Sign with your own digital certificate

If you already hold a digital certificate of your own — the one the Portuguese Bar Association (Ordem dos Advogados) issues to lawyers is the most common case — you can sign with it in AssinaJá. In the application this method is called Local Digital Certificate.

The sender chooses the method. If the zone you have to sign reads Local Digital Certificate, this is your path; if it reads CMD, see Qualified signatures with CMD.

Before you start

You need three things, all on the same computer:

• The certificate. It can be installed in Windows — which is what the Bar Association’s manual tells you to do with the .p12 —, in a .p12 or .pfx file, or on a card connected to the computer.
• The AssinaJá certificate app and the AssinaJá extension in your browser. See Install the AssinaJá certificate app.
• A computer. This method does not work on a phone.

Sign

The wizard has four steps: Certificate, Confirmation, Processing and Completion.

1. Certificate

Choose the certificate you will sign with. The list shows the certificates installed on this computer, including those on connected cards.

Under Available certificates, each certificate shows its holder, Issued by and Valid until. The one issued to the invitation email comes first, marked Issued to that email.

If the certificate is in a file, press Open file from disk:

The AssinaJá app opens the file and asks for the password in its own window — the password never goes through this page.

Why a certificate is greyed out

A certificate that cannot be used for this signature still appears in the list, but cannot be chosen. Below it, it says why:

Notice	What it means
“Expired on …”	Out of date — renew it with the issuing authority.
“Only valid from …”	Not valid yet.
“Uses a key type that is not supported yet (RSA only).”	Only RSA certificates are accepted.
“This certificate does not allow signing documents — choose your signing certificate.”	It is an authentication certificate. The Citizen Card, for example, carries both.
“Issued to another email — this document is for …”	The certificate belongs to another person or another email.
“This certificate could not be read.”	Choose another.
:::

If the list is empty:

We found no certificates installed on this computer. If your certificate is in a .p12 or .pfx file, open it from disk.

2. Confirmation

Confirm the certificate you will sign with. The summary shows Holder, Issuer, Email, Identification number (if the certificate has one), Validity, Document and Signature level — Advanced (AES).

When you click “Sign”, the AssinaJá app shows a window with this certificate and the document name and asks for your password or PIN. A signature cannot be undone.

Press Sign, or Choose another to go back to step 1.

3. Processing

The page shows Signing with your certificate and waits:

Confirm the signature in the AssinaJá app window and, if asked, enter the file password or the card PIN. Do not close this page.

The app window is titled Sign with your certificate. It shows the address asking for the signature, the document, the certificate and the issuer. Check them and press Sign. If the certificate is on a card, “Your system may ask for the card PIN next.”

Only sign what you asked for

The window ends with “Only sign if you asked for this signature on AssinaJá.” The button selected by default is Cancel. If you press Cancel, nothing is signed:

The signature was cancelled in the AssinaJá app. Nothing was signed — you can choose the certificate and sign again.

4. Completion

The signature is recorded. In the document history it appears as:

{name} ({email}) signed the document with a Local Digital Certificate (Advanced Electronic Signature).

What AssinaJá checks

Your certificate’s key never leaves your computer. AssinaJá sends the app only the digest (hash) of the document held on the server, the app signs that digest, and the server applies the signature to its own copy.

Before accepting it, the server checks the certificate:

• The issuer is recognised. AssinaJá keeps a list of certification authorities it trusts, built from the Portuguese Trusted List. A certificate from an authority outside the list is refused.
• The certificate has not been revoked. If the issuer’s service does not answer, the signature is refused, not accepted blindly.
• It is a signing certificate, valid on the day, with an RSA key.
• It is yours. If the certificate carries an email different from the invitation email, it is refused. If it carries an identity document number, the recipient has a number on record, and the two differ, it is refused too. If it carries neither, it is accepted, and the holder is recorded in the evidence.

Messages you may see

While signing:

Message	What to do
“The file password is wrong. Open the file again and use the password you received with the certificate.”	Open the file again. The password window says how many attempts are left.
“This certificate has no private key on this computer. Open the complete .p12/.pfx file or choose the certificate installed with its key.”	The certificate was installed without its key. Use the original .p12/.pfx file.
“The AssinaJá app could not sign — the card was removed, the PIN is blocked or the certificate failed. Check the card or certificate and try again.”	Check the card and the PIN.
“The AssinaJá app window got no answer for 2 minutes. Try again and confirm the signature in that window.”	Try again, and answer the app window when it opens.
“Another signer is completing a signature on this document. Try again in a few minutes.”	Wait and try again.
“The connection to the AssinaJá app was reopened. Choose the certificate again.”	Go back to step 1.

When the server refuses the certificate:

Message	What to do
“The certificate was not issued by an authority recognised by AssinaJá. Choose a certificate issued by a recognised certification authority.”	Use another certificate, or ask the sender for another method.
“The certificate was revoked by its issuing authority. Choose another certificate or request a new one from the issuing authority.”	The certificate has been cancelled.
“We could not confirm whether the certificate has been revoked. Please try again later.”	The issuer’s service did not answer.
“The certificate belongs to an email address other than the one invited to sign. Choose the certificate issued to the invitation email.”	If your certificate was issued to another email, ask the sender to send the document to that address.
“The document number on the certificate does not match that of the invited signer. Choose the certificate issued in your name.”	The same, for the identification number.
“The chosen method does not match the signature type required for this zone.”	Contact whoever sent you the document.

If the wizard cannot find the extension or the app, it says which one is missing and shows Install the AssinaJá app. See If it does not work.

What this signature is worth

It is an Advanced Electronic Signature (AES), with Substantial identity verification. It is always advanced, even if your certificate is qualified or sits on a card.

The reason is the one the Bar Association itself gives about its certificate: the key lives in a file the holder can download again, not in a qualified device under their sole control. If you need a signature equivalent to a handwritten one, use the Chave Móvel Digital.

What AssinaJá adds to Acrobat

A PDF signed in Acrobat with the Bar Association certificate often shows its signature validity as unknown to whoever receives it, because Adobe does not know the issuer. Here, the certificate chain and the proof that it was not revoked go inside the PDF, under the platform seal.

On a phone

On a phone or tablet, the wizard says:

Signing with a digital certificate is not possible on this device

Signing with a Local Digital Certificate needs the AssinaJá app on a Windows computer. Open this document on the computer where your certificate is.

If the document also lets you sign with Chave Móvel Digital, Sign with Chave Móvel Digital appears.

Related

• Install the AssinaJá certificate app
• Sign a document
• Signature levels