Help

How to sign a PDF with the DNIe on a Mac

Guide updated: 21 August 2026 · by David Pelayo (nexoapex)

Two completely different things get called "signing a PDF". One is drawing your mark on top of the document, which is what Preview does. The other is signing it electronically with your DNIe's certificate, which is what Spanish public bodies ask for. This guide explains the difference, and the three real ways to do the second one on a Mac.

Preview's signature is not an electronic signature

Preview has a signature tool in its markup bar, and it does its job well. Apple documents three ways to create the signature: writing it on the trackpad with your finger, holding a signed sheet of paper up to the camera, or signing on a nearby iPhone or iPad. In all three cases the result is the same: an image of your handwriting placed over the PDF.

That image has no certificate behind it. It proves nothing about who put it there, it is not bound to the content of the document, and it does not break if somebody edits the PDF afterwards. It is fine for returning a form to an accountant, or for a private agreement where both sides are happy with it. It is not enough when the administration asks for an electronic signature: there, the document itself has to carry a cryptographic signature made with your certificate.

What actually happens when you sign with the DNIe

Your DNIe holds two separate certificates on the chip. The authentication one signs you in to an e-government portal; the signing one signs documents. Spain's Tax Agency states it plainly in its technical checks: you have to select the signing certificate, not the authentication one. Mixing them up is one of the most common reasons signing "doesn't work".

When you sign, the private key never leaves the card. The Mac sends the chip a digest of the document, the chip signs it internally once you type the PIN, and returns the signature. That is why a physical reader is required, and why three wrong PINs in a row block the card.

The signature is then packaged in one of the three European standard formats, all of them in the glossary: PAdES if you are signing a PDF and want it to stay an ordinary PDF, CAdES for any kind of file, and XAdES for XML documents. On top of that you can add an RFC-3161 timestamp, which proves the date and time to a third party: without one, the date of the signature is only whatever your Mac's clock said.

And there is a deadline worth remembering: DNIe certificates expire after two years. That is not a convention, it is the rule — Royal Decree 255/2025, which regulates the national ID, sets it in article 11.3. With expired certificates you can still read your data, but not sign. They are renewed free and without an appointment at a DNIe Update Point: the guide to a blocked PIN or expired certificates covers the process.

The three ways to sign a PDF with the DNIe on a Mac

The AutoFirma and Acrobat Reader rows summarise their public function; for everything else, check the official sources, firmaelectronica.gob.es and Adobe's documentation.

With DNIe for Mac, step by step

1. Connect the USB contact reader and insert the DNIe chip-side up. macOS recognises any CCID reader with nothing to install; if you are unsure about yours, see the card reader guide.
2. Open the app and drag in the PDF you want to sign.
3. Choose PAdES if you want the file to remain a PDF anyone can open, and decide whether the signature is visible in the document or only embedded.
4. Type the PIN when the app asks. The chip signs; the key never leaves the card.
5. Save the result. The app adds the RFC-3161 timestamp, and you can validate the file right there, locally.

Signing and validating are free and never expire in DNIe for Mac — there is no trial period counting down on them. See how it works or get it on your Mac.

With AutoFirma

AutoFirma is the Spanish government's official application, and for many procedures it is not optional: the e-government portal itself invokes it from the browser. Download it only from firmaelectronica.gob.es, which publishes separate macOS builds for Intel and for Apple Silicon — installing the wrong one is a classic source of trouble.

To sign a PDF yourself: open AutoFirma, pick the file, select the signature format, choose the DNIe's signing certificate in the dialog, and type the PIN.

If AutoFirma never gets as far as showing you the certificate, it is almost never the DNIe's fault. The twelve usual causes —Gatekeeper, the reader, Java, Rosetta, error SAF_45— are broken down in the AutoFirma on Mac guide. There is also a known, open problem on recent macOS releases: on AutoFirma 1.9.2 running on macOS 26.4.1 on Apple Silicon, some users find the app lists no Keychain certificates at all and answers "No habia certificados validos en el almacen del usuario", even though the certificates are correctly installed and work in Safari. It is documented in issue 520 of AutoFirma's official repository, opened in May 2026 and unresolved as this guide went out.

With Adobe Acrobat Reader

Acrobat Reader signs PDFs with a certificate, and it is the route many people already have to hand. It needs the certificate to be visible to the application: the DNIe's arrive through macOS's smart-card subsystem or through a PKCS#11 module — the same kind of module you need to use the DNIe in Firefox. To sign, choose "Digitally sign", select the DNIe's signing certificate, draw the box where the signature should appear, and type the PIN.

Bear in mind that Acrobat Reader signs in PAdES, and PDFs only. If the procedure asks for CAdES or XAdES, you need one of the two options above.

How to check the signature is valid

A visible mark on the PDF does not mean the signature is valid. There are two ways to actually check.

• VALIDe, the Spanish government's validation service: at valide.redsara.es, the "Validar Firma" option tells you whether the signature is intact, which certificate produced it and whether it was valid. The same service offers "Validar Certificado", "Realizar Firma", "Visualizar Firma" and "Validar Sede Electrónica".
• Locally, with DNIe for Mac: validation checks integrity, chain of trust, OCSP revocation and the timestamp without the document leaving your machine. That is the difference that matters when what you are validating is a payslip, a deed or a contract.

Common signing errors

• "The certificate doesn't appear." Check first that you picked the signing certificate and not the authentication one, then that they have not expired: two years go quickly.
• "It won't accept my PIN." Three failed attempts block the card, and the DNIe has no PUK: it can only be unblocked in person, at a PAD. The blocked PIN guide explains the process.
• The Mac cannot see the reader. Usually an unpowered USB-C hub. Check the reader guide.
• You signed with the wrong certificate. The signature exists, but the body rejects it. Sign the original again with the signing certificate.
• The signature date looks wrong. Without a timestamp, the date is whatever your Mac's clock said. Turn on timestamping if the procedure has a deadline.

Frequently asked questions