How to sign a PDF with a digital certificate on a Mac

To sign a PDF with a digital certificate on a Mac, you need an app that can use the certificate’s private key. In Better PDF, which does this for free: open the PDF, press S, drag a rectangle where the signature goes, choose your certificate or USB token, enter the PIN and save the signed copy.

That is the short version. The rest of this post is what happens underneath, and the places people usually get stuck.

What does a certificate signature prove?

A drawn signature is a picture. It shows that someone put a picture of a name on the page. Anyone with the file can copy it onto another file, and nothing in the PDF notices if the text around it changes later.

A certificate signature is a calculation. The app takes a hash of the document’s bytes and has your private key sign that hash. The private key lives in your Mac’s keychain or on a smart card or token, and it never leaves. The signed hash, your certificate and the chain of authorities that issued it are written into the PDF.

When someone opens the file, their PDF reader repeats the hash and checks it against yours. That tells them two things:

• The document has not changed since it was signed. Change one character and the check fails.
• Which certificate signed it. How much that says about you depends on who issued the certificate. One from a national authority or a commercial issuer is recognised by most readers. A self-signed one proves the file is intact, but not much about who you are.

It does not prove you read the document, and it does not on its own make a contract binding. What counts as a valid signature is a legal question that differs by country. What a certificate signature gives you is evidence that holds up to checking, which a picture does not.

Where does a drawn signature stop?

The PDF viewer that comes with a Mac is good at the visual kind. You can draw on the trackpad or hold a paper signature up to the camera, then drop the result onto the page. For a lease your landlord will print, that is often all anyone needs.

It does not sign with a certificate. If a government portal, a bank or a company asks for a PDF “digitally signed with your DSC” or “signed with a qualified certificate”, a picture of your name is not what they asked for, and you need an app that can reach your certificate.

How to sign with a certificate in Better PDF

You need macOS 26 or later and a certificate with its private key: in the Keychain, on a smart card, or on a USB token.

1. Open the PDF with ⌘O, or drop it on the window.
2. Press S for Fill & Sign.
3. Drag a rectangle on the page where the signature should appear. You can move or resize it afterwards. Esc cancels.
4. In the inspector on the right, choose your certificate. Keychain identities and tokens are listed together, with the token’s live state.
5. Enter the PIN if the card or token asks for one.
6. Sign. Better PDF asks where to save the signed copy, named <name> signed.pdf unless you change it.

The original file is left alone. The signed copy is the one you send.

Signing with a certificate is part of the free app, with no trial clock on it. The step by step is in Help: Sign with a certificate or USB token.

What about USB tokens and smart cards?

Tokens reach a Mac in one of two ways, and it matters which one yours uses.

CryptoTokenKit. Some makers ship a driver that plugs into macOS’s own smart card system. The certificate then appears in the Keychain like any other, while the key stays on the token. Better PDF lists it with the rest. This works in both the direct download and the Mac App Store edition.

PKCS#11. Many signing tokens, including ones issued for Indian DSCs such as the Watchdata ProxKey, ship a PKCS#11 library instead: a file the app loads to talk to the token. Better PDF loads it, shows whether the token is plugged in and ready, and asks for the PIN on its own card. The Mac App Store edition is sandboxed and is not allowed to load outside libraries, so these tokens need the direct download.

If you are not sure which kind you have, plug the token in and open Keychain Access. If its certificate appears there, it is CryptoTokenKit.

For the PIN you can choose to be asked every time, to have it remembered until you quit, or to keep it in the Keychain behind Touch ID.

What is PAdES?

PAdES is the European standard for signatures inside PDFs (ETSI EN 319 142). It describes how the signature, the certificate chain and the signing time are stored, so that a reader made by someone else can check them. Most PDF readers that verify signatures understand it, and so do the validators many governments run.

Better PDF writes a PAdES signature in CMS form, as an incremental update: the signature is appended after the original bytes, which are not rewritten. That is how PDF signatures are meant to work, and it is why a second person can sign the same file later without breaking the first signature.

Do I need a time-stamp?

A signature on its own records the time your Mac’s clock said. A time-stamp is a second signature, from a time-stamp authority, saying the hash existed at that moment. It matters when the signing time has to be proven later, for example after your certificate expires.

Time-stamps are off by default. Turn them on in Settings › Signing and Better PDF asks the RFC 3161 server set there for one each time you sign. Only a hash of the signature is sent, never the document. It is the one part of signing that uses the network.

What happens when someone opens the signed file?

Their PDF reader checks the signature. Whether it shows as valid usually depends on whether that reader recognises the issuer of your certificate, not on the app that signed. A certificate from a widely recognised issuer tends to show as valid. A self-signed or less common one is often flagged as unknown until the recipient chooses to accept it.

In Better PDF, signatures are checked on your Mac when you open the file. The status bar shows the result and the Signatures panel lists each one: unchanged since signing, time-stamped, certificate valid, an untrusted root, or changed after signing. Revocation is not checked online, so a certificate revoked yesterday still looks fine.

For how the signature looks on the page, with a logo, text lines and a date format, see Certificate signing in Better PDF. Signature styles are part of Pro. Signing itself is not.

Questions people ask

Can Preview sign a PDF with a digital certificate?

No, Preview places a drawn or photographed signature on the page as an image. Signing with a certificate or a USB token needs an app that writes a digital signature into the file.

Is a drawn signature legally valid?

For many everyday agreements it is, depending on where you live. When a form, a court or a tax office asks for a digital signature, they mean one made with a certificate, and a drawn one will not do.

Do I need the internet to sign with a certificate?

No, the signature is made on your Mac or on the token. Only the optional RFC 3161 time-stamp uses the network, and it sends a hash of the signature, not the document.

Why does my USB token work in the direct download but not the App Store edition?

Some tokens only ship a PKCS#11 driver, which a sandboxed app is not allowed to load. Tokens with a CryptoTokenKit driver, and certificates in the Keychain, work in both editions.