1. IronPDF
  2. How-Tos
  3. Digitally Sign PDFs in Java

How to Digitally Sign a PDF in Java

Darrius Serrant
Darrius Serrant
Updated:

Digitally signing a PDF in Java with IronPDF lets you apply cryptographic signatures that verify document authenticity and detect unauthorized changes. IronPDF supports PdfSignature for attaching PFX certificate-based signatures to any PDF, setting visible signature images, controlling PDF certification levels with PdfCertificationLevel, and connecting to a Timestamp Authority server for long-term signature validity.

Quickstart: Digitally Sign a PDF in Java

  1. Install IronPDF for Java via Maven or Gradle
  2. Set your license key with License.setLicenseKey()
  3. Load the PDF with PdfDocument.fromFile()
  4. Create a PdfSignature with your PFX certificate file and password
  5. Apply the signature with signDigitalSignature()
  6. Save the signed PDF with saveAs()

```java :title=Quickstart //:path=/static-assets/ironpdf-java/content-code-examples/how-to/how-to-digitally-sign-pdfs-java-tutorial/quickstart.java import java.io.IOException; import java.nio.file.Path; import com.ironsoftware.ironpdf.License; import com.ironsoftware.ironpdf.PdfDocument; import com.ironsoftware.ironpdf.signature.PdfSignature;

public class Main { public static void main(String[] args) throws IOException { // Set the IronPDF license key License.setLicenseKey("IRONPDF-MYLICENSE-KEY-1EF01");

    // Load an existing PDF document
    PdfDocument pdf = PdfDocument.fromFile(Path.of("document.pdf"));

    // Create a PdfSignature using a PFX certificate file and its password
    PdfSignature signature = new PdfSignature("certificate.pfx", "password123");

    // Set signature metadata for audit trails
    signature.setSigningContact("John Smith");
    signature.setSigningLocation("New York");
    signature.setSigningReason("Document Approval");

    // Apply the digital signature to the PDF
    pdf.signDigitalSignature(signature);

    // Save the signed PDF to a new file
    pdf.saveAs(Path.of("signed.pdf"));
}

}


Digital signatures give PDF documents a cryptographic identity tied to a private key and certificate. When a recipient opens a signed PDF in Adobe Acrobat or any compliant viewer, the application verifies that the certificate chain traces back to a trusted authority and that the document content has not changed since signing. This combination of authentication and integrity makes digital signatures essential for contracts, invoices, regulatory filings, and any document where tamper evidence matters.

PDF signatures fall into two categories: approval signatures and author (certification) signatures. An approval signature records one signer's approval at a point in time; multiple parties can add approval signatures in sequence without invalidating earlier ones. A certification signature, applied with `certify()`, locks the document according to a `PdfCertificationLevel` and marks the signer as the document author. Certification signatures must be the first signature on a document and control what changes, if any, subsequent signers can make.

IronPDF handles both signature types through a consistent API built around `PdfSignature` and `PdfDocument`. For initial setup, dependency configuration, and license key instructions, see the [Get Started Overview](https://ironpdf.com/java/docs/).

<div class="hsg-featured-snippet">
    <h2>How to Digitally Sign a PDF in Java</h2>
    <ol>
        <li><a href="https://ironpdf.com/java/#download-modal">Install the IronPDF Java library for digital signatures</a></li>
        <li>Use the <strong>PdfDocument</strong> class to load the PDF</li>
        <li>Create a <strong>PdfSignature</strong> using a PFX certificate file and password</li>
        <li>Optionally set a visible signature image with <code>setSignatureImage</code></li>
        <li>Apply the signature with <code>signDigitalSignature</code></li>
        <li>Certify the PDF with <code>certify</code> and a <code>PdfCertificationLevel</code></li>
        <li>Save the signed PDF with <code>saveAs</code></li>
    </ol>
</div>

## What Do I Need Before Getting Started?

Before signing PDFs with IronPDF, confirm the following prerequisites:

- **Java 8 or higher**: IronPDF requires a JDK of version 8 or above.
- **IronPDF for Java**: Add the dependency to your build file. Find the latest version on [Maven Central](https://central.sonatype.com/artifact/com.ironsoftware/ironpdf).
- **A valid license key**: Set the key at application startup with `License.setLicenseKey()`. For setup details, visit the [license keys guide](https://ironpdf.com/java/get-started/license-keys/).
- **A PFX or P12 certificate file**: This is a password-protected archive containing your private key and public certificate in PKCS#12 format. Self-signed certificates work for development and testing; for production documents that need to be trusted by external recipients, use a certificate issued by a recognized Certificate Authority (CA) such as DigiCert, Comodo, or GlobalSign.

For full dependency setup and project configuration, refer to the [Get Started Overview](https://ironpdf.com/java/docs/).

## How Do I Apply a Digital Signature to a PDF?

The `PdfSignature` constructor takes the file path to your PFX certificate and its password. Once constructed, you can attach optional metadata through three setter methods:

- `setSigningContact(String)`: the name or email of the person signing
- `setSigningLocation(String)`: the physical or organizational location of the signer
- `setSigningReason(String)`: a short description of why the document is being signed

These fields appear in the signature properties panel of PDF viewers and create a useful audit record for compliance purposes. Call `signDigitalSignature(PdfSignature)` on the loaded `PdfDocument` to embed the cryptographic signature, then save the result with `saveAs()`.

```java
//:path=/static-assets/ironpdf-java/content-code-examples/how-to/how-to-digitally-sign-pdfs-java-tutorial/apply-signature.java
import java.io.IOException;
import java.nio.file.Path;
import com.ironsoftware.ironpdf.License;
import com.ironsoftware.ironpdf.PdfDocument;
import com.ironsoftware.ironpdf.signature.PdfSignature;

public class Main {
    public static void main(String[] args) throws IOException {
        // Set the IronPDF license key
        License.setLicenseKey("IRONPDF-MYLICENSE-KEY-1EF01");

        // Load the PDF to sign
        PdfDocument pdf = PdfDocument.fromFile(Path.of("contract.pdf"));

        // Construct the PdfSignature with the certificate path and password
        PdfSignature signature = new PdfSignature("certificate.pfx", "password123");

        // Set metadata that will appear in the signature properties panel
        signature.setSigningContact("Jane Doe");
        signature.setSigningLocation("Austin, TX");
        signature.setSigningReason("Contract Approval");

        // Embed the digital signature in the PDF
        pdf.signDigitalSignature(signature);

        // Save the signed document
        pdf.saveAs(Path.of("contract-signed.pdf"));
    }
}

After signDigitalSignature() completes, the PDF contains a cryptographic hash of the document content signed with the private key from the PFX file. Any modification to the file after this point will invalidate the signature.

How Do I Add a Visible Signature Image to a PDF?

A visible signature image places a graphical representation directly on the PDF page at the location of the signature field. This is commonly used to display a scanned handwritten signature, a company stamp, or a logo so that the document looks signed when printed or viewed, not only when inspected with a PDF reader's signature panel.

To add a visible image, open the image file as a FileInputStream and pass it to PdfSignature.setSignatureImage(InputStream) before calling signDigitalSignature(). The image is embedded within the signature field on the page.

//:path=/static-assets/ironpdf-java/content-code-examples/how-to/how-to-digitally-sign-pdfs-java-tutorial/visible-signature-image.java
import java.io.FileInputStream;
import java.io.IOException;
import java.nio.file.Path;
import com.ironsoftware.ironpdf.License;
import com.ironsoftware.ironpdf.PdfDocument;
import com.ironsoftware.ironpdf.signature.PdfSignature;

public class Main {
    public static void main(String[] args) throws IOException {
        // Set the IronPDF license key
        License.setLicenseKey("IRONPDF-MYLICENSE-KEY-1EF01");

        // Load the PDF document to sign
        PdfDocument pdf = PdfDocument.fromFile(Path.of("agreement.pdf"));

        // Build the PdfSignature from a PFX certificate
        PdfSignature signature = new PdfSignature("certificate.pfx", "password123");

        // Set signing metadata
        signature.setSigningContact("Alice Johnson");
        signature.setSigningLocation("Chicago, IL");
        signature.setSigningReason("Agreement Authorization");

        // Open the signature image file and attach it to the signature
        FileInputStream imageStream = new FileInputStream("signature.png");
        signature.setSignatureImage(imageStream);

        // Apply the digital signature with the visible image to the PDF
        pdf.signDigitalSignature(signature);

        // Save the signed PDF with the visible signature image embedded
        pdf.saveAs(Path.of("agreement-signed.pdf"));
    }
}
//:path=/static-assets/ironpdf-java/content-code-examples/how-to/how-to-digitally-sign-pdfs-java-tutorial/visible-signature-image.java
import java.io.FileInputStream;
import java.io.IOException;
import java.nio.file.Path;
import com.ironsoftware.ironpdf.License;
import com.ironsoftware.ironpdf.PdfDocument;
import com.ironsoftware.ironpdf.signature.PdfSignature;

public class Main {
    public static void main(String[] args) throws IOException {
        // Set the IronPDF license key
        License.setLicenseKey("IRONPDF-MYLICENSE-KEY-1EF01");

        // Load the PDF document to sign
        PdfDocument pdf = PdfDocument.fromFile(Path.of("agreement.pdf"));

        // Build the PdfSignature from a PFX certificate
        PdfSignature signature = new PdfSignature("certificate.pfx", "password123");

        // Set signing metadata
        signature.setSigningContact("Alice Johnson");
        signature.setSigningLocation("Chicago, IL");
        signature.setSigningReason("Agreement Authorization");

        // Open the signature image file and attach it to the signature
        FileInputStream imageStream = new FileInputStream("signature.png");
        signature.setSignatureImage(imageStream);

        // Apply the digital signature with the visible image to the PDF
        pdf.signDigitalSignature(signature);

        // Save the signed PDF with the visible signature image embedded
        pdf.saveAs(Path.of("agreement-signed.pdf"));
    }
}
JAVA

The signature image does not replace the cryptographic protection; both the graphical stamp and the underlying certificate remain part of the signed output. PNG and JPEG formats are supported for the signature image.

How Do I Certify a PDF With a Specific Permission Level?

Certifying a PDF differs from adding an approval signature. When you call pdf.certify(PdfSignature, PdfCertificationLevel), you sign the document as its author and specify which types of changes are permitted by subsequent users. A certified PDF displays a blue ribbon or similar trust indicator in Adobe Acrobat, signaling to recipients that the document comes from a verified source.

IronPDF provides three certification levels through the PdfCertificationLevel enum:

  • PdfCertificationLevel.NO_CHANGES_ALLOWED: the document is fully locked after certification; no further modifications are permitted.
  • PdfCertificationLevel.FORM_FILLING: recipients may fill in form fields but cannot add comments, annotations, or other changes.
  • PdfCertificationLevel.FORM_FILLING_AND_ANNOTATIONS: recipients may fill in form fields and add annotations, but structural edits are still prohibited.

Because a certification signature must be the first signature on a document, call certify() before applying any approval signatures from other parties.

//:path=/static-assets/ironpdf-java/content-code-examples/how-to/how-to-digitally-sign-pdfs-java-tutorial/certify-pdf.java
import java.io.IOException;
import java.nio.file.Path;
import com.ironsoftware.ironpdf.License;
import com.ironsoftware.ironpdf.PdfDocument;
import com.ironsoftware.ironpdf.signature.PdfCertificationLevel;
import com.ironsoftware.ironpdf.signature.PdfSignature;

public class Main {
    public static void main(String[] args) throws IOException {
        // Set the IronPDF license key
        License.setLicenseKey("IRONPDF-MYLICENSE-KEY-1EF01");

        // Load the PDF that will be certified
        PdfDocument pdf = PdfDocument.fromFile(Path.of("report.pdf"));

        // Create the PdfSignature from the author's certificate
        PdfSignature signature = new PdfSignature("author-certificate.pfx", "password123");

        // Set author metadata for the certification signature
        signature.setSigningContact("Legal Department");
        signature.setSigningLocation("San Francisco, CA");
        signature.setSigningReason("Official Publication");

        // Certify the document with NO_CHANGES_ALLOWED to lock it completely
        // Use FORM_FILLING to allow form field input after certification
        // Use FORM_FILLING_AND_ANNOTATIONS to also permit annotations
        pdf.certify(signature, PdfCertificationLevel.NO_CHANGES_ALLOWED);

        // Save the certified PDF
        pdf.saveAs(Path.of("report-certified.pdf"));
    }
}
//:path=/static-assets/ironpdf-java/content-code-examples/how-to/how-to-digitally-sign-pdfs-java-tutorial/certify-pdf.java
import java.io.IOException;
import java.nio.file.Path;
import com.ironsoftware.ironpdf.License;
import com.ironsoftware.ironpdf.PdfDocument;
import com.ironsoftware.ironpdf.signature.PdfCertificationLevel;
import com.ironsoftware.ironpdf.signature.PdfSignature;

public class Main {
    public static void main(String[] args) throws IOException {
        // Set the IronPDF license key
        License.setLicenseKey("IRONPDF-MYLICENSE-KEY-1EF01");

        // Load the PDF that will be certified
        PdfDocument pdf = PdfDocument.fromFile(Path.of("report.pdf"));

        // Create the PdfSignature from the author's certificate
        PdfSignature signature = new PdfSignature("author-certificate.pfx", "password123");

        // Set author metadata for the certification signature
        signature.setSigningContact("Legal Department");
        signature.setSigningLocation("San Francisco, CA");
        signature.setSigningReason("Official Publication");

        // Certify the document with NO_CHANGES_ALLOWED to lock it completely
        // Use FORM_FILLING to allow form field input after certification
        // Use FORM_FILLING_AND_ANNOTATIONS to also permit annotations
        pdf.certify(signature, PdfCertificationLevel.NO_CHANGES_ALLOWED);

        // Save the certified PDF
        pdf.saveAs(Path.of("report-certified.pdf"));
    }
}
JAVA

Once certified with NO_CHANGES_ALLOWED, any attempt to modify the PDF will break the certification signature and PDF viewers will display a warning. Choose FORM_FILLING or FORM_FILLING_AND_ANNOTATIONS when the certified document needs to be filled out or annotated by downstream recipients without invalidating the author's certification.

How Do I Add a Timestamp to a Digital Signature?

A Timestamp Authority (TSA) server provides a cryptographically signed time token that gets embedded alongside the signature in the PDF. This timestamp proves when the signature was applied, independent of the signer's local clock. Long-term validity depends on timestamps: even after a signing certificate expires, a trusted timestamp allows validators to confirm that the signature was created while the certificate was still valid.

To enable timestamping, set two properties on the PdfSignature object before signing:

  • setTimestampHashAlgorithm(PdfHashAlgorithm): specifies the hashing algorithm to use when computing the timestamp token. PdfHashAlgorithm.SHA256 is the standard choice.
  • setTimestampUrl(String): the HTTP or HTTPS endpoint of the TSA server that will issue the timestamp token.

Several TSA servers are available at no cost for testing and low-volume production use. https://freetsa.org/tsr and http://timestamp.digicert.com are two commonly used endpoints.

//:path=/static-assets/ironpdf-java/content-code-examples/how-to/how-to-digitally-sign-pdfs-java-tutorial/timestamp-signature.java
import java.io.IOException;
import java.nio.file.Path;
import com.ironsoftware.ironpdf.License;
import com.ironsoftware.ironpdf.PdfDocument;
import com.ironsoftware.ironpdf.signature.PdfHashAlgorithm;
import com.ironsoftware.ironpdf.signature.PdfSignature;

public class Main {
    public static void main(String[] args) throws IOException {
        // Set the IronPDF license key
        License.setLicenseKey("IRONPDF-MYLICENSE-KEY-1EF01");

        // Load the PDF to sign with a timestamp
        PdfDocument pdf = PdfDocument.fromFile(Path.of("invoice.pdf"));

        // Construct the PdfSignature from the certificate file
        PdfSignature signature = new PdfSignature("certificate.pfx", "password123");

        // Set signature metadata
        signature.setSigningContact("Finance Team");
        signature.setSigningLocation("Seattle, WA");
        signature.setSigningReason("Invoice Authorization");

        // Configure the timestamp: set the hash algorithm and TSA endpoint
        signature.setTimestampHashAlgorithm(PdfHashAlgorithm.SHA256);
        signature.setTimestampUrl("https://freetsa.org/tsr");

        // Apply the digital signature; IronPDF will contact the TSA to obtain
        // and embed a timestamp token alongside the cryptographic signature
        pdf.signDigitalSignature(signature);

        // Save the timestamped, signed PDF
        pdf.saveAs(Path.of("invoice-signed-timestamped.pdf"));
    }
}
//:path=/static-assets/ironpdf-java/content-code-examples/how-to/how-to-digitally-sign-pdfs-java-tutorial/timestamp-signature.java
import java.io.IOException;
import java.nio.file.Path;
import com.ironsoftware.ironpdf.License;
import com.ironsoftware.ironpdf.PdfDocument;
import com.ironsoftware.ironpdf.signature.PdfHashAlgorithm;
import com.ironsoftware.ironpdf.signature.PdfSignature;

public class Main {
    public static void main(String[] args) throws IOException {
        // Set the IronPDF license key
        License.setLicenseKey("IRONPDF-MYLICENSE-KEY-1EF01");

        // Load the PDF to sign with a timestamp
        PdfDocument pdf = PdfDocument.fromFile(Path.of("invoice.pdf"));

        // Construct the PdfSignature from the certificate file
        PdfSignature signature = new PdfSignature("certificate.pfx", "password123");

        // Set signature metadata
        signature.setSigningContact("Finance Team");
        signature.setSigningLocation("Seattle, WA");
        signature.setSigningReason("Invoice Authorization");

        // Configure the timestamp: set the hash algorithm and TSA endpoint
        signature.setTimestampHashAlgorithm(PdfHashAlgorithm.SHA256);
        signature.setTimestampUrl("https://freetsa.org/tsr");

        // Apply the digital signature; IronPDF will contact the TSA to obtain
        // and embed a timestamp token alongside the cryptographic signature
        pdf.signDigitalSignature(signature);

        // Save the timestamped, signed PDF
        pdf.saveAs(Path.of("invoice-signed-timestamped.pdf"));
    }
}
JAVA

When the TSA is unreachable at signing time, IronPDF will throw an exception; verify network access and the TSA endpoint URL before deploying to production. For high-volume production workflows, consider a commercial TSA subscription to ensure uptime and throughput guarantees.

What Are the Next Steps for Digitally Signing PDFs in Java?

IronPDF's PdfSignature class covers the full range of PDF signature requirements: approval signatures with certificate metadata, visible graphical stamps, PDF certification with access control levels, and TSA-backed timestamps for long-term validity. To extend your PDF workflow beyond signing, explore these related resources:

Start your free trial to add digital signatures to your Java PDF workflow. To purchase a license for production use, view licensing options.

Frequently Asked Questions

How do I digitally sign a PDF in Java with IronPDF?

Load your PDF with PdfDocument.fromFile(), create a PdfSignature using the path to your PFX certificate file and its password, optionally set metadata with setSigningContact(), setSigningLocation(), and setSigningReason(), then call pdf.signDigitalSignature(signature) and save with pdf.saveAs().

What is the difference between signDigitalSignature() and certify() in IronPDF?

signDigitalSignature() adds an approval signature that records one signer's approval. Multiple approval signatures can be added in sequence. certify() adds an author signature that must be first on the document and sets a PdfCertificationLevel controlling what changes subsequent signers can make.

How do I add a visible signature image to a signed PDF in Java?

Open the image file as a FileInputStream and pass it to signature.setSignatureImage(imageStream) before calling signDigitalSignature(). The image is embedded in the signature field on the page alongside the cryptographic signature.

What PDF certification levels does IronPDF support?

IronPDF supports three levels via the PdfCertificationLevel enum: NO_CHANGES_ALLOWED locks the document completely, FORM_FILLING permits form field input only, and FORM_FILLING_AND_ANNOTATIONS permits form fields and annotations while preventing structural edits.

How do I add a timestamp to a digital signature in Java?

Set signature.setTimestampHashAlgorithm(PdfHashAlgorithm.SHA256) and signature.setTimestampUrl("https://freetsa.org/tsr") on the PdfSignature before calling signDigitalSignature(). IronPDF contacts the TSA server and embeds the timestamp token in the signed PDF.

What certificate file format does IronPDF require for PDF signing?

IronPDF requires a PFX or P12 certificate file, which is a PKCS#12 archive containing the private key and public certificate. Self-signed certificates work for development; for production use, obtain a certificate from a trusted Certificate Authority such as DigiCert or GlobalSign.

What are the prerequisites for digitally signing PDFs with IronPDF in Java?

You need Java 8 or higher, the IronPDF dependency added via Maven or Gradle, a valid license key set with License.setLicenseKey(), and a PFX or P12 certificate file with its password.

Darrius Serrant
Darrius Serrant
  Chat with engineering team now
Full Stack Software Engineer (WebOps)

Darrius Serrant holds a Bachelor’s degree in Computer Science from the University of Miami and works as a Full Stack WebOps Marketing Engineer at Iron Software. Drawn to coding from a young age, he saw computing as both mysterious and accessible, making it the perfect medium for creativity ...

Read More
Ready to Get Started?
Version: 2026.4 just released
Still Scrolling Icon

Still Scrolling?

Want proof fast?
run a sample watch your HTML become a PDF.