To sign a document digitally, you install signing software such as Adobe Acrobat or a cloud platform like DocuSign, create or import a digital ID, place your signature on the document, and save the file in a way that preserves the cryptographic seal. Done properly, the whole process takes about 15 minutes the first time and under a minute after that. Here is how to sign digitally in a way that holds up legally and stays verifiable later.
Digital Signature or Electronic Signature
These two terms get used interchangeably but mean different things. An electronic signature is any electronic indication of intent to sign: a checkbox, a typed name, a drawn signature on a touchscreen. It records that you agreed, but it does not independently prove your identity or detect later tampering.
A digital signature is a specific kind of electronic signature built on public key infrastructure (PKI) and a certificate. When you apply one, the software creates a cryptographic seal tied to your verified identity. Change a single character in the document afterward and the seal breaks; the recipient’s software flags it. For routine agreements a basic electronic signature is usually fine. For regulated industries, high-value contracts, or cross-border work, use a certificate-based digital signature.
What You Need Before You Sign
Two things: signing software and a digital identity.
For software, Adobe Acrobat and Microsoft Word both include digital signature tools. Cloud platforms such as DocuSign and Adobe Acrobat Sign run entirely in a browser, which helps when you’re collecting signatures from more than one person.
Certificate Authority ID or Self-Signed ID
Your digital identity can come from a Certificate Authority (CA) such as DigiCert, IdenTrust, or GlobalSign. These organizations verify who you are before issuing a certificate, so recipients can independently confirm your identity through the CA’s trust chain. CA-issued certificates generally require a subscription, and both Google and Apple have been pushing publicly trusted certificate lifecycles toward 90 days or less. Costs vary by provider and validation level.
For internal business documents or personal use, you can create a self-signed digital ID directly in Adobe Acrobat at no cost. It proves the document has not been altered since signing, but recipients will see a notice that the certificate issuer isn’t recognized. That’s the trade-off: a self-signed ID shows integrity but doesn’t independently prove you are who you say you are.
Whichever route you choose, you’ll enter your legal name, email address, and optionally your organization and country. Get the name right. It appears on every document you sign, and a mismatch between your certificate name and your legal name can raise questions during verification.
Creating a Digital ID in Adobe Acrobat
If a CA issued your certificate, the provider will send you a digital file (usually a .pfx or .p12) or a hardware token. Import that file through your software’s security settings and enter the password the provider assigned.
To create a self-signed ID in Adobe Acrobat on Windows, open the Preferences menu, select Signatures, then click More under Identities & Trusted Certificates. Choose Digital IDs, click the add icon, and select the option to create a new digital ID. Enter your identity information, choose 2048-bit RSA as the key algorithm, and set a strong password. On macOS the steps are nearly identical; you start from Acrobat > Preferences instead.1Adobe. Create Self-Signed Digital IDs
Where to Keep the Digital ID
You can save the digital ID as a .pfx or .p12 file on your hard drive. Convenient, but anyone who gets that file and the password can sign as you. For higher security, store the identity on a hardware token, a specialized USB device that keeps the private key physically isolated from the computer. Hardware tokens are standard in government contracting and regulated industries where a forged signature is costly.
Applying Your Signature to a Document
Open the document in your signing software and go to the tools or signatures menu. Select the option to sign or certify. Your cursor becomes a crosshair. Click and drag to draw a rectangle where you want the visible signature to appear.
The software prompts you to pick a digital ID. If you’ve only created one, it appears automatically. Enter the password that protects the ID. This step is what prevents someone with access to your computer from signing as you.
Confirm, and the software applies the cryptographic seal and prompts you to save. Saving creates a new version of the file with the signature locked in. Do not open and re-save the signed document in a different application afterward. That can strip the signature data or trigger a tampering warning when anyone tries to verify it.
Keeping the Signature Verifiable Over Time
Certificates expire, and CAs eventually stop responding to revocation queries for old certificates. Without extra steps, a valid signature can become unverifiable years later because the infrastructure that supported it has moved on.
Long-term validation (LTV) fixes this by embedding everything needed to verify the signature directly into the document at signing time: the timestamp, the certificate chain, and the OCSP or CRL response confirming the certificate’s status. Most professional signing software can turn on LTV automatically. If you’re signing anything that may need to be verified years from now, such as contracts, deeds, or compliance records, enable LTV in your signing settings before you sign.
Storing the Signed File
Store the signed PDF in a system that preserves the digital signature data intact. Do not convert it to an image or print-to-PDF; both destroy the cryptographic seal. Cloud storage, a document management system, or an organized local drive all work, as long as the file format stays intact and backups exist.
Federal law treats a properly stored electronic record as the legal equivalent of a paper original, provided it accurately reflects the information in the original, remains accessible for the applicable retention period, and can be reproduced on demand.2Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity If you’re retaining digitally signed tax documents, keep them in their original signed format for at least as long as the applicable statute of limitations.
Documents You Cannot Sign Digitally
Federal law excludes specific categories from electronic signing. The ESIGN Act’s protections do not apply to:
- Wills and testamentary trusts, which still require the formalities your state prescribes, almost always pen and paper with witnesses.
- Family law matters such as adoption and divorce documents.
- Court orders and official court documents, including pleadings and briefs filed in connection with proceedings.
- Certain consumer notices: cancellation of utility services, foreclosure or eviction notices on a primary residence, termination of health or life insurance benefits, and product recall notices.
- Paperwork that must accompany the transport of hazardous or toxic materials.
Most state adoptions of the Uniform Electronic Transactions Act mirror these exclusions and sometimes add others, such as documents governed by the Uniform Commercial Code.3Office of the Law Revision Counsel. 15 USC 7003 – Specific Exceptions A digital signature on anything in these categories won’t satisfy the legal requirement on its own.
Verifying a Signed Document
When you open a digitally signed PDF in Adobe Acrobat or a similar viewer, a banner at the top indicates whether the signature is valid. Clicking the signature opens a details panel showing the certificate issuer, the signer’s name, and the exact time of signing.4Microsoft. Time Stamping Authenticode Signatures – Win32 Apps
The software checks three things:
- Identity: whether the certificate was issued by a trusted CA, or for self-signed IDs, whether you’ve manually added the signer to your trusted list.
- Integrity: whether the document has been modified since signing. The seal covers the whole document, so any alteration, even an added space, invalidates the signature.
- Revocation status: whether the signer’s certificate was revoked before expiration. The software contacts the CA via the Online Certificate Status Protocol (OCSP) or checks a Certificate Revocation List (CRL).
A yellow triangle usually means the signature is valid but the signer’s identity couldn’t be confirmed through a trusted chain. A red X means the document was altered or the certificate is revoked. These warnings exist because the point of a digital signature is independent verification, so take them seriously.
The Legal Backing in Brief
Two laws make all of this work. The Electronic Signatures in Global and National Commerce Act (ESIGN Act) is the federal statute, and it prevents a contract or record from being thrown out solely because it was signed electronically, as long as the transaction affects interstate or foreign commerce.5Office of the Law Revision Counsel. 15 USC Chapter 96 – Electronic Signatures in Global and National Commerce UETA does the same at the state level, and 49 states have adopted a version of it. One nuance to remember: the ESIGN Act does not force anyone to accept an electronic signature. Both parties must agree to transact electronically. If the counterparty insists on a wet-ink signature, the law doesn’t override that.