalSignature());
Console.WriteLine("Signed with the certificate: " + ps.DigitalSignatureCertificate.Subject);

Other search criteria are the other fields of the subject (OrganizationO, EmailE...), the thumbprint and the serial number of the certificate. To let the user choose the certificate in a Windows window, call DigitalCertificate.LoadCertificate() without parameters.

19.4 Sign all the documents of a folder

Create the PdfSignature object once, and load and sign each document of the folder. For a smart card, set the PIN before every signature. A document that fails must not stop the others.

PdfSignature ps = new PdfSignature("serial number");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");
ps.SignatureStandard = PdfSignatureStandard.Pades;

foreach (string file in Directory.GetFiles(sourceFolder, "*.pdf"))
{
    try
    {
        // DigitalCertificate.SmartCardPin = "1234";      // for a smart card: before each signature
        ps.LoadPdfDocument(file);
        File.WriteAllBytes(Path.Combine(destinationFolder, Path.GetFileNameWithoutExtension(file) + "-code-folder.pdf"), ps.ApplyDigitalSignature());
        Console.WriteLine("Signed: " + Path.GetFileName(file));
    }
    catch (Exception ex)
    {
        // an error on a file does not stop the other files
        Console.WriteLine("Error: " + file + ": " + ex.Message);
    }
}

19.5 The appearance of the signature

PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Invoices\invoice-001.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

ps.VisibleSignature = true;                                               // false = invisible signature
ps.SignaturePages = new List<int> { 1, int.MaxValue };                    // the pages of the signature (int.MaxValue = the last page)
ps.SignatureAdvancedPosition = new System.Drawing.Rectangle(300, 40, 220, 70);   // x, y (from the bottom left corner), width, height
ps.FontName = "Helvetica";
ps.SignatureText = "Digitally signed by Elaine Smith";                      // your own text, instead of the default text

File.WriteAllBytes(@"C:\Demo\Signed\invoice-001-code-appearance.pdf", ps.ApplyDigitalSignature());
Console.WriteLine("Signed: appearance on the pages of the list");

The signature box can also contain an image (SignatureImage, SignatureImageType) and uses the font of your choice (FontName for the standard fonts, FontFile for a font file).

19.6 Certify and encrypt

A certifying signature (the first signature of a document) and the encryption of the signed document, with an open password and a permissions password:

PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Invoices\invoice-002.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

// a certifying signature: only the author, and only on a document that is not signed yet
ps.CertifySignature = CertifyMethod.NoChangesAllowed;

File.WriteAllBytes(@"C:\Demo\Signed\invoice-002-code-certified.pdf", ps.ApplyDigitalSignature());

PdfSignature check = new PdfSignature("serial number");
check.LoadPdfDocument(@"C:\Demo\Signed\invoice-002-code-certified.pdf");
Console.WriteLine("Certification level: " + check.DocumentProperties.CertificationLevel);

PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Invoices\invoice-001.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

ps.Encryption.EncryptionMethod = PdfEncryptionMethod.PasswordSecurity;
ps.Encryption.EncryptionAlgorithm = PdfEncryptionAlgorithm.EnhancedEncryption128BitAES;
ps.Encryption.OwnerPassword = "permissions-password";       // to change the restrictions
ps.Encryption.UserPassword = "open-password";              // to open the document (optional)
ps.Encryption.DocumentRestrictions = PdfDocumentRestrictions.AllowPrinting;     // what the recipients can do

File.WriteAllBytes(@"C:\Demo\Signed\invoice-001-code-encrypted.pdf", ps.ApplyDigitalSignature());
Console.WriteLine("Signed and encrypted");

The encrypted document cannot be signed with PadesLT or PadesLTA: the library stops with the error PdfReader not opened with owner password.

19.7 Protected and damaged documents

A document protected with a password is signed with its owner password, which must be set before the document is loaded:

PdfSignature ps = new PdfSignature("serial number");

// a protected document is signed with its owner password (the permissions password): set it before loading the document
ps.DocumentProperties.Password = "permissions-password";
ps.LoadPdfDocument(@"C:\Demo\Signed\invoice-001-code-encrypted.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

try
{
    File.WriteAllBytes(@"C:\Demo\Signed\invoice-001-code-encrypted-2.pdf", ps.ApplyDigitalSignature());
    Console.WriteLine("Signed a protected document");
}
catch (Exception ex)
{
    Console.WriteLine("Not signed: " + ex.Message);
}

A damaged document (its structure had to be repaired when it was loaded, DocumentProperties.IsDamaged) is rebuilt before signing. If it already has signatures, the rebuild makes them invalid, so the library signs it only when you allow it with RebuildDamagedSignedDocument:

PdfSignature ps = new PdfSignature("serial number");
ps.LoadPdfDocument(@"C:\Demo\Check\invoice-damaged.pdf");
ps.DigitalSignatureCertificate = DigitalCertificate.LoadCertificate(@"C:\Demo\elaine.pfx", "123456");

Console.WriteLine("Damaged: " + ps.DocumentProperties.IsDamaged + ", signatures: " + ps.DocumentProperties.DigitalSignatures.Count);

// a damaged document that is already signed is rebuilt only when you allow it: the existing signatures become invalid
try
{
    ps.ApplyDigitalSignature();
}
catch (InvalidOperationException ex)
{
    Console.WriteLine("Not signed: " + ex.Message);
    ps.RebuildDamagedSignedDocument = true;
    File.WriteAllBytes(@"C:\Demo\Check\invoice-damaged-rebuilt.pdf", ps.ApplyDigitalSignature());
    Console.WriteLine("Signed after the rebuild");
}

The result:

Damaged: True, signatures: 1
Not signed: The PDF document is damaged (its structure has errors that were repaired when it was loaded) and it is already signed. A damaged document cannot be signed incrementally: it must be rebuilt, which makes the existing signatures invalid. Set RebuildDamagedSignedDocument to true to sign it anyway.
Signed after the rebuild

19.8 Good to know

20. Problems and solutions

21. Glossary

22. Warning and disclaimer, trademarks

Every effort has been made to make this manual as complete and accurate as possible, but no warranty or fitness is implied. The information provided is on an “as is” basis. The author shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this manual. The information about the eIDAS Regulation is a simplified explanation and it is not legal advice.

.NET, Windows, PowerShell, SmartScreen and Visual Studio are trademarks of Microsoft Corporation. Adobe and Adobe Reader are trademarks of Adobe Inc. All other trademarks are the property of their respective owners.