I have already acquired a S/MIME certificate (a .p12 file) issued by an authority. Using it in Writer, I can digitally sign documents by following this procedure : How do I make a digital certificate available to LibreOffice Writer for digital signatures?
Can I do the same for PDF files? If yes, what method do you suggest me? I would prefer a solution that relies on Free Software.
Your only option is Portable Signer. Download it and run the jar. It requires a private key in a p12 file though (not compatible with SmartCard).
You might expect Ubuntu document signing tools like qdigidoc or gpg would do, but no, they don't play with PDF signatures.
You might then expect Ubuntu PDF manipulation tools like qpdf, which provides encryption, or pdftk, which provides watermarking, to provide signing features too, but, no, they don't.
The total list of opensource tools available for your purpose is: http://wiki.cacert.org/PdfSigning
Unfortunately, none of the tools is currently maintained and none can be found in Ubuntu packages. Portable Signer is the most well maintained of all.
Good news! KDE's PDF viewer Okular (with backend Poppler) now supports embedded digital signatures in PDFs, similar to how Adobe Reader does it. Details are found in a post by TU Dresden, who has sponsored the implementation of this feature.
The feature is expected to appear in releases from April 2021 (Okular v21.04, Poppler v21.01). As of December 2020, it is already possible to compile the current development version of Okular and the Poppler PDF library locally to obtain the feature. Instructions and a build script are provided with the TU Dresden post.
I have completed the installation using the instructions in the script (watch out for truncated lines in the online-preview!) on KDE Neon 5.20 (based on Ubuntu 20.04 LTS) using Poppler as of Commit 407293bf and Okular as of Commit 110ccd61 (future versions should of course continue to work, so this is just for full reproducibility). I have installed under /usr/local/ and created a start script okular-sign with the variable definitions as in the TU Dresden manual. The new version of Okular identifies as "Version 21.03.70". As typical for KDE, this "local" version of Okular does interfere with the official one from the distribution, which is partly changed to the new version even when starting the old binary (presumably this is due to KDE's system-wide registration of "parts" or some such component). I hope that it will be possible to revert to an official version when signing support is released in my distribution's packages.
After successful installation, I could create a digital signature as advertised in the post:
One is prompted to save the signed PDF under a new file name after that.
If you have the certificate available in Writer and if using its Export to PDF function, you can also digitally sign the resulting PDF from the last tab of the dialog right before the export.
As far as I can tell, Acrobat Reader for Android says the document is protected, for what it's worth.
Update '17: Since last December you can sign PDF files with LibreOffice by going File → Digital signatures → Sign Existing PDF.
That will open Draw which is capable of signing the PDF.
I found that you can use gpg to sign a PDF in a way that it still opens up in a viewer.
gpg --clearsign --output=signed.pdf input.pdf
Above would yield .asc file which is basically concatenation of input||signature but file extension is forced into .pdf making it to open in viewer, produce thumbnails, etc.
You can verify signature using gpg again.
$ gpg --verify signed.pdf
gpg: Podpisano nie, 12 kwi 2015, 19:07:15 CEST z użyciem RSA kluczem
gpg: Poprawny podpis od "Arkadiusz Bulski <arek.bulski@gmail.com>"
Be warned that some pdfs dont work well with signing this way, such as optimised pdfs. You should check the results yourself.
There is a GPL tool called AutoFirma from Spanish Government which works quite nice with p12 formatted certificates. For now it's only available in Spanish, but source code is available here or on Github and could be translated.
You can sign PDF files with gpg/seahorse.
Learn more: https://help.ubuntu.com/community/GnuPrivacyGuardHowto
You can for instance use OpenSignPDF, that can be download here: http://opensignature.sourceforge.net/english.php
I hope this answers your question.
Master PDF Editor has a free version that will sign .p12 files.
However the free version leaves an ugly watermark. Interestingly enough, this can be removed within the program itself or with another PDF editor (ex. LibreOffice Draw). I think version 4 does not leave a watermark.
I ended up doing following
Not the native solution but it gets the work done.
Using LibreOffice with version bigger than 5.3 you can sign PDF documents.
Go To File > Digital Signatures > Sign existing PDF...
The original entry dated from December 2016:
https://vmiklos.hu/blog/pdf-sign.html
Since google led me here. These are my steps without p12 formatted certificate. based on how to get p12 formatted client certificate file and how to sign documents .
sudo /usr/local/PortableSigner/PortableSigner.sh
You may also want to take a look at my Simple Signer. In addition to LibreOffice Draw, it can also add a visual stamp onto the document (which is linked to your signature) as known from the Adobe Reader.
In addition to that, you can choose if you want to sign or certify your document.
PDF Studio 7 Pro, available in the Software Center, features digital signing of PDFs. As of when I am writing it costs only 125 $.
According to the official website, it is indeed S/MIME signing.
I met the same problem, and I build a small tool based on Pyhanko. It is here:
It's open-source and single-file. It has English CLI and Chinese-English bilingual QR code result.
You just need to fill your information in stamp.py, then it's OK.
If you want to change the location of stamp, change Line 50 in stamp.py
More information: My Blog
