This tool signs a PDF with a certificate you supply yourself — a password-protected .p12 or .pfx file — parsed entirely in your browser using WebCrypto; the private key and the password never leave the page and are cleared from memory once the signature is applied. The result is a real cryptographic PAdES-B-B signature, a detached CMS/SignedData in SHA-256 embedded in the PDF, with an optional visible appearance on the page you choose (name, date, reason, place). An RFC 3161 timestamp (PAdES-B-T) is available as an opt-in, off by default: only a 32-byte hash of the signature then travels to a timestamp authority, relayed through vellumpdf.ch — never the document itself. With your own certificate, the result is an advanced electronic signature, not a qualified electronic signature under Swiss ZertES or the EU eIDAS regulation: a qualified signature requires a qualified certificate held on a secure device — a smart card, an HSM, or a qualified trust service such as Swisscom, SwissSign or QuoVadis — which a browser cannot produce from a .p12 file. It suits internal documents, correspondence or contracts with no formal requirement, not acts that Swiss law requires to be in writing.
No: signing with your own certificate (.p12 file) produces an advanced electronic signature, not a qualified signature under the Swiss electronic signature act (ZertES) or the EU eIDAS regulation. A qualified signature requires a qualified certificate held on a secure device (smart card, HSM) or a qualified trust service, which a browser cannot produce from a .p12 file. This signature is suitable for internal documents, correspondence, or contracts with no formal requirement, but not for acts requiring written form under Swiss law.
Several Swiss providers issue certificates: SwissSign, QuoVadis, or the Swisscom All-in Signing Service. A law firm or trust company can also use a certificate issued by its own internal certification authority, usually set up by its IT department. In every case, a certificate obtained as a .p12 file is, by construction, not a qualified one.
No, the PDF, the .p12 file and its password are processed entirely on your device, in the browser, using WebCrypto; neither the private key nor the password leave the page, and both are cleared from memory after signing. The one exception is the optional timestamp, off by default: if enabled, a 32-byte hash (SHA-256) of the signature — not the document — is relayed through vellumpdf.ch to a timestamp authority, which returns a signed proof of the date. If that service is unreachable, the signature is still produced, without a timestamp, and you are told.
Because Acrobat only trusts the authorities on its own list (the Adobe Approved Trust List), and your certificate — self-signed, issued by your company, or by an authority not on that list — is not on it. This does not mean the signature is invalid: the cryptography checks out, only the issuer’s identity is not automatically vouched for. The recipient can add your certificate to their own trust list, after which the signature will show as valid.
No, not in this version of the tool: if a PDF already contains a signature, Vellum refuses to sign it again rather than produce a file that would invalidate the first signature. Adding an extra signature to an already-signed document requires an incremental update of the file, which this version does not perform.
Use the Vellum tool "Check a signature", or Acrobat Reader’s signature panel. If you enabled the timestamp, it provides extra proof: the date on which the signature already existed, independent of the clock of the machine that signed it.
Vellum — free PDF tools whose processing stays on your device.