Arch Linux

zekebsatx

Member

Registered: 2016-01-29

Posts: 66

[SOLVED] Digital signature certificate from kmail to okular

Question is related to the KDE/Plasma DE.

I have to digitally sign pdfs for my work. At one time I used a pdf creator to insert a CA CERT onto the document, but it created confusion because it wasn't always in the correct place on the document and it looked 'weird'. Since then, I have to open a virtual Windows machine, open the document in adobe reader, sign and save. This is cumbersome. I see that Okular now has the ability to digitally sign pdfs in the signature field.

I already have a digital signature for my email account in kmail, can I use this same certificate to sign PDFs in Okular?

It appears that I just need to configure the pdf backend in Okular to refer to the directory containing the signature file, but I can't find where kmail stores that.

Last edited by zekebsatx (2024-04-10 19:02:20)

progandy

Member

Registered: 2012-05-17

Posts: 5,203

Re: [SOLVED] Digital signature certificate from kmail to okular

Since then, I have to open a virtual Windows machine, open the document in adobe reader, sign and save.

Do you use a certificate here? I'd suggest you try to use the same in okular.
If you do not use any signature, then the Okular signature might cause the same confusion as the ca cert?

I already have a digital signature for my email account in kmail, can I use this same certificate to sign PDFs in Okular?

If you have an x.509 (S/MIME) certificate, then you should be able to use it. a pgp key will not work.
You might have to export the certificate from your Kleopatra certificate store to a known location. Maybe you can tell okular to use it directly, but I would not know how.
Edit: Poppler/Okular seem to look in the default mozilla firefox profile if you do not specify a custom path: https://man.archlinux.org/man/extra/poppler/pdfsig.1.en

Chromium should use ~/.pki/nssdb/. Even if do not have chromium you could use that directory as your nss database and add you signing certificate with certutil. https://chromium.googlesource.com/chrom … agement.md

Other options to sign your PDF would be https://github.com/MatthiasValvekens/pyHanko and podofosign from the podofo package (I have not found any documentation)

Last edited by progandy (2021-05-21 14:47:44)

---

| alias CUTF='LANG=en_XX.UTF-8@POSIX ' |

zekebsatx

Member

Registered: 2016-01-29

Posts: 66

Re: [SOLVED] Digital signature certificate from kmail to okular

I finally was able to get this to work in Okular.

This Reddit post explained how to do it:
https://www.reddit.com/r/archlinux/comm … &context=3

zekebsatx

Member

Registered: 2016-01-29

Posts: 66

Re: [SOLVED] Digital signature certificate from kmail to okular

No intention of necrobumping this, but after updating to Plasma 6, this no longer works.
I can send my password for the NSS database and draw the signature field, but I get a second popup asking for the cert password (if any). When I enter this the popup box is presented again as if the password is incorrect.  I tried creating a new cert, so I was certain of the password I set, and that also failed.

Is anyone else having trouble signing pdf documents in okular after update?

EDIT: It seems there is a change in the behavior of the new signature dialog in Okular.  I have to actually select the certificate I want to use (even though it already appears to be selected as the only certificate in the database). If I do this it doesn't go into the infinite password loop and proceeds to save the signed pdf as expected.

Last edited by zekebsatx (2024-04-10 19:03:58)