[GH-ISSUE #1050] Question: Certificate from a trusted authority

kerem commented

2026-02-26 18:46:29 +03:00

Owner

Originally created by @desto12 on GitHub (Mar 22, 2024).
Original GitHub issue: https://github.com/documenso/documenso/issues/1050

Hi,

At the beginning I want say that documenso is really great tool that's why I thought about using it to signing all my docs with bought certificate from trusted reseller, I was sure that I get certificate with private key but I got information from reseller support that private key is on physical cryptographic card that was send to the certificate and due to some law regulations it is impossible to export this key so I can't create .p12.

So the my question is it is possible to get somehow get trusted cert with private key? There is a lot of companies and services that allows to sign documents with trusted certificate, I don't belive that they are using crypto cards :)

Originally created by @desto12 on GitHub (Mar 22, 2024). Original GitHub issue: https://github.com/documenso/documenso/issues/1050 Hi, At the beginning I want say that documenso is really great tool that's why I thought about using it to signing all my docs with bought certificate from trusted reseller, I was sure that I get certificate with private key but I got information from reseller support that private key is on physical cryptographic card that was send to the certificate and due to some law regulations it is impossible to export this key so I can't create .p12. So the my question is it is possible to get somehow get trusted cert with private key? There is a lot of companies and services that allows to sign documents with trusted certificate, I don't belive that they are using crypto cards :)

kerem added the

Compliance

Stale

labels

2026-02-26 18:46:29 +03:00

kerem commented

2026-02-26 18:46:30 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Mar 22, 2024):

Thank you for opening your first issue and for being a part of the open signing revolution!

One of our team members will review it and get back to you as soon as it possible 💚

Meanwhile, please feel free to hop into our community in Discord

@github-actions[bot] commented on GitHub (Mar 22, 2024): Thank you for opening your first issue and for being a part of the open signing revolution! <br /> One of our team members will review it and get back to you as soon as it possible 💚 <br /> Meanwhile, please feel free to hop into our community in [Discord](https://documen.so/discord)

kerem commented

2026-02-26 18:46:30 +03:00

Author

Owner

@ElTimuro commented on GitHub (Mar 22, 2024):

@desto12 thanks, glad you like Documenso :)

About the cert: Yes, it is possible, though not all companies offer this. We got our cert from WiseKey
Happy to connect you to our contact if you like, but you could also just message them for an organizational cert (assuming you want your company name in there)
Let me know if there are more questions since this can be tricky. I'm more than happy to help, since this is partly why we started Documenso :)

@ElTimuro commented on GitHub (Mar 22, 2024): @desto12 thanks, glad you like Documenso :) - About the cert: Yes, it is possible, though not all companies offer this. We got our cert from WiseKey - Happy to connect you to our contact if you like, but you could also just message them for an organizational cert (assuming you want your company name in there) - Let me know if there are more questions since this can be tricky. I'm more than happy to help, since this is partly why we started Documenso :)

kerem commented

2026-02-26 18:46:30 +03:00

Author

Owner

@tankerkiller125 commented on GitHub (Apr 16, 2024):

@ElTimuro just a note on this issue from my experience working with multiple cert vendors.

The CAB Forum is getting significantly more strict about how CAs are allowed to issue certificates that have significant security or legal implications (Document Signing, Code Signing, etc.) and are beginning to force CAs to require Yubikey/HSM installs only.

As an example, in trying to get a new Code Signing certificate I spoke to 5 different providers and all of them told me that my only option was an HSM, or purchasing a Yubikey with the certificate installed for each developer who needed access. In the end we ended up using the Azure Key Vault HSM since that's our preferred cloud vendor.

I think long term, Documenso may be forced to add more HSM/Cloud HSM options to the signing logic, I see that Google Cloud HSM was recently introduced, and I think that's a great start, but Azure and AWS at minimum will probably also have to be added.

I tried to find the library/code used for the signing to potentially contribute Azure HSM functionality, but it appears that the code for that isn't public on Github?

@tankerkiller125 commented on GitHub (Apr 16, 2024): @ElTimuro just a note on this issue from my experience working with multiple cert vendors. The CAB Forum is getting significantly more strict about how CAs are allowed to issue certificates that have significant security or legal implications (Document Signing, Code Signing, etc.) and are beginning to force CAs to require Yubikey/HSM installs only. As an example, in trying to get a new Code Signing certificate I spoke to 5 different providers and all of them told me that my only option was an HSM, or purchasing a Yubikey with the certificate installed for each developer who needed access. In the end we ended up using the Azure Key Vault HSM since that's our preferred cloud vendor. I think long term, Documenso may be forced to add more HSM/Cloud HSM options to the signing logic, I see that Google Cloud HSM was recently introduced, and I think that's a great start, but Azure and AWS at minimum will probably also have to be added. I tried to find the library/code used for the signing to potentially contribute Azure HSM functionality, but it appears that the code for that isn't public on Github?

kerem commented

2026-02-26 18:46:30 +03:00

Author

Owner

@ElTimuro commented on GitHub (Apr 16, 2024):

Yes, I think so too
offering the high security HSM setups with minimal hustle is part of our mission and we will add as needed/ requested going forward
the reason you can't see the singing code is because we recentlymoved to a new, homegrown rust-based singing libary that we will Open Source shortly 🙌
we created this libary to better support cases like HSM signing

@ElTimuro commented on GitHub (Apr 16, 2024): - Yes, I think so too - offering the high security HSM setups with minimal hustle is part of our mission and we will add as needed/ requested going forward - the reason you can't see the singing code is because we recentlymoved to a new, homegrown rust-based singing libary that we will Open Source shortly 🙌 - we created this libary to better support cases like HSM signing

kerem commented

2026-02-26 18:46:30 +03:00

Author

Owner

@ElTimuro commented on GitHub (Apr 16, 2024):

It's also worth noting we have plans to create a free CA ourselves: https://github.com/documenso/backlog/issues/21
Ideally natively integrated in documenso and the supported HSM providers

@ElTimuro commented on GitHub (Apr 16, 2024): - It's also worth noting we have plans to create a free CA ourselves: https://github.com/documenso/backlog/issues/21 - Ideally natively integrated in documenso and the supported HSM providers

kerem commented

2026-02-26 18:46:30 +03:00

Author

Owner

@tankerkiller125 commented on GitHub (Feb 25, 2025):

@ElTimuro was the PDF signing rust library ever open-sourced so that other HSMs could be added by the community?

@tankerkiller125 commented on GitHub (Feb 25, 2025): @ElTimuro was the PDF signing rust library ever open-sourced so that other HSMs could be added by the community?

kerem commented

2026-02-26 18:46:30 +03:00

Author

Owner

@ElTimuro commented on GitHub (Feb 25, 2025):

Hey, yes of course: https://github.com/documenso/pdf-sign

Big update coming as well including LTV.

Not 100% if HSM is already public in this verison or if it's coming with the update.

lmk if you need the info!

@ElTimuro commented on GitHub (Feb 25, 2025): Hey, yes of course: https://github.com/documenso/pdf-sign Big update coming as well including LTV. Not 100% if HSM is already public in this verison or if it's coming with the update. lmk if you need the info!

kerem commented

2026-02-26 18:46:30 +03:00

Author

Owner

@koehn commented on GitHub (Mar 19, 2025):

FWIW, it would be nice if the user could simply upload a signed document to the original server to verify the authenticity of the signature. Finding apps that can do this is a pain.

@koehn commented on GitHub (Mar 19, 2025): FWIW, it would be nice if the user could simply upload a signed document to the original server to verify the authenticity of the signature. Finding apps that can do this is a pain.

kerem commented

2026-02-26 18:46:30 +03:00

Author

Owner

@MohammadAbuzar945 commented on GitHub (Nov 26, 2025):

@ElTimuro Do you have an estimate on when LTV support might be available? It’s a highly needed feature for our use case.

@MohammadAbuzar945 commented on GitHub (Nov 26, 2025): @ElTimuro Do you have an estimate on when LTV support might be available? It’s a highly needed feature for our use case.

kerem commented

2026-02-26 18:46:30 +03:00

Author

Owner

@ElTimuro commented on GitHub (Nov 26, 2025):

No fixed timeline
Q1 seems reasonable, but no promises

@ElTimuro commented on GitHub (Nov 26, 2025): - No fixed timeline - Q1 seems reasonable, but no promises

kerem referenced this issue

2026-02-26 19:30:51 +03:00

[PR #321] [MERGED] feat: add error message to signature pad #874

Rows
Columns

[GH-ISSUE #1050] Question: Certificate from a trusted authority #321