How do I add a real digital signature to a PDF — not just a drawn squiggle?

Drawn mark vs cryptographic signature

Two different things share the word "signature". A drawn or typed signature is a visual mark — ink on the page. A certificate-based digital signature binds the document to an identity: a private key signs a hash of the document bytes, and anyone holding the corresponding certificate can verify the file has not changed since. PDFDepth has both — the Signature pad produces the drawn mark (draw or type, optional date stamp, placed by dragging a box), while Digital Signature does the cryptographic act.

The signing flow

• Import your .p12 or .pfx certificate — it is parsed locally in the browser with its password; the file never leaves the device for the local sign.
• The signer name auto-detects from the certificate’s common name; add a reason, location, and certifying statement, plus custom lines (P.E. license number, job title, project ID).
• Choose the page, position preset or exact coordinates, box size, and border color.
• Apply — a SHA-256 PKCS#7 signed-data object is computed over the document, and the visible block is drawn with signer, issuer, reason, date, and location.

Lock after signing

The "Lock PDF after signing" option makes the signature mean something in the editor itself: the document’s editable annotations clear, the file flags as locked, and the drawing tools refuse input on the signed page set. A remembered-certificate option stores your cert for repeat signing sessions.

The server-side path

Deployments also ship a server signing endpoint: it signs with a configured certificate, writes an audit-trail record — signer ID, timestamp, IP address, and the document’s SHA-256 hash — and stores the signed file with a download link. Use the local path when the certificate is yours on your machine; use the managed path where a controlled signing identity and its audit record are the point.

Honest limits

A certificate signature is only as strong as the certificate behind it — a self-signed .pfx proves integrity and intent, not third-party-trusted identity; recipients verify trust against their own CA store. The visible block and the metadata record who signed and when; revocation checks and long-term validation are the verifier’s side of the job. And a sign-off on a QC stamp or an inspection pin is a review record — the digital signature is the step that cryptographically binds it.