How to digitally sign a PDF with a DSC
Signing a PDF properly takes three things: a certificate issued to you, a tool that can embed it, and a reader that can check it. Here is what each one does and where people go wrong.
A digital signature is not a picture of your handwriting pasted onto a page. It is a mathematical operation: your private key produces a value that could only have come from that key, calculated over the exact bytes of the document. Anyone who opens the file later can verify two things from it — that the document has not changed since you signed, and which certificate signed it.
That distinction matters because most "e-signature" tools only do the picture. The rest of this page is about the real thing.
What you need before you start
A Digital Signature Certificate
In India, certificates that carry legal weight are issued by Certifying Authorities licensed by the Controller of Certifying Authorities (CCA), a body created under the Information Technology Act 2000. Familiar names include eMudhra, Sify, Capricorn, nCode, VSign and PantaSign.
Since the start of 2021, Class 3 is effectively the only class issued for individuals and organisations; Class 2 was withdrawn. Certificates come in signing-only, encryption-only and combination forms, and typically run for one, two or three years.
The certificate in a usable form
This is the step that catches people out. Your DSC arrives in one of two shapes:
- On a USB crypto token — ePass2003, ProxKey, HYP2003, Watchdata and similar. The private key is generated inside the token and is designed never to leave it.
- As a software certificate file — a
.pfxor.p12file protected by a password.
Which one you have decides which tools can sign for you. A browser cannot read a USB token at all, so any web-based signer needs the file form.
Signing the document
- Start with a PDF. If your document is in Word, export it to PDF first — from Word itself, so the text stays selectable. Signing a Word file directly means converting it anyway, and conversion after signing would break the signature.
- Finish all edits. A signature covers the document as it stands at that moment. Any change afterwards, even adding a page number, invalidates it.
- Choose where the visible mark goes. The visible stamp is optional and cosmetic — the signature is embedded whether or not anything appears on the page — but most Indian offices expect to see one.
- Apply the certificate. The tool hashes the document, signs that hash with your private key, and embeds the result along with your certificate inside the PDF file structure.
- Save as a new file. Keep the unsigned original. If you need to make a correction, you edit the original and sign again — you cannot edit a signed file and keep the signature.
Checking that it worked
Open the result in Adobe Acrobat Reader. Not Chrome, not Edge, not your phone's default viewer — those ignore signatures entirely, so a forged file looks identical to a genuine one in them. This is the most common mistake people make when verifying.
In Acrobat you will see a bar across the top of the document and a Signature Panel button. Open it, then right-click the signature entry and choose Show Signature Properties. From there you can inspect the certificate itself: who issued it, its validity dates, and whether the signing time falls inside them.
Three outcomes are possible, and only one of them means something is wrong:
| What you see | What it means |
|---|---|
| Green tick | Document unchanged since signing, and the issuing authority is trusted by Acrobat. |
| Yellow triangle | Document unchanged, but Acrobat does not recognise the issuer. Usually a trust-store gap, not a problem with the file. |
| Red cross | The document was modified after signing. This one matters. |
Things worth knowing
The signing time is not proof of time
Unless a timestamp from an RFC 3161 timestamping authority is attached, the date recorded in the signature comes from the signer's own computer clock. It can be set to anything. If the date has legal or contractual significance, insist on a timestamped signature.
An expired certificate does not retroactively void a signature
What matters is whether the certificate was valid at the moment of signing. Readers will flag it, and without a trusted timestamp you cannot prove when signing happened — which is the practical reason timestamps exist.
Aadhaar eSign is a different route
eSign services let you sign with an OTP against your Aadhaar record instead of holding a certificate yourself. A certificate is generated for that single transaction. It is recognised under the IT Act and is often simpler for one-off signing, but you cannot use it offline and you do not keep a reusable certificate.
Common questions
- Can I sign a PDF with a DSC for free?
- Yes. The certificate itself costs money and must be bought from a licensed CA, but the signing software does not have to. Free desktop tools and browser-based tools can both embed a signature using a certificate you already own.
- Why does my signature show a yellow warning instead of a green tick?
- Adobe Reader only shows green when the issuing authority is in its Approved Trust List. A yellow triangle means the cryptography checked out and the document is intact, but Acrobat does not recognise the issuer. It is not a sign of tampering.
- Can I sign a Word document directly?
- Word has its own signature feature, but the result is only checkable in Microsoft Office. For a signature anyone can verify, export to PDF first and sign the PDF.
- Does the visible stamp matter legally?
- No. The legal effect comes from the embedded cryptographic signature, not from anything drawn on the page. The visible mark is a convention that helps human readers, and a document with no visible mark can be perfectly valid.
- What happens if I edit the document after signing?
- The signature breaks. Any change to the bytes means the recomputed hash no longer matches, and readers show a red cross. You must edit the original and sign again.