Batch digital signatures with a PKCS#12 certificate

The signature distinction

Digital signature vs. e-signature — not the same thing

Both terms get thrown around interchangeably, but they describe different mechanisms. An e-signature is any electronic indication of intent to agree — a typed name, a checkbox, an image of a handwritten signature pasted into a document. Most jurisdictions accept e-signatures for most contracts under statutes like the US ESIGN Act, UETA, and EU eIDAS Regulation. They work because the law treats them as equivalent to handwritten signatures, not because the bytes themselves prove anything.

A digital signature is a cryptographic operation backed by a certificate. The signer's private key signs a hash of the document. Anyone with the corresponding public key (embedded in the file, validated against a trusted certificate authority) can verify two things: who signed it, and whether the document has been modified since. Modify a single byte after signing and the verification fails. PDF Batch Editor produces digital signatures — the cryptographic kind — using PKCS#12 certificates from any standard issuer.

Certificate format

PKCS#12 (PFX/P12) and what's actually inside the file

PKCS#12 is the standard container format defined in RFC 7292. It bundles three things in one password-protected file:

1. Private key            The cryptographic secret used to sign documents.
                          Never leaves your machine. Used only to generate
                          the signature, never embedded in the output PDF.

2. Public certificate     The signer's identity, attestation that the public
                          key belongs to a named subject (CN), validity
                          dates, and certificate-authority chain.

3. Intermediate certs     The CA chain from the signer's cert up to a
                          trusted root. Embedded in the signed PDF so
                          verifiers can validate without external lookups.

Both the .pfx and .p12 file extensions identify the same PKCS#12 format. Enterprise IT departments typically issue these from internal CAs; commercial signers buy them from public CAs. PDF Batch Editor accepts password-protected PFX/P12 files; you enter the password once at the start of the batch, and the password is held in memory only for the duration of the run.

Signature appearance

Visible widget, invisible cryptographic seal, or both

Timestamping

RFC 3161 timestamp servers and when you actually need them

Without a timestamp, a verifier can confirm a document was signed by a particular certificate, but the when is whatever the local machine clock said at signing time. That's fine for low-stakes signatures and when the certificate is still valid at verification time. It becomes a problem in two scenarios: when the certificate expires or is revoked between signing and verification, and when regulatory requirements mandate a trusted time source.

A Time-Stamping Authority (TSA) provides a cryptographically signed assertion of when the document was signed, independent of any local clock. The signature is sent to the TSA over HTTPS following the RFC 3161 protocol; the TSA returns a signed timestamp token that is embedded into the PDF signature. A verifier checking the signature later can establish: this was signed at this exact time, even if the original signing certificate has since expired.

Configure the TSA URL once in the signing dialog and every signature in the batch carries the timestamp. Public TSAs are available from various CAs; enterprise environments typically run their own.

Running the batch

One certificate, one configuration, every file

The batch runs sequentially: each file is signed independently with the configured certificate, signature appearance, and (if set) timestamp. Real-time progress shows the current file and step. Files that fail signing — usually because they're already signed by a conflicting signature, encrypted, or otherwise structurally restricted — are logged with the specific error and the rest of the batch continues.

The operation log records every signature event: source file, output path, certificate CN, timestamp (if used), and any errors. This is what makes the run auditable for compliance purposes — not just "we signed a batch", but "these specific 300 files were signed with this specific certificate at this specific time, with these specific reasons recorded."