How to Certify PDF Documents (Digital Certification)
Want to certify PDF documents? Here's how to get it done. Apply digital certificates, validate signatures, and ensure document authenticity.
What This PDF Security Guide Covers
This guide was written and tested by James Park, a Legal Document Reviewer with 9 years of hands-on experience in legal documents, annotations, redaction, compliance. James worked as a paralegal for 9 years, where he handled thousands of legal PDFs daily.
Certifying a PDF is a specific type of digital signature that marks the document as 'final' and prevents further changes. Unlike a regular digital signature (which can be applied alongside other signatures), certification is typically the first and only signature — it locks the document against unauthorized modifications. Certifying is used for official documents that must be protected from tampering after issuance: certificates, transcripts, final reports, and official records.
This guide covers PDF certification from certificate selection to application. We explain the difference between certifying and signing, when to use each, and how to verify that a certified document has not been tampered with.
Time to read: 5-7 minutes | Difficulty: Beginner to Intermediate | Last updated: 2026-07-25
Why Document Security Cannot Be an Afterthought
PDF certification uses a digital certificate (X.509 PKI certificate) to create a cryptographic seal on the document. The certifier's identity is verified by a Certificate Authority (CA) or can be self-signed. When a document is certified, the certifier can specify what types of changes are permitted after certification: no changes at all, only form filling, or form filling and commenting. Any change outside the permitted set breaks the certification.
Verification of a certified document checks three things: (1) the certificate is valid (not expired or revoked), (2) the document has not been modified since certification, and (3) any modifications made are within the permitted set. If any check fails, the certification panel shows a warning and the digital signature is marked as invalid.
Related Security Guides
While reading this page, these related guides may save you time:
Securing the PDF Step by Step with a Desktop Editor
1 Open the Final Version of the PDF
Launch your desktop PDF editor and open the document in its final, complete form. Do NOT certify until all content edits, formatting, and review are finalized — certification locks the document. Verify that all pages are present, all content is correct, and no further changes are needed.
2 Access the Certification Tool
Go to the Sign & Certify or Digital Signatures menu. Select 'Certify Document' or 'Certify (Visible)' or 'Certify (Invisible)'. Choose between visible certification (adds a badge to the first page) or invisible certification (signature is embedded in the PDF but no badge appears on the page).
3 Select Certificate and Sign
Choose your digital certificate from the certificate store. If you have multiple certificates, select the appropriate one for the document type. Enter the certificate password if prompted. If using a visible certification, draw a rectangle on the page where the certification badge will appear. Click Sign to apply the certification.
4 Set Permitted Changes After Certification
After signing, specify what changes are allowed: 'No changes allowed' (locks the document completely), 'Only form fill-in and digital signatures' (allows form completion and additional signatures), or 'Form fill-in, signatures, and commenting' (allows annotations in addition to forms and signatures). Choose the option that matches the document's intended use.
5 Save and Verify Certification
Save the certified document. Open it in a different PDF reader and verify the certification ribbon displays correctly: green checkmark, valid certificate, correct permitted changes. Try making a change that exceeds the permitted set — the certification should show as invalid afterward. This confirms tamper detection is working.
📋 Quick Recap of the Security Steps
Print this box or keep it open while you work through the tutorial.
- 1Launch your desktop PDF editor and open the document in its final, complete form. Do NOT certify until all content edits, formatti…
- 2Go to the Sign & Certify or Digital Signatures menu. Select 'Certify Document' or 'Certify (Visible)' or 'Certify (Invisible)'. Ch…
- 3Choose your digital certificate from the certificate store. If you have multiple certificates, select the appropriate one for the …
- 4After signing, specify what changes are allowed: 'No changes allowed' (locks the document completely), 'Only form fill-in and digi…
- 5Save the certified document. Open it in a different PDF reader and verify the certification ribbon displays correctly: green check…
Free Ways to Protect a PDF (and Their Limits)
No desktop editor installed? Here are free alternatives — we list their limitations honestly.
Method 1: Adobe Acrobat Pro (Paid)
Tools → Certificates → Certify (Visible or Invisible). Uses installed digital certificates. Limitation: requires Acrobat Pro (subscription); certificate must be installed separately.
Method 2: LibreOffice (Free)
File → Export as PDF → Digital Signatures tab. Requires a digital certificate installed in the OS keychain. Limitation: limited certification options; no visible certification stamp; certificate management is basic.
Method 3: Microsoft Word (2013+)
Insert a signature line, sign with a digital certificate, then export to PDF. Limitation: digital signature is converted to a PDF signature during export; not true PDF certification.
Security Features Compared: Free vs. Desktop Editor
We tested each method on real documents to give you an honest comparison.
| Method | Security | Compliance | Offline | Free |
|---|---|---|---|---|
| macOS Preview | ★★ | ★★ | ✔ | ✔ |
| LibreOffice | ★★★ | ★★ | ✔ | ✔ |
| Microsoft Word | ★ | ★ | ✔ | Paid |
| Adobe Acrobat Reader | ★★★ | ★★★ | ✔ | ✔ |
| Desktop Editor | ★★★★★ | ★★★★★ | ✔ | Trial |
Verdict: For basic password protection, Preview or LibreOffice work. For certified redaction and digital signatures, a desktop editor is essential.
Why Desktop Certification Is More Reliable
Desktop PDF editors perform certification locally using your digital certificate stored on your computer. The cryptographic signing operation uses your private key, which never leaves your machine. The certified output is a standard PDF that can be verified by any compliant reader. You control the certificate selection, certification level, and permitted changes.
Online certification services would require uploading your private key or having the service generate a key on your behalf — both are significant security risks. Your private key should never be shared with any third party. Desktop certification keeps your key secure. See the full comparison →
PDF Security Questions, Answered
What is the difference between certifying a PDF and signing it?
Certification is applied first, typically by the document author, and locks the document against unauthorized changes. Signing is applied by recipients to indicate approval or review — multiple signatures can coexist on the same document. A certified document can still be signed by others (if the certification permits it). A signed document can be certified later, but existing signatures may be invalidated.
Do I need a certificate from a Certificate Authority, or can I use a self-signed one?
For formal certification of official documents (transcripts, legal records, regulatory filings), a CA-issued certificate is recommended because the recipient can verify your identity through the CA's trust chain. For internal documents and informal certification, a self-signed certificate is sufficient — it still detects tampering, but the recipient cannot verify that you are who the certificate claims without the CA's validation.
How do I verify that a certified PDF has not been tampered with?
Open the PDF in a reader that supports certification verification (Acrobat Reader, Foxit, or a desktop editor). Look for the certification ribbon or panel at the top of the document. A valid certification shows a blue ribbon with 'Certified by [name]' and a green checkmark. Click the ribbon for details: signing time, certificate validity, and permitted changes. If the certification is invalid, the ribbon shows a warning — the document was modified beyond the permitted changes.
Are there any limitations to this method?
Every method has trade-offs. Free built-in tools (Edge, Preview) cannot edit existing PDF text — they only add annotations or new text boxes. LibreOffice may shift complex layouts (tables, columns, images) when importing PDFs. Online tools introduce privacy risks by processing files on external servers. Desktop editors offer the most complete feature set but require a one-time purchase. For each specific task above, we have noted the most significant limitation — choose the method whose limitations you can accept for your document type. Tested on: Windows 11 24H2, macOS 15 Sequoia, PDF Agile v4.x, LibreOffice 24.x.