How to Digitally Sign PDFs That Adobe Trusts

Here is how to digitally sign a PDF so Adobe Acrobat and Acrobat Reader show it as valid: get a document signing certificate from a certificate authority (CA) on the Adobe Approved Trust List (AATL), keep its private key on the hardware it ships with, and sign with Acrobat’s certificate tool. Your recipients then see a trusted signature without importing anything.

A digital signature is a cryptographic seal. It binds your verified identity to the file and shows whether anyone changed the PDF after you signed it. A typed name or a drawn scribble cannot do that. If you are not sure which kind your document needs, read our comparison of digital vs electronic signatures first.

Key fact	What it means for you
Certificate type	Document signing certificate from an AATL-listed CA
CA behind our plans	DigiCert
Identity checks	Individual or organization validation
Key storage	Hardware token or hardware security module (HSM), per product
Signature volume	500, 2,000 or 5,000 signatures per year, depending on plan
Software	Adobe Acrobat to sign; any current Acrobat or Acrobat Reader to validate

What makes a PDF signature trusted in Adobe?

Adobe trusts a PDF signature when the signer’s certificate chains up to a root on the Adobe Approved Trust List and the file has not changed since signing. Acrobat then shows a green check with the message “Signed and all signatures are valid.”

The AATL is Adobe’s program for CAs whose root certificates Acrobat and Reader trust automatically. Acrobat trusts every signing certificate that chains up to one of its trust anchors (root certificates it already holds). As of October 2026, DigiCert appears on Adobe’s AATL member list, so a DigiCert document signing certificate validates on your recipients’ machines out of the box.

A self-signed certificate is different. Acrobat cannot find it in its list of trusted identities, so it shows “At least one signature has problems.” The math may be correct, but nobody can confirm who signed.

What the recipient sees	What it means
Green check, “Signed and all signatures are valid”	Certificate chains to a trusted root and the file is unchanged
Blue ribbon in the Signatures panel	A valid certifying signature (the author certified the document)
“At least one signature has problems”	Acrobat cannot trust the signer’s certificate, for example a self-signed one
Signature shown as invalid	The file changed after signing or the signature is damaged

Approval signatures and certifying signatures

An approval signature says “I signed this.” A certifying signature is applied by the document’s author and controls which later changes, such as form filling, are still allowed. Most users need approval signatures; contract templates and official forms often use a certifying signature first.

Individual or organization document signing – which do I need?

Choose individual document signing when the signature should prove who you are as a person. Choose organization document signing when the signature should also prove that the signer acts for a verified company.

With an individual certificate, DigiCert validates the signer’s identity, and the signature names that person. With an organization certificate, DigiCert also validates the organization, so recipients can see that the document comes from your company. Freelancers, consultants and professionals who sign in their own name usually pick individual. Companies that send contracts, invoices, reports or certified forms usually pick organization.

Good fit for individual	Good fit for organization
You sign in your own name	You sign on behalf of a company
Signer identity is what counts	Company identity must be visible and verified
Lower yearly volume (500 or 2,000 signatures)	Higher yearly volume (2,000 or 5,000 signatures)
Freelancers, consultants, independent professionals	Sales, finance, HR and legal teams

What do the 500, 2,000 and 5,000 tiers mean?

The number in each plan name is the signature volume per year: how many documents you can sign with the certificate in a year. Per DigiCert’s product data, Individual plans come with 500 or 2,000 signatures and Organization plans with 2,000 or 5,000.

Count how many documents you sign in a typical month, multiply by twelve and add a buffer for busy periods. If you expect to come close to the limit, contact our support team before you order, so we can check the right tier with you.

Do I need special hardware to sign PDFs?

Yes. The private key of a document signing certificate lives on certified hardware, not in a file on your laptop. For the DigiCert plans we sell, that means a hardware token or your own HSM.

DigiCert’s documentation lists three ways to receive the key, as of October 2026: a DigiCert-supplied hardware token, your own FIPS 140-2 Level 2 token (FIPS 140-2 is the US government standard for cryptographic hardware), or your own FIPS 140-2 Level 2 HSM. A hardware security module (HSM) is a network appliance that stores keys and signs on request, which suits teams that sign many documents from a server. A USB token suits one person signing at one computer.

• Hardware token: plug it in, enter the PIN, sign. Simple for one signer.
• Your own HSM: central key storage for automated or high-volume signing.
• Cloud signing: availability depends on the product; confirm with us before you order.

Tip: Add a trusted timestamp when you sign. In Acrobat, set a time stamp server under Preferences → Signatures → Document Timestamping. The timestamp proves when you signed, which helps the signature stay valid after your certificate expires.

Common PDF signing problems and fixes

Most signing problems come from the token setup, from edits made after signing or from a missing timestamp. The table lists what you are likely to see and what to do.

What you see	Likely cause	Fix
Acrobat does not offer your digital ID	Token not plugged in or driver missing	Reconnect the token, reinstall the driver, restart Acrobat
“At least one signature has problems”	Certificate not from an AATL-listed CA, or revocation status could not be checked	Sign with an AATL certificate; let the recipient go online and revalidate
Signature marked invalid	The PDF changed after signing	Make all edits first, then sign as the last step
Signature questioned after the certificate expires	No trusted timestamp in the signature	Configure a time stamp server before signing

For files you need to keep for years, also look at long-term validation (LTV) in Acrobat. LTV embeds the certificate status information in the PDF, so the signature can still be checked when the original revocation services are no longer reachable.

Signing email instead of PDFs?

Document signing certificates are built for files, not for messages. To sign and encrypt email, you need S/MIME email certificates, and our guide to S/MIME email signing walks through Outlook, Apple Mail and Gmail.