How to self sign a PDF document

Self-signing means generating your own key pair and certificate instead of buying one from a CA. It’s useful during development and testing, and in internal processes where it is feasible to add the certificate to the trust chain on the machines that need to verify it.

Nothing in UniPDF is special about a self-signed certificate. Generate the pair with the standard library and hand the result to the same handler you would use otherwise:

priv, err := rsa.GenerateKey(rand.Reader, 2048)
if err != nil {
	return err
}

template := x509.Certificate{
	SerialNumber: new(big.Int),
	Subject:      pkix.Name{CommonName: "any", Organization: []string{"Test Company"}},
	NotBefore:    time.Now().Add(-time.Hour).UTC(),
	NotAfter:     time.Now().Add(time.Hour * 24 * 365).UTC(),
	KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
}

certData, err := x509.CreateCertificate(rand.Reader, &template, &template, priv.Public(), priv)
if err != nil {
	return err
}

cert, err := x509.ParseCertificate(certData)
if err != nil {
	return err
}

handler, err := sighandler.NewAdobePKCS7Detached(priv, cert)

Passing &template as both the certificate and the parent is what makes it self-signed. KeyUsageDigitalSignature is the part you cannot omit.

What you give up is trust, not validity. The signature is cryptographically sound and UniPDF will validate it, but Adobe Acrobat shows the yellow warning triangle rather than a green check, because the issuer is not on the Approved Trust List. No amount of configuration on the signing side changes that; the certificate has to be installed as trusted on the verifying machine, or you need a certificate from a CA that is already trusted. If a green check in Acrobat is the actual requirement, see signing with an external service.

Self-signed certificates also make poor timestamp anchors, so if you are aiming at PAdES B-T or higher you still need a real TSA.

Visit our user guide of how you can use self-generated keys with UniPDF.