How do you get a digital signature certificate in your country?

A government portal, a client or a regulator has asked you to "sign with a digital signature", and a drawn signature will not do. You need a certificate.

If you are not sure you need one at all, read digital vs electronic signature first. For many everyday contracts, an ordinary e-signature is enough.

The short answer

• Who issues: a certificate authority (CA), also called a trust service provider, that your country licenses, accredits or lists. In some countries a government body issues citizen certificates directly.
• Identity check: in person, by video, through a national ID card or app, or through a bank or government login.
• What you get: either a file (.pfx or .p12, protected by a password) or a key locked inside a smart card, USB token, phone app or remote (cloud) signing service.
• Using it on a website: only a file certificate can be uploaded to a website such as KovaPDF's Digital Signature. Card, token and cloud certificates cannot be exported, by design; you sign with the CA's own app or software.

File, token, card or cloud: why it matters

A certificate has two parts: the public certificate (which anyone can see) and the private key (which must stay secret). Where the private key lives decides what you can do with it.

Qualified signatures in the EU usually need a qualified signature creation device, which is why they are almost always on a card, token or remote service rather than in a file.

Country by country

European Union (general)

Qualified certificates come from qualified trust service providers listed on the EU trusted lists. Identity is checked in person, by video (where national rules allow), or with an electronic ID. Qualified signatures are increasingly offered as remote signing: you confirm each signature on your phone. The 2024 revision of eIDAS (Regulation (EU) 2024/1183) requires member states to offer European Digital Identity Wallets that can create qualified signatures, free of charge for non-professional use; rollout depends on each country. See the EU.

Germany

The online ID function of the German identity card (Personalausweis) proves who you are online; it is not itself a signature. You can use it to identify yourself to a qualified provider (for example D-Trust's sign-me remote signing) and then create qualified signatures through that provider. These are remote signatures, not files. See Germany.

France

Qualified and advanced certificates are sold by providers listed on the French and EU trusted lists, typically on a USB token or through remote signing, after an identity check. Many professional bodies have their own arrangements. See France.

Spain

The Fábrica Nacional de Moneda y Timbre (FNMT) issues a free personal certificate (certificado de persona física) to anyone with a DNI or NIE, after identity verification in person, by video, with the electronic DNI or through its mobile app. The software version is installed in your browser and can be exported as a .pfx or .p12 backup file, so it is one of the few widely held citizen certificates that works with a file-based tool. The electronic DNI card also carries certificates, but those stay on the card. See Spain.

Italy

The firma digitale is supplied by qualified providers accredited by the Agency for Digital Italy (AgID), as a kit with a smart card or USB token, or as remote signing (firma remota) confirmed with a code. SPID or the electronic ID card is often used to prove identity when you buy one. None of these gives you an exportable file. See Italy.

United Kingdom

There is no government signing certificate for citizens. Qualified and advanced certificates are available from commercial providers, but for most private documents a simple e-signature is enough. See the UK.

United States

There is no government digital signature certificate for the public. Businesses and individuals buy document signing certificates from commercial CAs. Certificates trusted automatically by common PDF readers are usually issued on a hardware token or through a cloud signing service, so they often cannot be exported. Some CAs sell exportable certificates that PDF readers will show as valid only after the recipient chooses to trust them. See the US.

Canada

No general citizen signing certificate exists; commercial providers and some professional bodies supply them. Most private documents do not need one. See Canada.

Brazil

Certificates are issued within ICP-Brasil by accredited authorities, after identity checks (often by video). An A1 certificate is a file installed on your computer and valid for one year; it can be used with file-based tools. An A3 lives on a token, card or cloud service and lasts longer, but cannot be exported. The free gov.br account also offers an advanced electronic signature for many uses, but that is a different, non-ICP-Brasil signature made on the government platform. See Brazil.

Mexico

The tax authority, SAT, issues the e.firma (advanced electronic signature) to individuals and companies, after an in-person appointment with biometric checks. You receive a certificate file (.cer), a private key file (.key) and a password, valid for four years. It is used for tax and many government procedures. The .cer and .key are separate files, not a .pfx; they can technically be combined into one, but whether a PDF signed that way outside SAT's systems is accepted is up to the recipient. See Mexico.

India

Digital Signature Certificates (DSCs) are issued by Certifying Authorities licensed by the Controller of Certifying Authorities (CCA). Individual certificates are Class 3 and are issued on a FIPS-certified USB crypto token after identity and video verification, so they cannot be used on websites that require a .pfx upload; signing is done with the CA's or the portal's own utility. Aadhaar-based eSign is an alternative for many documents: an online service signs for you after an OTP to your Aadhaar-linked phone, with no token needed. See India.

Bangladesh

Certificates come from Certifying Authorities licensed by the Controller of Certifying Authorities under the ICT Division. Check the CCA's current list of licensed CAs; token-based issuance is common. See Bangladesh.

Pakistan

Under the Electronic Transactions Ordinance 2002, certification service providers are accredited by the Electronic Certification Accreditation Council. Only a small number have been accredited; check the council's current list and ask each provider what form the certificate takes. See Pakistan.

Turkey

A secure (qualified) electronic signature certificate comes from an electronic certificate service provider authorised by the Information and Communication Technologies Authority (BTK). It is delivered on a smart card or USB token, or as a mobile signature through your mobile operator. Neither can be exported. Public employees usually get theirs through their institution. See Turkey.

United Arab Emirates

UAE Pass, the national digital identity app, lets residents sign documents digitally inside the app and on connected services. The Telecommunications and Digital Government Regulatory Authority licenses trust service providers under Decree-Law No. 46 of 2021. UAE Pass signatures stay inside the app, not in an exportable file. Which signature level a specific use needs: check locally. See the UAE.

Saudi Arabia

Digital certificates are part of the national framework overseen under the Electronic Transactions Law, with the National Center for Digital Certification at its core. Individuals usually sign through government platforms or licensed providers rather than holding their own file. Check locally for the current providers. See Saudi Arabia.

South Africa

For an advanced electronic signature under the Electronic Communications and Transactions Act, the provider must be accredited by the South African Accreditation Authority; the list is short. Commercial certificates are also available for general use. See South Africa.

Nigeria

Nigeria's Evidence Act 2011 accepts electronic signatures, but a public-facing national certificate system for individuals is still developing. Commercial international CAs can supply document signing certificates. Check with the office receiving your document what it accepts. See Nigeria.

Japan

The My Number Card carries a signature certificate issued under the Public Certification Service for Individuals (JPKI), valid for five years, used for online government applications with a card reader or a compatible smartphone. It stays on the card. Accredited certification businesses under the Electronic Signatures Act also sell certificates. See Japan.

Singapore

Sign with Singpass lets Singpass users sign documents digitally on participating platforms, using the Singpass app. It does not give you a certificate file. Other certificates are available from commercial providers. See Singapore.

Philippines

The Department of Information and Communications Technology runs the Philippine National Public Key Infrastructure (PNPKI), issuing digital certificates to government personnel and, depending on the programme, to individuals and businesses. Ask DICT what form your certificate will take. See the Philippines.

Indonesia

Certified electronic signatures come from electronic certification providers (PSrE) recognised by the Ministry of Communication and Digital Affairs; government employees generally use the national cyber agency's provider. Most offer signing through an app or platform. See Indonesia.

Australia

There is no general citizen signing certificate; the myID digital identity is for logging in to government services. Commercial certificates are available where needed. See Australia.

How to sign a PDF with your .pfx file on KovaPDF

1. Open Digital Signature and upload your PDF.
2. Choose your .pfx or .p12 file and enter its password. The certificate and password are used once in memory and not stored.
3. Choose a visible signature (placed on the page) or an invisible one.
4. Keep the trusted timestamp on (the default). If your CA publishes revocation data, long-term validation information is embedded so the signature stays checkable after the certificate expires.
5. Download the signed PDF and check it in Verify PDF Signature.

Whether the result is an advanced, qualified or nationally "certified" signature depends entirely on your certificate and how it was issued, not on KovaPDF.

If your certificate is on a token, card, app or cloud service

You cannot use it on any website that asks for a file, including ours. Instead:

• install your CA's signing software or driver and sign in a desktop PDF reader that supports your token, or
• use the CA's or government's own online signing service (remote signing, UAE Pass, Sign with Singpass, eSign), or
• sign on the government portal that asked for the signature, if it has its own signing step.

You can still use KovaPDF to prepare the PDF beforehand and to verify the signed file afterwards. If you only need signatures from other people and any e-signature is acceptable, Request Signatures does not need a certificate at all.

For background, see what a digital certificate is.