[GH-ISSUE #1663] Signed Document Shows 'Pending'

kerem commented

2026-02-26 18:47:11 +03:00

Owner

Originally created by @cowale on GitHub (Feb 20, 2025).
Original GitHub issue: https://github.com/documenso/documenso/issues/1663

Issue Description

I'm having trouble signing documents, because even after completing the signature the status remains pending. I'm hosting on my own VPS using Docker Swarm. Below is a print demonstrating the problem.

Steps to Reproduce

No response

Expected Behavior

No response

Current Behavior

No response

Screenshots (optional)

No response

Operating System [e.g., Windows 10]

Ubuntu 24

Browser [e.g., Chrome, Firefox]

Edge

Version [e.g., 2.0.1]

lastest

Please check the boxes that apply to this issue report.

I have searched the existing issues to make sure this is not a duplicate.
I have provided steps to reproduce the issue.
I have included relevant environment information.
I have included any relevant screenshots.
I understand that this is a voluntary contribution and that there is no guarantee of resolution.
I want to work on creating a PR for this issue if approved

Originally created by @cowale on GitHub (Feb 20, 2025). Original GitHub issue: https://github.com/documenso/documenso/issues/1663 ### Issue Description I'm having trouble signing documents, because even after completing the signature the status remains pending. I'm hosting on my own VPS using Docker Swarm. Below is a print demonstrating the problem. ![Image](https://github.com/user-attachments/assets/fc31d2e5-18c4-43e6-a2f7-fa9acfb21d8c) ### Steps to Reproduce _No response_ ### Expected Behavior _No response_ ### Current Behavior _No response_ ### Screenshots (optional) _No response_ ### Operating System [e.g., Windows 10] Ubuntu 24 ### Browser [e.g., Chrome, Firefox] Edge ### Version [e.g., 2.0.1] lastest ### Please check the boxes that apply to this issue report. - [x] I have searched the existing issues to make sure this is not a duplicate. - [x] I have provided steps to reproduce the issue. - [x] I have included relevant environment information. - [x] I have included any relevant screenshots. - [x] I understand that this is a voluntary contribution and that there is no guarantee of resolution. - [x] I want to work on creating a PR for this issue if approved

kerem added the

status: triage

label

2026-02-26 18:47:11 +03:00

kerem commented

2026-02-26 18:47:11 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Feb 20, 2025):

Thank you for opening your first issue and for being a part of the open signing revolution!

One of our team members will review it and get back to you as soon as it possible 💚

Meanwhile, please feel free to hop into our community in Discord

@github-actions[bot] commented on GitHub (Feb 20, 2025): Thank you for opening your first issue and for being a part of the open signing revolution! <br /> One of our team members will review it and get back to you as soon as it possible 💚 <br /> Meanwhile, please feel free to hop into our community in [Discord](https://documen.so/discord)

kerem commented

2026-02-26 18:47:11 +03:00

Author

Owner

@sidhuiwnl commented on GitHub (Feb 22, 2025):

I tried and it worked perfectly

@sidhuiwnl commented on GitHub (Feb 22, 2025): ![Image](https://github.com/user-attachments/assets/6eeee23f-15db-4511-af37-0be9db424d0d) I tried and it worked perfectly

kerem commented

2026-02-26 18:47:11 +03:00

Author

Owner

@cowale commented on GitHub (Feb 22, 2025):

I don't know if you're using it as Docker Swarm, but anyway, below is my stack configuration. I've censored some data for security reasons.

version: "3.7"
services:

  documenso:
    image: documenso/documenso:latest

    volumes:
      - documenso_cert:/opt/documenso/cert.p12

    networks:
      - conetwork ## Nome da rede interna

    environment:
      ## Dados de Acesso
      - PORT=3000
      - NEXTAUTH_URL=https://my.domain.com
      - NEXT_PUBLIC_WEBAPP_URL=https://my.domain.com
      - NEXT_PUBLIC_MARKETING_URL=https://oriondesign.art.br

      ## Secret Keys
      - NEXTAUTH_SECRET=9667ab5f41a741e7eb1faac8e6f90f5b
      - NEXT_PRIVATE_ENCRYPTION_KEY=ac6080ecc9e19347d89ef1ba49deb58e
      - NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=903fedf533347f851ae4ae48e30fc405

      ## Dados do Google Cloud
      #- NEXT_PRIVATE_GOOGLE_CLIENT_ID=
      #- NEXT_PRIVATE_GOOGLE_CLIENT_SECRET=

      ## Dados Postgres
      - NEXT_PRIVATE_DATABASE_URL=postgresql://postgres:CENSURED@postgres:5432/documenso
      - NEXT_PRIVATE_DIRECT_DATABASE_URL=postgresql://postgres:CENSURED@postgres:5432/documenso

      ## Configurações MinIO
      - NEXT_PUBLIC_UPLOAD_TRANSPORT=s3
      - NEXT_PRIVATE_UPLOAD_ENDPOINT=https://s3.domain.com ## Url do s3 | Comente esta linha caso tiver erro ao fazer login
      - NEXT_PRIVATE_UPLOAD_FORCE_PATH_STYLE=true
      - NEXT_PRIVATE_UPLOAD_REGION=eu-south
      - NEXT_PRIVATE_UPLOAD_BUCKET=documenso
      - NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID=x2Hian1wbA9aGJdFYyxi
      - NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY=8m8ez0wTDhVgZhxnzgcfERglvDaHNmjkXRcY6qoQ

      ## Dados de SMTP
      - NEXT_PRIVATE_SMTP_TRANSPORT=smtp-auth
      - NEXT_PRIVATE_SMTP_FROM_ADDRESS=main@email.com
      - NEXT_PRIVATE_SMTP_USERNAME=main@email.com
      - NEXT_PRIVATE_SMTP_PASSWORD=PASSWORD
      - NEXT_PRIVATE_SMTP_HOST=smtp.email.com
      - NEXT_PRIVATE_SMTP_PORT=465
      - NEXT_PRIVATE_SMTP_SECURE=true
      - NEXT_PRIVATE_SMTP_FROM_NAME=Suporte

      ## Configurações
      - NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT=10
      - NEXT_PUBLIC_DISABLE_SIGNUP=false
      - NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=/opt/documenso/cert.p12

    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      resources:
        limits:
          cpus: "1"
          memory: 1024M
      labels:
        - traefik.enable=true
        - traefik.http.routers.documenso.rule=Host(`my.domain.com`)
        - traefik.http.services.documenso.loadbalancer.server.port=3000
        - traefik.http.routers.documenso.service=documenso
        - traefik.http.routers.documenso.tls.certresolver=letsencryptresolver
        - traefik.http.routers.documenso.entrypoints=websecure
        - traefik.http.routers.documenso.tls=true
    
volumes:
  documenso_cert:
    external: true
    name: documenso_cert

networks:
  conetwork: ## Nome da rede interna
    name: conetwork ## Nome da rede interna
    external: true

@cowale commented on GitHub (Feb 22, 2025): I don't know if you're using it as Docker Swarm, but anyway, below is my stack configuration. I've censored some data for security reasons. ``` version: "3.7" services: documenso: image: documenso/documenso:latest volumes: - documenso_cert:/opt/documenso/cert.p12 networks: - conetwork ## Nome da rede interna environment: ## Dados de Acesso - PORT=3000 - NEXTAUTH_URL=https://my.domain.com - NEXT_PUBLIC_WEBAPP_URL=https://my.domain.com - NEXT_PUBLIC_MARKETING_URL=https://oriondesign.art.br ## Secret Keys - NEXTAUTH_SECRET=9667ab5f41a741e7eb1faac8e6f90f5b - NEXT_PRIVATE_ENCRYPTION_KEY=ac6080ecc9e19347d89ef1ba49deb58e - NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=903fedf533347f851ae4ae48e30fc405 ## Dados do Google Cloud #- NEXT_PRIVATE_GOOGLE_CLIENT_ID= #- NEXT_PRIVATE_GOOGLE_CLIENT_SECRET= ## Dados Postgres - NEXT_PRIVATE_DATABASE_URL=postgresql://postgres:CENSURED@postgres:5432/documenso - NEXT_PRIVATE_DIRECT_DATABASE_URL=postgresql://postgres:CENSURED@postgres:5432/documenso ## Configurações MinIO - NEXT_PUBLIC_UPLOAD_TRANSPORT=s3 - NEXT_PRIVATE_UPLOAD_ENDPOINT=https://s3.domain.com ## Url do s3 | Comente esta linha caso tiver erro ao fazer login - NEXT_PRIVATE_UPLOAD_FORCE_PATH_STYLE=true - NEXT_PRIVATE_UPLOAD_REGION=eu-south - NEXT_PRIVATE_UPLOAD_BUCKET=documenso - NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID=x2Hian1wbA9aGJdFYyxi - NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY=8m8ez0wTDhVgZhxnzgcfERglvDaHNmjkXRcY6qoQ ## Dados de SMTP - NEXT_PRIVATE_SMTP_TRANSPORT=smtp-auth - NEXT_PRIVATE_SMTP_FROM_ADDRESS=main@email.com - NEXT_PRIVATE_SMTP_USERNAME=main@email.com - NEXT_PRIVATE_SMTP_PASSWORD=PASSWORD - NEXT_PRIVATE_SMTP_HOST=smtp.email.com - NEXT_PRIVATE_SMTP_PORT=465 - NEXT_PRIVATE_SMTP_SECURE=true - NEXT_PRIVATE_SMTP_FROM_NAME=Suporte ## Configurações - NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT=10 - NEXT_PUBLIC_DISABLE_SIGNUP=false - NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=/opt/documenso/cert.p12 deploy: mode: replicated replicas: 1 placement: constraints: - node.role == manager resources: limits: cpus: "1" memory: 1024M labels: - traefik.enable=true - traefik.http.routers.documenso.rule=Host(`my.domain.com`) - traefik.http.services.documenso.loadbalancer.server.port=3000 - traefik.http.routers.documenso.service=documenso - traefik.http.routers.documenso.tls.certresolver=letsencryptresolver - traefik.http.routers.documenso.entrypoints=websecure - traefik.http.routers.documenso.tls=true volumes: documenso_cert: external: true name: documenso_cert networks: conetwork: ## Nome da rede interna name: conetwork ## Nome da rede interna external: true ```

kerem commented

2026-02-26 18:47:11 +03:00

Author

Owner

@sangemaru commented on GitHub (Feb 26, 2025):

I have this issue with some documents running Documenso on Cloudron.

@sangemaru commented on GitHub (Feb 26, 2025): I have this issue with _some_ documents running Documenso on Cloudron.

kerem commented

2026-02-26 18:47:12 +03:00

Author

Owner

@lenardchristopher commented on GitHub (Mar 3, 2025):

I had this issue too. I looked at the application logs and saw an error about sealing documents. I realized I didn't set the signing certificate env vars. After I did that, documents started completing.

For documents signed before this, I assume you can change some values in the BackgroundJobTask table to get them running again -- or something generally along that line of logic.

2025-03-02T19:50:32.4342533Z [JOBS]: Triggering job internal.seal-document with payload {
2025-03-02T19:50:32.4343013Z   documentId: 7,
2025-03-02T19:50:32.4343033Z   requestMetadata: {
2025-03-02T19:50:32.4343053Z     userAgent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36'
2025-03-02T19:50:32.4343066Z   }
2025-03-02T19:50:32.4343078Z }
2025-03-02T19:50:42.6599710Z [JOBS:task-06292354c47ced55f2e4d03bfb7e63bc9b46a8180d6f46eb02d23d3ebb8b8a45--cm7s1pezf003s5r20zsle425x] Task failed Error: ENOENT: no such file or directory, open '/opt/documenso/cert.p12'
2025-03-02T19:50:42.6600151Z     at Object.openSync (node:fs:562:18)
2025-03-02T19:50:42.6600172Z     at Object.readFileSync (node:fs:446:35)
2025-03-02T19:50:42.6600244Z     at I (/app/apps/web/.next/server/chunks/1348.js:1:1129364)
2025-03-02T19:50:42.6600260Z     at runNextTicks (node:internal/process/task_queues:65:5)
2025-03-02T19:50:42.6600274Z     at listOnTimeout (node:internal/timers:555:9)
2025-03-02T19:50:42.6600289Z     at process.processTimers (node:internal/timers:529:7)
2025-03-02T19:50:42.6600305Z     at async I (/app/apps/web/.next/server/chunks/1348.js:1:1127355)
2025-03-02T19:50:42.6600320Z     at async /app/apps/web/.next/server/chunks/6822.js:1:3016
2025-03-02T19:50:42.6600336Z     at async Object.runTask (/app/apps/web/.next/server/chunks/9125.js:1:31990)
2025-03-02T19:50:42.6600352Z     at async Module.b (/app/apps/web/.next/server/chunks/6822.js:1:2710) {
2025-03-02T19:50:42.6600376Z   errno: -2,
2025-03-02T19:50:42.6600390Z   code: 'ENOENT',
2025-03-02T19:50:42.6600421Z   syscall: 'open',
2025-03-02T19:50:42.6600436Z   path: '/opt/documenso/cert.p12'
2025-03-02T19:50:42.6600449Z }

@lenardchristopher commented on GitHub (Mar 3, 2025): I had this issue too. I looked at the application logs and saw an error about sealing documents. I realized I didn't set the signing certificate env vars. After I did that, documents started completing. For documents signed before this, I assume you can change some values in the BackgroundJobTask table to get them running again -- or something generally along that line of logic. ``` 2025-03-02T19:50:32.4342533Z [JOBS]: Triggering job internal.seal-document with payload { 2025-03-02T19:50:32.4343013Z documentId: 7, 2025-03-02T19:50:32.4343033Z requestMetadata: { 2025-03-02T19:50:32.4343053Z userAgent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36' 2025-03-02T19:50:32.4343066Z } 2025-03-02T19:50:32.4343078Z } 2025-03-02T19:50:42.6599710Z [JOBS:task-06292354c47ced55f2e4d03bfb7e63bc9b46a8180d6f46eb02d23d3ebb8b8a45--cm7s1pezf003s5r20zsle425x] Task failed Error: ENOENT: no such file or directory, open '/opt/documenso/cert.p12' 2025-03-02T19:50:42.6600151Z at Object.openSync (node:fs:562:18) 2025-03-02T19:50:42.6600172Z at Object.readFileSync (node:fs:446:35) 2025-03-02T19:50:42.6600244Z at I (/app/apps/web/.next/server/chunks/1348.js:1:1129364) 2025-03-02T19:50:42.6600260Z at runNextTicks (node:internal/process/task_queues:65:5) 2025-03-02T19:50:42.6600274Z at listOnTimeout (node:internal/timers:555:9) 2025-03-02T19:50:42.6600289Z at process.processTimers (node:internal/timers:529:7) 2025-03-02T19:50:42.6600305Z at async I (/app/apps/web/.next/server/chunks/1348.js:1:1127355) 2025-03-02T19:50:42.6600320Z at async /app/apps/web/.next/server/chunks/6822.js:1:3016 2025-03-02T19:50:42.6600336Z at async Object.runTask (/app/apps/web/.next/server/chunks/9125.js:1:31990) 2025-03-02T19:50:42.6600352Z at async Module.b (/app/apps/web/.next/server/chunks/6822.js:1:2710) { 2025-03-02T19:50:42.6600376Z errno: -2, 2025-03-02T19:50:42.6600390Z code: 'ENOENT', 2025-03-02T19:50:42.6600421Z syscall: 'open', 2025-03-02T19:50:42.6600436Z path: '/opt/documenso/cert.p12' 2025-03-02T19:50:42.6600449Z } ```

kerem commented

2026-02-26 18:47:12 +03:00

Author

Owner

@sangemaru commented on GitHub (Mar 3, 2025):

I was able to resolve the issue on my end by first allocating significantly more memory to Documenso (3GB up from 1GB), and going through the pending documents, clicking Edit, going through the whole process and at the end choosing to share using links instead of email - then was able to re-confirm the signing and move status to Completed.

@sangemaru commented on GitHub (Mar 3, 2025): I was able to resolve the issue on my end by first allocating significantly more memory to Documenso (3GB up from 1GB), and going through the pending documents, clicking Edit, going through the whole process and at the end choosing to share using links instead of email - then was able to re-confirm the signing and move status to Completed.

kerem commented

2026-02-26 18:47:12 +03:00

Author

Owner

@aleksander-pankow commented on GitHub (Apr 21, 2025):

The same, dokploy, last version.

@aleksander-pankow commented on GitHub (Apr 21, 2025): The same, dokploy, last version.

kerem commented

2026-02-26 18:47:12 +03:00

Author

Owner

@iptelephony commented on GitHub (Jun 18, 2025):

Sanity check, make sure your .p12 certificate is correctly generated.

openssl pkcs12 -export -out cert.p12 -inkey private.key -in certificate.crt -legacy

The -legacy flag must be included to generate a certificate that can be properly used for sealing.

If you followed the instructions from Github project, it's missing the -legacy flag.

Please follow the instructions from Documenso site

@iptelephony commented on GitHub (Jun 18, 2025): Sanity check, make sure your .p12 certificate is correctly generated. ``` openssl pkcs12 -export -out cert.p12 -inkey private.key -in certificate.crt -legacy ``` The `-legacy` flag must be included to generate a certificate that can be properly used for sealing. If you followed the instructions from [Github project](https://github.com/documenso/documenso/blob/main/SIGNING.md), it's missing the `-legacy` flag. Please follow the instructions from [Documenso site](https://docs.documenso.com/developers/local-development/signing-certificate)

kerem commented

2026-02-26 18:47:12 +03:00

Author

Owner

@ismxilxrif commented on GitHub (Jul 2, 2025):

we had this issue too recently, for us the issue happens when:

the environment NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH is not set, even though we use default paths, by setting this variable, it works, or
the permission for the .p12 file is not sufficient, it has to be own by the user running the node process. in our case using docker, it is UID 1001 GID 1001

after setting the correct permissions, and also the env, it worked again

you can also try to set NEXT_PRIVATE_INTERNAL_WEBAPP_URL to http:://localhost:3000 or the IP of your container, as this is where the backround worker is used to mark the doc as completed.

hope it helps

@ismxilxrif commented on GitHub (Jul 2, 2025): we had this issue too recently, for us the issue happens when: - the environment NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH is not set, even though we use default paths, by setting this variable, it works, or - the permission for the .p12 file is not sufficient, it has to be own by the user running the node process. in our case using docker, it is UID 1001 GID 1001 after setting the correct permissions, and also the env, it worked again you can also try to set NEXT_PRIVATE_INTERNAL_WEBAPP_URL to http:://localhost:3000 or the IP of your container, as this is where the backround worker is used to mark the doc as completed. hope it helps

kerem commented

2026-02-26 18:47:12 +03:00

Author

Owner

@chrisalat commented on GitHub (Jul 25, 2025):

In our case everything works fine, but after final signing no email will be send and the status is still pending. We are using latest documenso version 1.12.1 on GCP Cloud run with GCP KMS keys with the following vars:

NEXT_PRIVATE_SIGNING_TRANSPORT="gcloud-hsm"
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_KEY_PATH="PATH-TO-GCP-KEY-VERSION"
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_PUBLIC_CRT_FILE_CONTENTS="BASE64-KEY"

Here are the Cloud-Run-Logs:
[JOBS]: Job send.signing.requested.email failed PrismaClientKnownRequestError: Invalidprisma.document.findFirstOrThrow()invocation: An operation failed because it depends on one or more records that were required but not found. No record was found for a query. at Zn.handleRequestError (/app/node_modules/@prisma/client/runtime/library.js:121:7459) at Zn.handleAndLogRequestError (/app/node_modules/@prisma/client/runtime/library.js:121:6784) at Zn.request (/app/node_modules/@prisma/client/runtime/library.js:121:6491) at async l (/app/node_modules/@prisma/client/runtime/library.js:130:9778) at async Promise.all (index 1) at async Module.run (file:///app/apps/remix/build/server/hono/packages/lib/jobs/definitions/emails/send-signing-email.handler.js:27:39) at async Object.handler (file:///app/apps/remix/build/server/hono/packages/lib/jobs/definitions/emails/send-signing-email.js:25:5) at async file:///app/apps/remix/build/server/hono/packages/lib/jobs/client/local.js:101:9 at async dispatch (file:///app/node_modules/hono/dist/compose.js:30:17) at async file:///app/apps/remix/build/server/hono/server/router.js:57:3 { code: 'P2025', meta: { modelName: 'Document', cause: 'No record was found for a query.' }, clientVersion: '6.8.2' } POST503 67 B8,4 snode https://sub.documenso.com/api/jobs/internal.seal-document/cmdXXXXXX0z3cs Uncaught signal: 6, pid=52, tid=52, fault_addr=0. fatal runtime error: failed to initiate panic, error 5 Aborted

@chrisalat commented on GitHub (Jul 25, 2025): In our case everything works fine, but after final signing no email will be send and the status is still pending. We are using latest documenso version 1.12.1 on GCP Cloud run with GCP KMS keys with the following vars: - NEXT_PRIVATE_SIGNING_TRANSPORT="gcloud-hsm" - NEXT_PRIVATE_SIGNING_GCLOUD_HSM_KEY_PATH="PATH-TO-GCP-KEY-VERSION" - NEXT_PRIVATE_SIGNING_GCLOUD_HSM_PUBLIC_CRT_FILE_CONTENTS="BASE64-KEY" Here are the Cloud-Run-Logs: ` [JOBS]: Job send.signing.requested.email failed PrismaClientKnownRequestError: Invalid `prisma.document.findFirstOrThrow()` invocation: An operation failed because it depends on one or more records that were required but not found. No record was found for a query. at Zn.handleRequestError (/app/node_modules/@prisma/client/runtime/library.js:121:7459) at Zn.handleAndLogRequestError (/app/node_modules/@prisma/client/runtime/library.js:121:6784) at Zn.request (/app/node_modules/@prisma/client/runtime/library.js:121:6491) at async l (/app/node_modules/@prisma/client/runtime/library.js:130:9778) at async Promise.all (index 1) at async Module.run (file:///app/apps/remix/build/server/hono/packages/lib/jobs/definitions/emails/send-signing-email.handler.js:27:39) at async Object.handler (file:///app/apps/remix/build/server/hono/packages/lib/jobs/definitions/emails/send-signing-email.js:25:5) at async file:///app/apps/remix/build/server/hono/packages/lib/jobs/client/local.js:101:9 at async dispatch (file:///app/node_modules/hono/dist/compose.js:30:17) at async file:///app/apps/remix/build/server/hono/server/router.js:57:3 { code: 'P2025', meta: { modelName: 'Document', cause: 'No record was found for a query.' }, clientVersion: '6.8.2' } POST503 67 B8,4 snode https://sub.documenso.com/api/jobs/internal.seal-document/cmdXXXXXX0z3cs Uncaught signal: 6, pid=52, tid=52, fault_addr=0. fatal runtime error: failed to initiate panic, error 5 Aborted `

kerem referenced this issue

2026-02-26 19:31:42 +03:00

[PR #596] [CLOSED] fix: signer fields cannot be edited/removed after modifying the signer #1069

kerem referenced this issue

2026-02-26 19:32:50 +03:00

[PR #1039] [MERGED] fix: update document flow fetch logic #1336