How do i generate a certificate to sign pdf electronically?

Maybe it is worth to give some more details, how to sign PDFs with Libreoffice. There are some pitfalls and this is a good place to store the experience I made.

First get yourself a x509 certificate you can use to sign/encrypt emails. Where you can get one, is dynamically changing. The free ones are rare, in worst case create a self signed. There are plenty of explanations in the web on how to do this. At the end you need a signed certificate including the private key in pk12 format.

For the moment, lets assume the pk12 file is named: cert.pk12

$ mkdir -p "~/.pki/cert8"
$ certutil -N -d ~/.pki/cert8/
Enter a password which will be used to encrypt your keys.
The password should be at least 8 characters long,
and should contain at least one non-alphabetic character.

Enter new password: 
Re-enter password: 
$ pk12util -d ~/.pki/cert8/ -i cert.pk12
Enter Password or Pin for "NSS Certificate DB":
Enter password for PKCS12 file: 
pk12util: PKCS12 IMPORT SUCCESSFUL
$ ls ~/.pki/cert8/
cert8.db  key3.db  secmod.db
$ certutil -L -d ~/.pki/cert8/

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

[email protected]                                                u,u,u
Xxxxxxxxxxxxxxxxxxxxxxxxxxxx CA                              ,,   
XXxxxx xxxxxxxxxxxxxxxxxxx CA                                ,,   

Now the certificate is in the database. In Libreoffice in the options (Tools -> Options... -> Security -> Certificate... -> Select NSS path...) the path to the database needs to be configured.

Now the certificate should be selectable in the "Digital Signatures" dialog.

With this at least all tools show me that the PDF is signed. Most of them show me that the signature is valid. But Windows Acrobat Reader still is not convinced. In Acrobat you need to explicitly manually trust the certificate. But my PDFs from Linux are marked as "modified". Maybe the transfer changed the Linux line endings to Windows line endings?

Using "Time Stamp Authotity" (TSA) seems only possible if you go via "Export as PDF".

Addition: With seahorse (which is started from Libreoffice by clicking on "Start Certificate Manager") it is not possible to add x509 certificates (at least at the time writing this).

There are three basic stages to obtaining a certificate.

1. You can get a certificate from a certification authority. No matter if you choose a governmental institution or a private company it is common to be charged for this service, for example when they certify your identity. Few other authorities issue certificates free of costs, like the Open Source Project "CAcert" which is based on the well-known and reliable Web of Trust model and is of growing popularity.

2. If you are using Solaris or Linux, you must install a recent version of Thunderbird or Firefox to install some system files that are needed for encryption.

3. Sign the macros inside a document. Normally, macros are part of a document. If you sign a document, the macros inside the document are signed automatically.

Reference

Here's how you can generate your own certificate for signing documents within libreoffice on (eg Debian), and get yourself set up to do so:

Prep

Install necessary tools:

sudo apt-get update && sudo apt-get install openssl libnss3-tools

Making the certificate

First, generate an x509 certificate:

openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
-keyout signing.key -out signing.crt -subj "/CN=John T Doe" \
-addext "subjectAltName=email:[email protected]"

...

..+......+..+....+........+.+.........+...........+.+.....+.+.....+...+.+....
+.....+.+.....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++*.........+..+.........+....+.........+...............+......+......
++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----

...

Note that subjectAltName can contain email: instead of DNS entries

Next, convert the certificate to a p12 format key:

openssl pkcs12 -export -in signing.cert -inkey signing.key \
-out signing-certificate.p12 -name "John T Doe"

...
Enter Export Password:
Verifying - Enter Export Password:
...

Making the NSS Database

Next, we need to prepare a database path for NSS and generate the database:

mkdir -p ~/.pki/nssdb
certutil -d ~/.pki/nssdb -N

...
Enter Password or Pin for "NSS Certificate DB":
Enter a password which will be used to encrypt your keys.
The password should be at least 8 characters long,
and should contain at least one non-alphabetic character.

Enter new password:
Re-enter password:
Password changed successfully.

...

Note that the password in question is your default master firefox password (on Debian/Ubuntu). So if you haven't set one up, its an empty string - once you do it will prompt you to enter a new one and change it

Or, do so without adding a password (Reference 4):

certutil -d ~/.pki/nssdb -N --empty-password

Finally, import the p12 certificate into the database:

pk12util -d ~/.pki/nssdb -i signing-certificate.p12

...

Enter Password or Pin for "NSS Certificate DB":
Enter password for PKCS12 file:
pk12util: PKCS12 IMPORT SUCCESSFUL

...

Note that you can use -k ${database.password.file} -w ${certificate.password.file} to flag in the passwords programatically if you want to get fancy

Configuring LibreOffice

1. Open LibreOffice
2. Select Window
3. Select Options
4. Select Security on the left
5. On the right, select Certificate by Certificate Path
6. Select Select NSS Path at the bottom of the resulting dialog, select the proper path (i.e. ~/.pki/nssdb), select Ok (ensuring the new Manual path is selected), and finally Restart Now.
7. After reboot, open a document, select File, select Export as, select Export as PDF.
8. Navigate to the Digital Signatures tab, and you should see things working:
9. Then select the certificate in question to use it to sign:
10. Enter your certificate password
11. Enter your location and reason (if so desired)
12. Select Export and save your document

You can lastly go into File ⇨ Digital Signatures... ⇨ Sign Existing PDF, and open your signed PDF to verify that a signature exists (and you could also sign in this fashion too):

References: