pdfsig(1)

✨ pdfsig ✨

okay bestie, sit down, hydrate, because today we're talking about pdfsig — the manual page 1 tool from the PDF squad, aka the Portable Document Format digital signatures tool. she verifies, she signs, she slays. 💅

---

🫶 SYNOPSIS 🫶

pdfsig [options] [PDF-file] [Output-file]

---

💖 DESCRIPTION 💖

So like, what does pdfsig actually do? She verifies the digital signatures in a PDF document. that's the main character job. 🎀

And she doesn't just say "yep, signed" and dip — she shows you everything:

• the identity of each signer (the commonName field and the full distinguished name of the signer certificate)
• the time and date of the signature
• the hash algorithm used for signing
• the type of the signature as stated in the PDF
• the signed ranges, plus a statement about whether the total document is signed

And plot twist — she can also sign PDF documents. that's the -add-signature or -sign options. iconic. 👑

Where do the trusted certs come from, you ask? pdfsig uses the trusted certificates stored either in the Network Security Services (NSS) Database or in GnuPG's S/MIME system (gpgsm).

She also uses the Online Certificate Status Protocol (OCSP) — like, go read http://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol if you wanna know more — to look up the certificate online and check if it has been revoked. Unless you passed -no-ocsp, in which case she's not doing that, obviously.

---

🦋 Where does she look for the NSS Database?

If the NSS backend is used, the NSS Database is searched for in these locations, in this order:

1. If the -nssdir option is specified, the directory specified by this option. (you said it, she listens 💅)
2. The NSS Certificate database in the default Firefox profile. i.e. $HOME/.mozilla/firefox/*.default*
3. System's NSS Certificate database in /etc/pki/nssdb
4. User's NSS Certificate database in $HOME/.pki/nssdb

🌸 And for the GPG girlies?

If the GPG backend is used, the S/MIME certificate is read from $GNUPGHOME, defaulting to $HOME/.gnupg.

---

🎀 OPTIONS 🎀

• -nssdir [prefix]directory — Specify the database directory containing the certificate and key database files. See certutil(1) -d option for details of the prefix. If you don't specify it, the other search locations described up in DESCRIPTION get used instead.
• -nss-pwd password — Specify the password needed to access the NSS database (if any). like, only if there is one, bestie.
• -nocert — Do not validate the certificate. skipping the vibe check, fr fr.
• -no-ocsp — Do not perform online OCSP certificate revocation check (local Certificate Revocation Lists (CRL) are still used). so the online part is off, but the local CRLs are still doing their thing. 🫶
• -assert-signer fpr_or_file — This option checks whether the signature covering the full document been made with the specified key. The key is either specified as a fingerprint or a file listing fingerprints. The fingerprint must be given or listed in compact format (no colons or spaces in between). If fpr_or_file specifies a file, empty lines are ignored as well as all lines starting with a hash sign. Only available for GnuPG backend.
• -no-appearance — Do not add appearance information when signing existing fields (signer name and date). no aesthetic, just vibes. 🙈
• -aia — Enable the use of Authority Information Access (AIA) extension to fetch missing certificates to build the certificate chain.
• -dump — Dump all signatures into current directory in their native format. Most likely it is either a unpadded or zero-padded CMS/PKCS7 bundle.
• -add-signature — Add a new signature to the document. ✍️
• -new-signature-field-name name — Specifies the field name to be used when adding a new signature. A random ID will be used by default.
• -sign field — Sign the document in the specified signature field present in the document (must be unsigned). Field can be specified by field name (string) or the n-th signature field in the document (integer).
• -nick nickname — Use the certificate with the given nickname for signing (NSS backend). If nickname starts with pkcs11:, it's treated as PKCS#11 URI (NSS backend). If the nickname is given as a fingerprint, it will be the certificate used (GPG backend).
• -backend backend — Use the specified backend for cryptographic signatures.
• -kpw password — Use the given password for the signing key (this might be missing if the key isn't password protected).
• -digest algorithm — Use the given digest algorithm for signing (default: SHA256).
• -reason reason — Set the given reason string for the signature (default: no reason set).
• -enable-pgp — Enable pgp signatures in the GnuPG backend. Only available for GnuPG backend.
• -etsi — Create a signature of type ETSI.CAdES.detached instead of adbe.pkcs7.detached.
• -list-nicks — List available nicknames in the NSS database. 🧚
• -list-backends — List available backends for cryptographic signatures.
• -v — Print copyright and version information.
• -h — Print usage information. (-help and --help are equivalent.)

---

🌈 EXAMPLES 🌈

okay now the fun part, let's actually run her:

1. pdfsig signed_file.pdf

Displays signature info for signed_file.pdf.

2.

pdfsig input.pdf output.pdf -add-signature -nss-pwd password -nick my-cert -reason 'for fun!'

Creates a new pdf named output.pdf with the contents of input.pdf signed by the 'my-cert' certificate.

3.

pdfsig input.pdf output.pdf -add-signature -nss-pwd password -nick 'pkcs11:token=smartcard0;object=Second%20certificate;type=cert'

Same, but uses a PKCS#11 URI as defined in IETF RFC 7512 to select the certificate to be used for signing. fancy!! 🔥

4.

pdfsig input.pdf output.pdf -sign 0 -nss-pwd password -nick my-cert -reason 'for fun!'

Creates a new pdf named output.pdf with the contents of input.pdf signed by the 'my-cert' certificate. input.pdf must have an already existing un-signed signature field. no field, no signature, so make sure it's there.

---

👑 AUTHOR 👑

The pdfsig software and documentation are copyright 1996-2004 Glyph & Cog, LLC and copyright 2005-2015 The Poppler Developers - http://poppler.freedesktop.org

---

💜 SEE ALSO 💜

• pdfdetach(1)
• pdffonts(1)
• pdfimages(1)
• pdfinfo(1)
• pdftocairo(1)
• pdftohtml(1)
• pdftoppm(1)
• pdftops(1)
• pdftotext(1)
• pdfseparate(1)
• pdfunite(1)
• certutil(1)

---

and that's the whole page, bestie!! this lil slice of manual-page perfection is dated 28 October 2015 and lives under the name pdfsig(1). go forth, verify those signatures, and remember: signed ranges don't lie. 💖✨🎀🦋