PDFNexus tool
Certificate sign (experimental)
Import a PKCS#12 certificate and apply an experimental crypto-intent appearance plus a detached PKCS#7 artifact. This is not Adobe-validated PDF signing.
Certificate sign (experimental)
Import a PKCS#12 certificate and apply an experimental crypto-intent appearance. Distinct from visual Sign PDF.
Drop a PDF here or click to browse
Processed in your browser — files stay on this device
Not the same as Sign PDF
Sign PDF adds a visual electronic stamp only. This tool parses a real PKCS#12 certificate and stamps CN + date, attaches signer.pem and a detached .p7s when the private key is present, and sets experimental metadata. It does not embed ISO 32000 /ByteRange CMS — Adobe Reader will not show a validated signature.
Experimental: visual appearance + signer PEM + detached PKCS#7 (.p7s) attachment. Not Adobe-validated CMS byte-range signing — viewers will not show a green checkmark.
Full PDF /ByteRange PKCS#7 embedding (ISO 32000) is not complete. Do not claim Adobe Reader validation, LTV, or TSA timestamps.
Detached .p7s (when present) covers the original PDF bytes before the appearance stamp — it will not verify the downloaded stamped file.
Provide both a PDF and a PKCS#12 file to continue.
Certificate password and PKCS#12 stay in your browser. Passwords are never logged or uploaded.
How it works
- Upload the PDF you want to mark with certificate intent.
- Select your .p12 / .pfx file and enter its password (never logged).
- Download one PDF that includes the CN appearance stamp plus attached signer.pem and optional signature-detached.p7s (embedded attachments — not separate download files).
Privacy
Runs in your browser. Certificate password and PKCS#12 never leave your device.
Limits
- Experimental — not ISO 32000 /ByteRange CMS embedded in the PDF.
- Adobe Reader will not show a green validated digital signature.
- No TSA timestamps or LTV/PAdES long-term validation.
- Distinct from /sign-pdf visual electronic stamps.
FAQ
- Will Adobe Reader validate this signature?
- No. The optional detached .p7s covers the original PDF bytes before the appearance stamp — it will not verify the downloaded stamped file. We do not embed ByteRange CMS. Do not claim Adobe-valid signing.
- Is this a legally binding digital signature?
- No compliance claim is made. Full CMS byte-range signing, TSA, and LTV are out of scope for this MVP.
- How is this different from Sign PDF?
- Sign PDF adds a typed or drawn visual stamp. Certificate sign uses a real PKCS#12 to show CN and embed PEM/PKCS#7 as PDF attachments, with clear experimental labeling.
- Are PEM and .p7s separate downloads?
- No. They are attached inside the output PDF (EmbeddedFile attachments). Open the PDF’s attachments panel to extract them.
- What if my password is wrong?
- You will see a clear error that the PKCS#12 password is wrong or the file is corrupted. The password is cleared from memory after each attempt.