Better PDFby Evenpine
Better PDF blog

Certificate signing in Better PDF: keychain certificates, USB tokens and signature styles

· 3 min read · signing, certificates, guide

In short: Better PDF signs PDFs on a Mac with a keychain certificate, a smart card or a USB token. It writes a PAdES signature as an incremental update, with an optional RFC 3161 time-stamp. You can also draw or type a visual signature. Signing is free; signature styles, which set how a signature looks, are part of Pro.

The Signatures block of a membership agreement in Better PDF, with a typed signature inside a dashed placement rectangle on the Member line

Better PDF signs in two ways from the same place: a visual signature you draw or type, and a digital signature made with a certificate. Both are free. This post covers what each one is, where certificates come from, what goes into the file, and how signature styles change the way a signature looks.

Two kinds of signature

A visual signature is your name, typed or drawn, placed on the page.

A digital signature is made with a certificate and its private key. It is written into the file alongside an appearance on the page.

Press S for Fill & Sign, drag a rectangle where the signature goes, and choose how to sign.

Where your certificate lives

In the Keychain. If the certificate and its private key are in your Mac’s keychain, Better PDF lists it. That includes smart cards and USB tokens whose maker ships a CryptoTokenKit driver: the key stays on the card, and the Mac asks the card to sign.

On a USB token with a PKCS#11 driver. Many signing tokens, the Watchdata ProxKey among them, ship a PKCS#11 library instead. Better PDF loads that driver, shows the token’s live state, and asks for the PIN on a card of its own. Because the Mac App Store edition is sandboxed and cannot load such a driver, these tokens need the direct download from betterpdf.co. Keychain and CryptoTokenKit signing work in both editions.

Your PIN. Choose to be asked every time, to have it remembered until you quit, or to keep it in the Keychain behind Touch ID.

What gets written

Better PDF builds a CMS signature in the PAdES format and writes it as an incremental update: the signature is appended after the original bytes, which are not rewritten.

Time-stamps are optional and off by default. Turn them on in Settings › Signing and Better PDF asks an RFC 3161 server for a time-stamp; only a hash of the signature is sent, never the document.

Signatures in a PDF you open

Open a signed PDF and Better PDF checks its signatures on your Mac. The status bar shows the result, and the Signatures panel lists each signature: unchanged since signing, time-stamped, certificate valid, an untrusted root, or changed after signing. You can view the certificate and choose to trust its root. Revocation is not checked online.

How the signature looks

Signature styles set the appearance of a signature on the page. Six are built in, and you can build your own:

  • stack logos behind or in front of the text, each with its own opacity, size and anchor,
  • edit the text lines, with placeholders such as {name}, {date}, {reason} and {location} filled in when you sign,
  • set the font, size and weight per line,
  • pick any date format, including ISO 8601, in local time, UTC or a named time zone.

Make a style the default for a certificate and it is used every time you sign with it. The preview in the style sheet and the signature in the file come from the same renderer.

Signature styles are part of Pro, a single payment from $9.99 (the founder price for the first 100 buyers). Signing stays free.

In short

  1. Press S, drag the rectangle.
  2. Draw or type your name, or pick your certificate, smart card or USB token.
  3. Sign. A certificate signature is written as PAdES in an incremental update, with a time-stamp if you turned them on.

The step by step is in Help: Sign with a certificate or USB token and Signature styles.

Questions people ask

Is certificate signing free in Better PDF?
Yes, signing with a keychain certificate, smart card or USB token is part of the free app with no time limit. Signature styles, which only change how the signature looks on the page, are part of Pro.
Which edition do I need for a PKCS#11 token?
The direct download, because the Mac App Store edition is sandboxed and cannot load a PKCS#11 driver. Keychain certificates and CryptoTokenKit tokens work in both editions.
Does signing send my document anywhere?
No, the signature is made on your Mac or on the token. If you turn time-stamps on, only a hash of the signature goes to the RFC 3161 server.