To get a digital signature, you obtain a digital certificate from a trusted certificate authority, prove your identity to that authority, install the certificate on your computer or a secure token, and then use signing software such as Adobe Acrobat to apply the signature to a document. The process can take anywhere from a few minutes to several business days, depending on how thoroughly the authority needs to verify you. Costs typically run a few hundred dollars a year, and the certificate has to be renewed before it expires.
Before spending money on one, make sure you actually need a certificate-based signature. Federal law defines an electronic signature broadly as any electronic sound, symbol, or process attached to a record and adopted with intent to sign.1Office of the Law Revision Counsel. 15 U.S. Code 7006 – Definitions Typing your name at the end of an email, clicking “I agree,” or drawing your signature in DocuSign all qualify. A digital signature is the stricter subset: it uses Public Key Infrastructure, where a certificate authority issues a certificate binding your verified identity to a pair of cryptographic keys. If anyone alters the document after you sign, the math breaks and the signature shows as invalid. For a lease or a job offer, a basic electronic signature is usually enough. For regulated industries, government contracting, or high-value transactions where you need the strongest proof of integrity, the steps below are the route to take.
Choose a Certificate Authority
Certificate authorities are the organizations trusted to verify identities and issue digital certificates. Widely used providers include IdenTrust, DigiCert, GlobalSign, and Sectigo. If you plan to sign PDFs that recipients will open in Adobe Acrobat, pick a provider on the Adobe Approved Trust List so your signature displays as valid without extra steps on the recipient’s end. For U.S. government work, the Federal PKI framework governs which authorities are acceptable.
Decide Between an Individual or Role-Based Certificate
Most people should get an individual certificate tied to their personal identity. If you sign on behalf of an organization and the authority may transfer between people, a role-based certificate can be more practical. A role-based certificate carries the title of the authorizing role, such as “Chief Financial Officer,” rather than the individual’s name, and whoever holds the private key can sign for that role.2IDManagement.gov. Delegated Digital Signature Playbook Role-based certificates are limited to document signing; they cannot be used to log into systems or for other authentication purposes.
Verify Your Identity
Every certificate authority will require proof of who you are before issuing a certificate. Expect to provide, at minimum, a government-issued photo ID such as a passport or driver’s license. If the certificate will be tied to a business, you will also need documentation of the organization’s legal name and status, such as articles of incorporation or a business license. Some providers require a notarized application form.
How deep the verification goes depends on the assurance level. The National Institute of Standards and Technology defines identity assurance levels that many authorities follow.3NIST. Identity Assurance Level Requirements At the lower end, a confirmation code sent to a validated address may be enough. At higher levels, you may need to appear in person or complete a live video session where a representative examines your documents in real time. Build in extra time if you are targeting a higher assurance level; scheduling the in-person or video step is usually what stretches the timeline from minutes to days.
Pay for and Receive Your Certificate
Individual document-signing certificates typically cost between $200 and $800 or more per year, depending on the provider, validation level, and subscription length. Multi-year subscriptions often carry a discount. Certificates come with a fixed validity period, usually one to three years, so budget for renewal as a recurring expense.
After verification and payment, the authority will guide you through generating a key pair and installing the certificate. The private key stays with you, either on your computer or on a hardware token such as a USB device, and is protected by a password or PIN you set during issuance. Keep both safe. Losing the key means losing the ability to sign; exposing it means anyone who has it can sign as you until the certificate is revoked.
Apply Your Signature to a Document
Once the certificate is installed, the signing process itself is straightforward. The steps below use Adobe Acrobat, the most common tool for signed PDFs, but the flow is similar in other signing software.
- Open the document in your signing application. In Acrobat, go to All Tools and select Use a Certificate.
- Choose Digitally Sign.
- Draw a rectangle on the page where the visible signature block should appear.
- Select the digital ID issued by your certificate authority from the list the software displays.
- Enter the password or PIN you set up when the certificate was issued.
- Optionally check the box to lock the document against further changes, then save the file.4Adobe. Add Digital Signatures
After signing, the software displays a confirmation panel with the signature’s validity status. Recipients who open the file in compatible software will see a visual indicator, often a blue ribbon or check mark, showing the signature is intact and the document has not been modified since signing.
Documents You Cannot Sign This Way
Even the strongest digital signature will not work for every document. The ESIGN Act carves out categories that still require a traditional wet-ink signature, including wills, codicils, and testamentary trusts; adoption, divorce, and other family law matters; court orders, notices, briefs, pleadings, and other filings required in connection with court proceedings; certain consumer notices such as cancellation of utility services, default or foreclosure on a primary residence, cancellation of health or life insurance benefits, and product recalls that pose health or safety risks; documents accompanying transportation or handling of hazardous materials, pesticides, or other dangerous substances; and most Uniform Commercial Code transactions other than Articles 2 and 2A.5Office of the Law Revision Counsel. 15 USC 7003 – Specific Exceptions State law may add further restrictions, such as requiring notarized wet-ink signatures for real property deeds, certain powers of attorney, or specific healthcare directives. Check the rules for your document type before assuming a digital signature will hold up.
Keep Your Signature Valid Over Time
A digital signature is only as reliable as the certificate behind it, and certificates do not last forever.
Renew Before Expiration
Most authorities let you start renewal up to 90 days before the certificate expires. Renewal typically requires generating a new key pair and submitting a fresh request, though identity verification may be abbreviated if nothing has changed. Do not wait until the last day. An expired certificate makes any new signatures invalid, and recipients may question documents signed near the end of the validity window.
Revoke a Compromised Key
If you suspect your private key has been exposed, through a lost USB token, a compromised computer, or any other breach, contact your certificate authority immediately to revoke the certificate. Revocation adds it to a public list that verification software checks, so anyone opening a document signed with that certificate after revocation will see a warning. After revocation, generate a new key pair and request a new certificate. Never reuse a compromised key.
Add a Trusted Timestamp and Long-Term Validation
Your certificate will eventually expire, and someone verifying an older document may question whether the signature was valid at the moment you applied it. A trusted timestamp records the exact time the signature was made using a separate Time Stamp Authority, whose own certificate signs the timestamp and provides independent proof the signature existed before yours expired or was revoked.6IETF Datatracker. RFC 3161 – Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)
Long-Term Validation goes further, embedding the timestamp, certificate status responses, and the full certificate chain directly into the signed document. A document with LTV information can have its signature verified years after the original certificate expires, as long as the root certificate in the chain is still trusted. Most professional signing software offers a Long-Term Validation option at the moment of signing. If the document might need to hold up for years or decades, turn it on.