Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When sending an invoice in PDF format, it is useful (in some countries obligatory) to sign this PDF digitally.

Of course, I could create a self-signed certificate via OpenSSL, but a warning "could not verify certificate" in the PDF rather reduces trust than increases it. Of course, this is absolutely correct as anyone could create self-signed certificates in any name.

No problem, I thought. I have an SSL certificate signed by RapidSSL, signed by CACert and OpenSSL allows me to convert this to a PKCS#12 certificate file

Probably it is bold to expect that the same instance valid for signing SSL certificates would also be valid for my PDF documents. So Adobe Acrobat shows the same message again that it cannot verify the certificate.

Well, then someone probably sells certificates that are signed by some authority that is trusted by Adobe Acrobat by default. However, I simply can't find the right search term in Google to locate appropriate offers.

Therefore my question: Did I think completely wrong in one point or another? And: What must I watch for at the certificate vendors when I need a certificate that Adobe Acrobat likes?

share|improve this question
up vote 4 down vote accepted

This is mostly a link only answer, however I do know that if the signing CA isn't marked as trusted by the app (Acrobat in this case) then it won't be marked as trusted. That being said, this link talks about exactly what your asking:

share|improve this answer
Thank you. This link is actually very helpful! When my SSL certificate expires I should probably buy the new one from an CA listed in the Adobe Approved Trust List... Let's see if this SSL can then be misused for PDFs ;) Actually some of the CAs whose websites I have yet visited, do not tell so much about which one to buy for PDF signing. Would probably be too easy... – BurninLeo Jan 11 '13 at 20:21
It's certainly possible if your certificate is signed by a CA on that list. Hey if this answered your question let everyone know :-) – BigHomie Jan 11 '13 at 20:26
My (extra-cheap RapidSSL-)certificate roots to GeoTrust which is not on the list :( Btw. The prices for "explicit" PDF certificates (e.g. are about $400. I could get a large bunch of standard SSL certificates for that... – BurninLeo Jan 11 '13 at 20:28
Yeah it's a racket alright, we had to get a cert for use with Intel vPro and it was $500 USD. – BigHomie Jan 11 '13 at 20:29

I have found 4 organizations, trusted by Adobe Acrobat so that the signatures will be considered "valid" in Acrobat Reader, Standard, or Pro, that sell these certificates. They are all expensive (typically $300/year).

Note that Adobe has built things so that the person who signs a PDF document MUST use "two-factor authentication" at the time they sign the document. This means that simply purchasing and possessing the certificate itself is not enough. You must also typically have a USB thumb device on hand that you must physically stick into the computer while you sign the document, along with the certificate. (This explains the cost.)

Here are 4 organizations from whom you can purchase an Adobe-certified Digital ID certificate, along with a proper physical USB thumb device, that will be considered "valid" by anyone viewing your signed document in Adobe Reader or Adobe Acrobat:

What a pain! Thanks for making life so difficult, Adobe, by making this so expensive.

share|improve this answer
The service itself still has large profit margins: the certificate hardware USB stick itself costs only tens of dollars, and the verification step involves an employee manually verifying your provided identity documentation, probably less than a half-hour's work for a $30/hr employee. I suspect that Adobe might charge a hefty licensing fee and of course require regular auditing, but because of the public-at-large's ignorance of PKI (who think services like DocuSign are somehow just as good) means the demand is low, which reduces the incentive for competition to drive prices down. – Dai Apr 2 at 23:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.