diff --git a/docs/Functionality/Security/Certificate-Signing.md b/docs/Functionality/Security/Certificate-Signing.md index 6cfe8763..7e7f1864 100644 --- a/docs/Functionality/Security/Certificate-Signing.md +++ b/docs/Functionality/Security/Certificate-Signing.md @@ -80,7 +80,7 @@ Digitally sign PDFs with X.509 certificates and validate existing signatures aga Once configured, users can choose **Server** in the **Certificate source** step to sign with the shared certificate. - Sign with a certificate held on your own machine - a USB token or smart card (PKCS#11), or the Windows certificate store. The private key never leaves the device: Stirling PDF asks the token or operating system to perform the signing. This option appears only in the **desktop app** and works on every edition. + Sign with a certificate held on your own machine - a USB token or smart card (PKCS#11), or the Windows certificate store. The private key never leaves the device: Stirling PDF asks the token or operating system to perform the signing. This option appears only in the **desktop app** and works on every edition. It is also independent of what the desktop is connected to: whether you are working offline, signed in to Stirling Cloud, or pointed at your own self-hosted server, the certificate is read and used on your own machine. Only the signed PDF continues through the rest of your workflow. 1. Go to **Certificate Sign** tool 2. Upload PDF @@ -107,10 +107,63 @@ Digitally sign PDFs with X.509 certificates and validate existing signatures aga ### Signature Appearance -**Visible:** Appears as a box on a chosen page showing the signer name, signing date, and reason, with an optional logo. +**Visible:** Appears as a box on the page, showing details from your certificate and an optional logo. **Invisible:** Embedded in PDF metadata only, not visible on the page. +#### Placing the Signature + +By default the box goes where it always has, on the page you choose. To put it somewhere specific — a printed signature line on a form, for instance — select **Draw the box on the document** and either drag a rectangle across the page or click one corner and then the opposite one. + +The page you draw on becomes the page that gets signed, so the page number updates to match. Press `Esc` to leave placement mode without placing anything. + +Text inside the box scales to fit whatever size you draw, so it never spills over the surrounding content. + +#### Choosing What the Box Shows + +Certificates carry more than a name. Tick the fields you want printed inside the box: + +| | | +|--------|--------| +| Signer name | Organisation | +| Organisational unit | Country | +| Email | Issued by | +| Issuer organisation | Serial number | +| Valid from | Valid until | +| Signature algorithm | Signing date | +| Reason | Location | + +Fields your certificate doesn't carry are skipped rather than drawn blank, so you can tick a field without checking your keystore first. Ticking nothing shows the signer name, signing date and reason, as before. + +#### Using Your Own Logo + +The box can carry your organisation's logo instead of the built-in Stirling PDF mark. Upload a **PNG or JPEG** and choose where it sits: + +| Position | Result | +|--------|--------| +| Left of the text | Logo in a column down the left, details beside it | +| Right of the text | The same, mirrored | +| Above the text | Logo in a band across the top, details underneath | +| Below the text | Logo in a band across the bottom | +| Behind the text (watermark) | Logo fills the box, faded, with the details drawn on top | + +Leave the upload empty and the built-in mark is used, as before. + +The image always keeps its proportions, so a logo is never stretched to fill its strip. The details keep a usable share of the box whatever shape the logo is, so a wide banner cannot squeeze out the signer's name. **Behind the text** is the one position where the two overlap: the logo is drawn faded underneath so the details stay readable. + +When **Repeat it on every page** is also on, the marks on the other pages carry the same logo, so they match the real signature. +#### Repeating It on Every Page + +Long documents are often initialled on every page so a reader can see the whole thing was signed. **Repeat it on every page** does that. + +:::caution Only one page is really signed +A PDF signature lives in a single place, so only the page you drew on carries the actual signature. The other pages get a mark that looks the same but is not a signature and will not be reported by a validator. + +Each mark links to the signed page, so a reader can click it to reach the signature and check its properties. +::: + +This option needs a box to have been drawn first, since there has to be a shape to repeat. + --- ## Validating Signatures