Sign with a certificate
Your private key never leaves the device — an advanced signature, not a qualified one.
Your files never leave your deviceDrop the PDF you want to sign
or click to browse your files
How to sign a PDF with a certificate, step by step
This tool produces an advanced electronic signature in PAdES format, using your own .p12 certificate: the private key stays on your device from start to finish.
Drop the PDF to sign
Drag the file in, or click to browse for it. A document that already carries a signature is refused: a second signature would invalidate the first.
Choose your certificate file and its password
The .p12 or .pfx file and its password are read on the page, never sent; click “Open the certificate” to check the identity it carries.
Fill in the signature’s details
Displayed name, reason, place and contact are optional and appear in the signature box if you choose a visible signature.
Choose the appearance and position
A visible signature is placed with a click on the page preview; an invisible signature seals the document without displaying anything. A hand-drawn initial can be added to the box.
Turn on the timestamp if you want one
Off by default, it sends only the signature’s 32-byte hash — never the document — to a third-party timestamp authority.
Click “Sign and download”
VellumPDF produces the signature, embeds it in the PDF, and offers the result for download.
This signature is an advanced electronic signature, never a qualified one: it does not carry the weight of a qualified signature under the Swiss electronic signature act (ZertES) or the eIDAS regulation, which requires a qualified certificate on a secure device. It suits internal use or a contract with no formal requirement, not an act that requires written form.
Frequently asked questions
Does signing with my own certificate produce a qualified electronic signature?
No: signing with your own certificate (.p12 file) produces an advanced electronic signature, not a qualified signature under the Swiss electronic signature act (ZertES) or the EU eIDAS regulation. A qualified signature requires a qualified certificate held on a secure device (smart card, HSM) or a qualified trust service, which a browser cannot produce from a .p12 file. This signature is suitable for internal documents, correspondence, or contracts with no formal requirement, but not for acts requiring written form under Swiss law.
Where can I get a signing certificate in Switzerland?
Several Swiss providers issue certificates: SwissSign, QuoVadis, or the Swisscom All-in Signing Service. A law firm or trust company can also use a certificate issued by its own internal certification authority, usually set up by its IT department. In every case, a certificate obtained as a .p12 file is, by construction, not a qualified one.
Is my PDF file or my certificate sent to a server?
No, the PDF, the .p12 file and its password are processed entirely on your device, in the browser, using WebCrypto; neither the private key nor the password leave the page, and both are cleared from memory after signing. The one exception is the optional timestamp, off by default: if enabled, a 32-byte hash (SHA-256) of the signature — not the document — is relayed through vellumpdf.ch to a timestamp authority, which returns a signed proof of the date. If that service is unreachable, the signature is still produced, without a timestamp, and you are told.
Why does Acrobat show "the validity of the signature is unknown"?
Because Acrobat only trusts the authorities on its own list (the Adobe Approved Trust List), and your certificate — self-signed, issued by your company, or by an authority not on that list — is not on it. This does not mean the signature is invalid: the cryptography checks out, only the issuer’s identity is not automatically vouched for. The recipient can add your certificate to their own trust list, after which the signature will show as valid.
Can I add a second signature to a PDF that is already signed?
No, not in this version of the tool: if a PDF already contains a signature, VellumPDF refuses to sign it again rather than produce a file that would invalidate the first signature. Adding an extra signature to an already-signed document requires an incremental update of the file, which this version does not perform.
How do I check my signature afterwards?
Use the VellumPDF tool "Check a signature", or Acrobat Reader’s signature panel. If you enabled the timestamp, it provides extra proof: the date on which the signature already existed, independent of the clock of the machine that signed it.