This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(28.799999999999997, 96%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVL%3C/text%3E%3C/svg%3E)
Does Trusted Signing Account support PDF signing? If so, how? If not, is this an upcoming feature?
It would be extremely interesting: currently, solutions for AATL signatures (valid in Acrobat but requiring storage on HSM FIPS 142-2 L2+) are very expensive and complex to implement. It is possible to achieve this with Azure Keyvault and an external provider, but the process is lengthy, complex, and costly. Having this functionality available directly in Azure would be a real game changer.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
@Vincent Langard Thank you for reaching out to us. Based on the update from my team, we currently do not support PDF signing, and it is not on our roadmap at this time. However, could you please provide more details on how this feature could benefit? I would be happy to share your feedback with our team.
@Givary-MSFT Automating the signing of PDF files has become a relatively simple process, accessible to any developer using the many open-source libraries available today. However, signing a PDF to achieve a "valid" signature in Acrobat is an entirely different challenge. While applying a valid signature to a single PDF is relatively straightforward (a cryptographic module in the form of a USB key is sufficient), industrializing this process is significantly more complex.
This industrialization has become essential, as fake documents are so easy to produce that valid signatures on PDFs are now critical for issuing organizations, regardless of their industry or size.
The simplest solution currently available for mass-signing PDFs with a "valid" stamp in Acrobat is to use an external service provider. These providers offer APIs capable of signing documents with an AATL certificate. However, this approach comes with a high cost (setup fees, purchasing signature bundles, per-document signing costs, etc.) and raises common outsourcing issues, particularly regarding GDPR compliance: declaring the subcontractor, notifying clients, managing the sharing of potentially sensitive data, and so on. For these reasons, this solution remains unsatisfactory for SMEs in terms of cost, scalability, and the complexity of adding an external provider.
Another solution is deploying an AATL certificate on Azure Key Vault, provided by a trusted vendor. However, current offerings for such certificates are scarce, opaque, and often hidden within the broader services offered by specialized companies. Additionally, when they are available, they are expensive: the last quote I saw was $5,000 per year for a certificate, with a cap of 30,000 timestamped signatures. Over the long term, this type of solution is not feasible for most SMEs.
In conclusion, an affordable, all-in-one, managed service with transparent costs would enable SMEs to sign their documents in bulk with Acrobat-validated signatures, without relying on additional external providers and their associated constraints. On reflection, this challenge closely mirrors that of the code signing market, where you are already making a significant impact with your Trusted Signing service.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(192, 3%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
PDF signing certificates are identical to Code Signing certificates, but they include a different 'enhanced key usage': Document Signing (1.3.6.1.4.1.311.10.3.12)
Just as code signing certificates were expensive and difficult to manage prior to Microsoft trusted signing, document signing certificates today are now expensive and difficult to manage.
Many software developers who have code signing certificates also have document signing certificates.
The main Microsoft web page for trusted signing specifically states that it does support documents, but the service currently does not generate certificates with the correct 'enhanced key usage'.
https://azure.microsoft.com/en-us/products/trusted-signing/
Trusted Signing
Secure your applications with a fully managed end-to-end signing service for code, documents, applications, and more