I am at a loss. I want to create a self-signed certificate to sign PDFs with Okular. I have not found any step-by-step directions that work. I tried creating and installing a certificate, but Okular did not recognize it. This was couple weeks ago, so I am hazy on the details.

Background: I am aware that a self-signed certificate does not really mean much. But at my university people on Windows routinely sign PDFs with Adobe with meaningless certificates, and I want to be able to do the same. So what matters here is not data security, but being able to do what the local bureaucrats accept.

  • 1
    Install xca, it will make things far easier. Basic all you do is crate a root cert, then sign it with itself. Then optionally use that to sign an intermediate, then finally create a user cert and sign that with the root or intermediate. Things to watch out for, root & intermediate must have the CA box ticked, and for the end cert you have to select some additional usage options, except that I cannot tell you what as my system is broken. But really, install xca, you won't look back. Poor instructions, hence comment. Commented Nov 23, 2021 at 18:56
  • 1
    This is the best blog I've found. It helps with self signed (my experience) as well as third party. Commented Dec 21, 2022 at 6:07

3 Answers 3


Following @Bib's comment I did the following:

  1. Installed XCA
  2. Created a new certificate database and password for the database
  3. Created a certificate valid for digital signing only
  4. Exported it as a .p12-file.
  5. Imported the .p12-file into Firefox (the default key location for Okular)
  6. Activated the certificate (Okular - Backends - PDF) in Okular

Now it works on Okular like intended.


The answer from @gaussian worked, but I needed to figure out a few more details that don't fit in a comment:

  • In (2), I used the default filename XCADatabase.xdb from some other tutorial.

  • In (3), I don't know how to configure for "digital signing only", but the defaults seemed to work.

  • Also in (3), I didn't fill in enough fields the first time, and my signature showed as "Not Available", so I made another one and put my name/email in almost every field.

  • In (4), the linux extension for this format seems to be .pfx instead of .p12 (stated in this other tutorial) and that worked for me.

  • In (5), import through Settings -> Certificates -> View Certificates -> Your Certificates tab.

  • In (6) make sure the correct profile directory is activated. I had to change from what Okular had selected because I'm using the flatpak version of firefox. Find the profile directory in Firefox via Help -> More Troubleshooting information -> Profile directory.

  • Thanks a lot for these additional comments! I managed to import a certificate (.p12-file) in my firefox, but I still struggle to use it with Okular. Could you please specify what you mean by 'I had to change from what Okular had selected'? Does it mean that in Okular under settings -> configure Backends -> pdf -> certificate database you switch from 'default' to costum and insert the 'profile directory' that one finds as you described? If so, that does not work for me.
    – Olmo
    Commented Sep 27, 2023 at 7:44
  • Yes, I meant putting that profile directory into Okular -> Backends -> PDF -> Certificate Database. I'm sorry it didn't work for you; I don't know what the issue might be.
    – Niles
    Commented Nov 13, 2023 at 11:08

I was unable to get this to work. Carried out the steps 1-5 of AdminBee above, but when I restart Okular and go to Backends - PDF, the just created .p12 certificate does not appear.

I'm stumped. What am I doing wrong?


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .