To get an X.509 digital certificate for a notary public, apply through a certificate authority that your state’s commissioning office recognizes, complete an identity-proofing check tied to your active notary commission, and then install the issued certificate either as a software file on your computer or on a dedicated hardware token. The certificate is the electronic credential that replaces your ink signature and physical seal when you notarize online, binding your verified identity to the cryptographic keys you use to sign.
Everything downstream of that depends on getting the state-approval step right, so start there before you spend any money.
Start With Your State’s Commissioning Office
Regulation of electronic notarization sits with each state, usually under the secretary of state or an equivalent commissioning authority. Each state sets its own rules for which certificate authorities are approved, what encryption and format standards the certificate must meet, and whether you have to use a specific notarization platform. A certificate that satisfies one state will not necessarily satisfy another, so a notary commissioned in more than one state needs to confirm compliance for each one separately.
You cannot simply buy any X.509 certificate off the shelf and use it for notarial acts. It must come from a provider your state recognizes, and it must meet the technical requirements your state has published. If your state does not maintain an approved list, the certificate still has to comply with the state’s stated standards, and the responsibility for confirming that falls on you.
Many states tie their identity-proofing requirement to Identity Assurance Level 2 as defined by the National Institute of Standards and Technology. At that level, the certificate authority has to collect at least two pieces of strong identity evidence, or one strong plus two fair pieces, and verify the applicant through a process that reaches at minimum a “strong” confidence level.1National Institute of Standards and Technology. NIST Special Publication 800-63A – Digital Identity Guidelines: Enrollment and Identity Proofing In practice that usually means a government photo ID plus a video verification call or a knowledge-based quiz.
Using a certificate that falls short of state standards can get your notarized documents rejected. More serious issues, such as performing electronic notarizations without proper authorization, can lead to commission suspension or revocation, misdemeanor charges, and fines, with some states barring reapplication for five years or more. Check with your commissioning authority before you perform any electronic notarizations.
What You Need Before You Apply
Certificate authorities will ask for your legal name exactly as it appears on your notary commission. A missing middle initial or an abbreviated first name is enough to delay processing or produce a certificate that does not match your official record, which makes it useless for notarization. Pull your name from your commission paperwork rather than typing it from memory.
You also need your commission number and expiration date. The certificate’s validity period is linked to your commission term, so the provider needs both to issue it correctly. Have a current government-issued photo ID ready as well: a U.S. driver’s license, state ID, or passport. Gathering these before you start the application saves you from the most common delays.
The Identity Proofing Step
After you submit an application, the certificate authority verifies your identity before issuing anything. Depending on the provider, that happens through a live video call, a secure photo upload with liveness detection, or an in-person appointment. The scrutiny is deliberate. This is the step that makes the eventual certificate trustworthy to anyone who later verifies a document you signed. If a provider’s check seems perfunctory, that is a warning sign about the provider.
Costs and How Long the Certificate Lasts
Notary digital certificates are typically valid for one year, though some providers offer multi-year options with validity periods of up to three years. Pricing depends on the provider, the length of validity, and whether the certificate is software-based or stored on a hardware token. Expect roughly $60 to $150 for a standard software-based certificate, with hardware-backed options running higher.
These costs are separate from your state’s electronic notary application fee and from any subscription your notarization platform charges. Budget for all three before you commit to a provider.
Hardware Token or Software File
Your state’s rules will tell you whether you can store the certificate as a software file or whether you need a dedicated hardware device. Software-based certificates arrive as a file, usually in PKCS #12 format with a .pfx or .p12 extension, and you store them on your hard drive or import them directly into your signing software. They are cheaper and more convenient, but their security rests entirely on how well you protect the computer and the password that control access.
Hardware tokens are small USB devices built specifically for cryptographic operations. The private key is generated on the device and never leaves it, so even someone who copied every file on your computer still could not sign with your certificate. Some states require hardware storage for exactly this reason. Where it is not required, a hardware token is still the stronger choice if you notarize high-value documents or work somewhere others have physical access to your machine.
Either way, treat the private key the way you would treat your physical seal. Do not share the password or PIN. Do not leave a token plugged in when you walk away. Do not store the certificate file in an unencrypted shared folder. The private key is what makes your signature yours, and anything someone else signs with it will look legitimate.
Installing the Certificate and Signing
Once the certificate authority approves your application, you will receive instructions to download the certificate file or activate your hardware token. For a software-based certificate, you import the .pfx or .p12 file into your signing software. In Adobe Acrobat, that means adding the file to your digital ID preferences so the software knows which certificate to use when you sign. Most remote notarization platforms handle the import during their onboarding and walk you through it.
Signing is simple after installation. Open the document, click the signature field or place one, and the software prompts you for the password or PIN you set during certificate activation. Entering the correct credential unlocks the private key and the software applies the signature. The whole process takes a few seconds.
Renewal, Revocation, and Keeping Your Certificate Valid
Renewal is not automatic. You go through identity re-verification each time, presenting valid government-issued identification just as you did at first issue. Start renewal at least two to three weeks before expiration. If the certificate lapses, you cannot perform electronic notarizations until a new one is active, and any backlog builds up quickly.
The certificate is also tied to a current notary commission. If your commission expires or is not renewed, the digital certificate becomes invalid regardless of its own expiration date. Track both timelines together.
If Your Private Key Is Compromised
If you lose control of the private key, whether the hardware token is stolen, someone copies the certificate file off your computer, or you suspect unauthorized use for any reason, revoke the certificate immediately. Contact your certificate authority and request revocation through their management portal. Once revoked, the certificate is flagged as invalid across verification systems and any new signatures made with it will fail.
Notify your state’s commissioning office as well, because a compromised certificate means someone could potentially forge notarizations under your identity. Document the date you discovered the compromise, the steps you took, and any affected documents you know about. Then apply for a new certificate through the standard process. There will be a gap between revocation and receiving the replacement during which you cannot perform electronic notarizations, which is the practical reason for treating private key security as seriously as you treat your physical seal.