mirror of
https://github.com/documenso/documenso.git
synced 2026-07-22 16:03:39 +10:00
Lucas Smith
d5ce222482
Adds Cloud Signature Consortium (CSC) integration for AES/QES signing against a configured TSP. v1 ships as instance-wide configuration via environment variables, with per-envelope signature level selection, license gating, and an OAuth-driven signing flow (capture + FIFO signers, SAD session, blocking/in-progress recipient pages). Includes signature level compatibility checks (role, signing order, dictate next signer), envelope mutability assertions, Prisma migration for signature level and CSC tables, and docs for the new signing certificate options.
103 lines
3.7 KiB
Plaintext
103 lines
3.7 KiB
Plaintext
---
|
|
title: Signing Certificate
|
|
description: Configure the X.509 signing certificate used for digital signatures in self-hosted Documenso.
|
|
---
|
|
|
|
import { Tab, Tabs } from 'fumadocs-ui/components/tabs';
|
|
|
|
When a document is completed in Documenso, it is digitally signed using an X.509 certificate. This cryptographic signature provides:
|
|
|
|
- Proof of document authenticity
|
|
- Verification that the document has not been modified since signing
|
|
- Identity information about the signing entity
|
|
|
|
Self-hosted Documenso instances require a signing certificate. You can generate a self-signed certificate or purchase one from a Certificate Authority (CA).
|
|
|
|
<Cards>
|
|
<Card
|
|
title="Local Certificate"
|
|
description="Configure a local .p12 certificate file or base64-encoded contents."
|
|
href="/docs/self-hosting/configuration/signing-certificate/local"
|
|
/>
|
|
<Card
|
|
title="Google Cloud HSM"
|
|
description="Hardware-based key protection with Google Cloud KMS."
|
|
href="/docs/self-hosting/configuration/signing-certificate/google-cloud-hsm"
|
|
/>
|
|
<Card
|
|
title="CSC (AES / QES)"
|
|
description="Route signing through a third-party Trust Service Provider for Advanced and Qualified Electronic Signatures."
|
|
href="/docs/self-hosting/configuration/signing-certificate/csc-qes"
|
|
/>
|
|
<Card
|
|
title="Timestamp Server"
|
|
description="Add trusted timestamps and customise signature appearance."
|
|
href="/docs/self-hosting/configuration/signing-certificate/timestamp-server"
|
|
/>
|
|
<Card
|
|
title="Troubleshooting"
|
|
description="Common certificate errors and solutions."
|
|
href="/docs/self-hosting/configuration/signing-certificate/troubleshooting"
|
|
/>
|
|
</Cards>
|
|
|
|
## Certificate Options
|
|
|
|
<Tabs items={['Self-Signed', 'CA-Issued', 'Google Cloud HSM', 'CSC (AES / QES)']}>
|
|
<Tab value="Self-Signed">
|
|
|
|
A self-signed certificate is sufficient for most use cases where your industry has no special signing regulations.
|
|
|
|
**Advantages:**
|
|
|
|
- Free to create
|
|
- Full control over certificate details
|
|
- Works for internal and business documents
|
|
|
|
**Limitations:**
|
|
|
|
- PDF readers like Adobe Acrobat will not show a green checkmark
|
|
- Not recognized by Adobe's trust list
|
|
- Recipients see a warning that the signature cannot be verified
|
|
|
|
The certificate still includes your organisation details and guarantees document integrity.
|
|
|
|
</Tab>
|
|
<Tab value="CA-Issued">
|
|
|
|
Purchase a certificate from a Certificate Authority if you need:
|
|
|
|
- Green checkmark in Adobe PDF readers
|
|
- Industry-specific compliance requirements
|
|
- Third-party signature validation
|
|
|
|
For Adobe recognition, choose a vendor from the [Adobe Approved Trust List](https://helpx.adobe.com/acrobat/kb/approved-trust-list1.html).
|
|
|
|
</Tab>
|
|
<Tab value="Google Cloud HSM">
|
|
|
|
For organisations requiring hardware-based key protection, Documenso supports Google Cloud HSM. This provides:
|
|
|
|
- FIPS 140-2 Level 3 certified key storage
|
|
- Keys never leave the HSM
|
|
- Audit logging of all cryptographic operations
|
|
|
|
See [Google Cloud HSM](/docs/self-hosting/configuration/signing-certificate/google-cloud-hsm) for setup instructions.
|
|
|
|
</Tab>
|
|
<Tab value="CSC (AES / QES)">
|
|
|
|
For Advanced and Qualified Electronic Signatures under eIDAS, Documenso integrates with third-party Trust Service Providers via the Cloud Signature Consortium API. Each recipient authenticates directly with the TSP, which holds the private key and issues the signature.
|
|
|
|
- Per-recipient identity verification by an accredited TSP
|
|
- Legally equivalent to a handwritten signature within the EU (QES)
|
|
- Requires an [Enterprise Edition](/docs/policies/enterprise-edition) license
|
|
- Instance-wide setting; one CSC provider per Documenso install
|
|
|
|
See [CSC (AES / QES)](/docs/self-hosting/configuration/signing-certificate/csc-qes) for setup instructions.
|
|
|
|
</Tab>
|
|
</Tabs>
|
|
|
|
|