Skip to content

Certificate Management

Digital certificates are essential for creating legally binding, cryptographically signed PDFs.

Why Certificates Are Needed

Digital signatures require a certificate to:

  • Create legally binding signatures - Cryptographic proof of signing
  • Verify document integrity - Detect any tampering
  • Provide non-repudiation - Prove who signed
  • Enable long-term validation - Signatures remain valid over time

Certificate Types

Self-Signed Certificates

  • Generated by GxPSign
  • Good for testing and development
  • Free to create
  • Not trusted by external PDF readers by default

CA-Issued Certificates

  • Issued by a trusted Certificate Authority (CA)
  • Automatically trusted by PDF readers
  • Required for external document sharing
  • Has associated costs

Recommendation

For production use, especially if sharing documents externally, use a CA-issued certificate.

Managing Certificates

Viewing Certificates

Certificates are managed through Django Admin:

  1. Access Django Admin (/admin/)
  2. Go to Signature Certificates
  3. View all organization certificates

Certificate Information

Each certificate displays:

Field Description
Name Friendly name for the certificate
Subject Certificate subject (organization info)
Issuer Who issued the certificate
Valid From Start of validity period
Valid Until Expiration date
Serial Number Unique certificate identifier
Is Default Whether this is the default for signing

Generating Self-Signed Certificates

Using Django Admin

  1. Go to Django Admin > Signature Certificates
  2. Select certificates to generate for
  3. Choose Generate self-signed certificate from Actions
  4. Click Go

Using Management Command

# Generate for all organizations without certificates
uv run python manage.py generate_default_certificates --all

# Generate for a specific organization
uv run python manage.py generate_default_certificates --org-id <id>

Certificate Details

Self-signed certificates are generated with:

  • 2048-bit RSA key
  • 365-day validity
  • SHA-256 signature algorithm
  • Organization name as subject

Importing External Certificates

Prerequisites

Before importing, you'll need:

  • PEM-encoded certificate file
  • PEM-encoded private key file
  • Private key password (if encrypted)

Import Process

  1. Go to Django Admin > Signature Certificates
  2. Click Add Signature Certificate
  3. Enter:
  4. Name: Descriptive name
  5. Certificate PEM: Paste certificate content
  6. Private Key PEM: Paste private key content
  7. Key Password: If key is encrypted
  8. Is Default: Check if this should be the default
  9. Click Save

Security Warning

Never share private key data. Keep private keys secure and limit access to certificate management.

Certificate Validation

When you save, the system validates:

  • Certificate format is valid
  • Private key matches certificate
  • Certificate is not expired
  • Key password is correct (if encrypted)

Default Certificate

Setting a Default

Each organization should have one default certificate:

  1. Go to Django Admin > Signature Certificates
  2. Click on the certificate
  3. Check Is Default
  4. Click Save

How Default Is Used

  • All new signatures use the default certificate
  • If no default, the first valid certificate is used
  • Documents can override with a specific certificate

Certificate Expiration

Monitoring Expiration

The admin interface shows expiration warnings:

  • Red: Expired
  • Yellow: Expiring within 30 days
  • Green: Valid for more than 30 days

Renewal Process

  1. Obtain a new certificate from your CA
  2. Import the new certificate
  3. Set it as the new default
  4. Test with a new signature
  5. Optionally remove the old certificate

Plan Ahead

Start renewal at least 30 days before expiration to avoid signing interruptions.

Hardware Security Modules (HSM)

For highest security environments, consider using an HSM:

  • Private keys never leave the HSM
  • Tamper-resistant hardware
  • Required for some compliance standards
  • Contact support for HSM integration

Timestamping

Trusted Timestamps

GxPSign can add trusted timestamps to signatures:

  • Proves when the signature was made
  • Independent verification of time
  • Required for long-term validation

TSA Configuration

  1. Obtain TSA credentials from a provider
  2. Configure in organization settings:
  3. TSA URL
  4. Authentication credentials
  5. Enable timestamping for signatures

TSA Providers

Common trusted timestamp providers:

  • DigiCert
  • Sectigo (formerly Comodo)
  • GlobalSign
  • FreeTSA (for testing)

Long-Term Validation (LTV)

What is LTV?

LTV embeds all necessary validation data in the signed PDF:

  • Certificate chain
  • Revocation information (CRL/OCSP)
  • Timestamp certificates

Why LTV Matters

Without LTV, signatures may become unverifiable when:

  • Certificates expire
  • CRL/OCSP servers are unavailable
  • CA goes out of business

With LTV, signatures remain verifiable indefinitely.

Enabling LTV

LTV is automatically enabled when:

  1. A trusted timestamp is added
  2. Certificate chain is available
  3. Revocation data can be obtained

Troubleshooting

Certificate Not Recognized

  • Ensure the certificate chain is complete
  • Check that the certificate is not expired
  • Verify the private key matches

Signatures Show as Invalid

  • Certificate may have expired
  • Document may have been modified
  • LTV data may be missing

Cannot Generate Certificate

  • Check database connectivity
  • Verify organization exists
  • Review error messages in logs

Best Practices

  1. Use CA-issued certificates for production
  2. Monitor expiration dates proactively
  3. Enable LTV for long-term validation
  4. Use trusted timestamps for legal compliance
  5. Secure private keys with strong access controls
  6. Regular backups of certificate data