Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

10
  • 1
    This question would be improved by some example links to the packages involved. I suspect the Answer may be that they're selling an HSM which will protect their signing subkey even though the signing ability is transferred to your posession. It prevents you, or an attacker, from extracting their signing key (the "file") and redistributing it in any way. Commented Apr 9, 2019 at 10:13
  • I've added an example for GlobalSign. The key will be secure on our systems, the hardware solution will directly interfere with software. Commented Apr 9, 2019 at 11:07
  • 2
    Possible duplicate of valid PDF signature without using hardware HSM or usb Token. In short - this is a legal requirement for the kind of certificates you want to use. It is different for example with certificates for HTTPS server where you actually get the files. Also duplicate to Need raw certificate/key to sign PDFs via Java app. But vendors seem to only sell HSMs for this. What to do? Commented Apr 9, 2019 at 11:12
  • 2
    You can just buy a certificate intended for https or S/MIME and sign any file. It technically works. It will just not be accepted by entities which require you to have a document signing certificate. Commented Apr 9, 2019 at 11:23
  • 3
    @Seb: While you claim that it is not related to Adobe but you don't even say what you need the certificate for. Like I said in my comment - you can actually get certificates as files for use in a HTTPS server. But this does not seem to be what you want. It would be more useful if you would describe the actual use case what you need the certificates for instead of complaining that the suggested duplicates have nothing to do with what you want (but don't explain). Commented Apr 9, 2019 at 13:25