In short
A document signing certificate is a digital certificate, issued by a certificate authority after it verifies your identity, that you use to apply cryptographic signatures to PDF and Office documents. Each signature proves two things: who signed, and that the file hasn't changed since. If the certificate comes from a CA on the Adobe Approved Trust List (AATL), Acrobat and Reader treat the signature as trusted automatically — no setup on the recipient's side.
If you're reading this because you already need one: the document signing certificate My-SSL sells is Certum's AATL-compliant certificate, stored on a virtual card instead of a USB token, at $89 per year. The rest of this article explains what each of those terms means, so you can judge whether they match your situation.
"Signed" means very different things depending on how a document was signed. A typed name at the bottom of a PDF asserts almost nothing; a certificate-based digital signature turns the file into its own evidence. This guide walks through the difference: what a document signing certificate contains, what happens cryptographically when you sign, why Adobe's trust list decides whether recipients see a trusted signature or a warning, and how European and US law weigh each kind of signature. By the end you should know whether you need a certificate, an e-signature platform, or both.
Is a document signing certificate the same as an e-signature?
No — and the distinction is the key to this whole topic. An electronic signature is a legal concept: any electronic mark that shows agreement, from a typed name to a drawn squiggle to an "I accept" checkbox. A digital signature is a cryptographic mechanism, and a document signing certificate is what powers it: a CA-verified identity whose private key seals the document. Most e-signatures involve no certificate at all.
That difference shows up the moment a signature is questioned. A typed name or pasted signature image proves nothing by itself — anyone can type your name. E-signature platforms compensate with audit trails: records of who clicked what, from which IP address, stored on the platform's servers. That evidence is real, but it lives outside the document and depends on the platform keeping it.
A certificate-based signature embeds the proof in the file itself. The signed PDF carries the signature, your certificate, and — with a timestamp — proof of when it was signed. Anyone can verify it in a PDF reader, offline, years later, without contacting you or any platform. When people say "digital signature" in the strict sense, this is what they mean, and it's the foundation the rest of this article builds on.
How does a digital signature work on a PDF?
When you sign a PDF, your software computes a hash of the document, your private key signs that hash, and the result is embedded in the file along with your certificate. A reader that opens the file recomputes the hash, checks it against the signed one, and validates the certificate chain. Any edit after signing changes the hash and breaks the signature visibly.
Two details make this stronger than it first sounds. First, the private key never sits in a file on your laptop: AATL rules require it to live on certified hardware that blocks export and duplication — a USB token, smart card, or a hardware security module operated by the CA. Stealing the key would mean stealing the physical device or breaking into the CA's HSM, not copying a file.
Second, PDF signatures follow a standard — PAdES (ETSI EN 319 142) — with levels designed for the long haul. A baseline signature can be extended with a trusted timestamp proving when it was made, and with embedded validation data (the certificate chain and revocation status at signing time), called long-term validation or LTV. That's how a contract signed today can still be verified in ten years, after your certificate has long expired — the same reason timestamps matter in code signing.
What is Adobe AATL and why does it matter?
The Adobe Approved Trust List is Adobe's own root program: a list of certificate authorities whose document signing certificates Acrobat and Reader trust out of the box. Sign with an AATL certificate and every recipient sees a valid, trusted signature immediately. Sign with anything else and the reader reports that the signer's identity can't be verified — even when the cryptography is flawless.
It works exactly like the root stores browsers use for HTTPS, just scoped to documents: Adobe vets the certificate authorities, and membership carries obligations. AATL CAs must verify the identity of every certificate holder — face to face or by an equivalent remote process — and must keep private keys on certified hardware that prevents export. That second rule is why no reputable CA will ever email you a document signing certificate as a downloadable key file.
One scope note: AATL governs Adobe products. Microsoft Office validates signatures against the Windows certificate store instead, which has its own root program. The major commercial document signing CAs — Certum, DigiCert, GlobalSign, and others — participate in both, so in practice one certificate validates cleanly in Acrobat and in Word. But if your recipients live in Adobe Reader, AATL membership is the specific thing to check before buying.
SES, AdES, QES: what do the legal signature levels mean?
The EU's eIDAS regulation defines three levels of electronic signature: simple (SES), advanced (AdES), and qualified (QES). A certificate-based PDF signature is what gets you to the advanced level — uniquely linked to an identified signer and able to reveal any later change. Qualified signatures go further, and they're the only kind automatically treated as equal to a handwritten signature across the EU.
The qualified level adds two requirements on top of advanced: the certificate must be a qualified certificate from a qualified trust service provider (QTSP) supervised by an EU member state, and the signature must be created on a qualified signature creation device. As of July 2026, this space is moving: under eIDAS 2.0, member states are rolling out the EU Digital Identity Wallet, due to be offered to citizens by the end of 2026, which is designed to make qualified signing available from a phone.
The US takes a different approach: the ESIGN Act (2000) and UETA make electronic signatures legally effective without prescribing any technology, so there's no American equivalent of the QES tier. In practice that makes certificate-based signatures a matter of evidence rather than eligibility in the US — a court asks "can you prove who signed and that nothing changed?", and a digital signature is a strong answer.
What can you sign with one certificate?
One document signing certificate covers the common business formats: PDF, Microsoft Word, Excel, and PowerPoint, plus LibreOffice documents. The mechanics differ slightly — PDF signatures follow the PAdES standard, Office files use Microsoft's XML signature format — but both embed your certificate in the file and both flag the signature if the document changes after signing.
The typical uses are the documents where "who signed this, really?" has consequences: contracts and NDAs, invoices, HR paperwork, board resolutions, compliance filings, engineering and architectural submissions, medical and legal correspondence. Organizations also use these certificates for automated signing — an accounting system that seals every outgoing invoice, for instance, so customers can verify none were altered or forged in transit.
A signature can be visible — a signature block on the page showing the signer's name and time — or invisible, living only in the document's metadata. Both carry identical cryptographic weight; the visible block is a communication choice. Certificates are issued to individuals (your name), to individuals within an organization (your name plus the company's), or to the organization itself for departmental seals.
Do you need a certificate, or is an e-signature platform enough?
Use an e-signature platform when your problem is workflow — routing a contract to five signers with reminders and a shared audit trail. Get your own certificate when your problem is proof — a signature anyone can verify inside the file itself, with no account required and no dependence on a platform staying in business. Many organizations end up with both, used for different documents.
Some signs a certificate is the right tool: you mostly sign documents you produce (invoices, reports, filings) rather than collecting signatures from others; your recipients open PDFs in Acrobat and need them to show as trusted without any setup; a regulator, tender process, or foreign counterparty expects certificate-based signatures; or you want to keep long-term verifiability independent of any vendor's servers.
And the honest counterpoint: if your only need is occasionally countersigning agreements that arrive through a platform, the platform's built-in flow is fine. A certificate earns its keep once your own documents need to carry their proof with them.
How do you get a document signing certificate?
You buy one from a certificate authority, prove your identity — and your organization's, for company certificates — and receive the certificate on a secure medium: a USB token, a smart card, or a virtual card whose key stays in the CA's certified HSM. Plan for the identity check to take anywhere from an hour to a few days, depending on how quickly you can complete verification.
1. Pick the certificate type
Individual certificates carry your name; organizational ones add your company's verified identity, which is what most business documents call for. If recipients use Adobe products, confirm the CA is an AATL member before anything else.
2. Complete identity verification
AATL rules require identity proofing face to face or by an equivalent remote method — typically an ID document check combined with automated face matching, done from your desk. Organization certificates add a check of company registration records, similar to OV validation for SSL.
3. Choose where the key lives, then sign
A physical token means waiting for shipping and carrying the device; a virtual card means the key sits in the CA's certified hardware and you activate remotely. The Certum document signing certificate My-SSL carries uses the virtual-card option — nothing ships, and the certificate runs one to three years depending on the term you pick. Once activated, you sign directly in Acrobat, Word, or the CA's signing app.
If a vendor offers a downloadable .pfx file, walk away
Trusted document signing keys must live on certified hardware that blocks export — that's an AATL program rule, not a product feature. A "document signing certificate" delivered as a plain key file either isn't AATL-trusted or isn't being issued honestly, and signatures made with it will greet your recipients with a warning instead of a checkmark.
The bottom line
A document signing certificate turns "this looks signed" into "this is provably signed and unchanged" — identity verified by a CA, integrity checked by every PDF reader, trust automatic when the CA is on Adobe's AATL. If that's the missing piece in how your contracts, invoices, or filings go out, My-SSL carries the Certum document signing certificate at $89 per year, on a virtual card with no hardware to ship, and with a 30-day money-back guarantee if it turns out not to fit.