/usr/bin/pdfsig

pdfsig version 26.11.0
Copyright 2005-2026 The Poppler Developers - http://poppler.freedesktop.org
Copyright 1996-2011, 2022 Glyph & Cog, LLC
Usage: pdfsig [options] <PDF-file> [<output-file>]
  -nssdir <string>                  : path to directory of libnss3 database
  -nss-pwd <string>                 : password to access the NSS database (if any)
  -nss-pwds <int> <string>...       : passwords to access named NSS stores (if any)
  -nocert                           : don't perform certificate validation
  -no-ocsp                          : don't perform online OCSP certificate revocation check
  -no-appearance                    : don't add appearance information when signing existing fields
  -aia                              : use Authority Information Access (AIA) extension for certificate fetching
  -assert-signer <string>           : This option checks whether the signature covering the full document been made with the specified key. The key is either specified as a fingerprint or a file listing fingerprints. The fingerprint must be given or listed in compact format (no colons or spaces in between). If fpr_or_file specifies a file, empty lines are ignored as well as all lines starting with a hash sign. Only available for GnuPG backend.
  -dump                             : dump all signatures into current directory
  -add-signature                    : adds a new signature to the document
  -new-signature-field-name <string>: field name used for the newly added signature. A random ID will be used if empty
  -sign <string>                    : sign the document in the given signature field (by name or number)
  -etsi-cades-b                     : create a signature of type ETSI.CAdES.detached type B instead of adbe.pkcs7.detached
  -backend <string>                 : use given backend for signing/verification
  -enable-pgp                       : Enable pgp signatures in the GnuPG backend. Only available for GnuPG backend
  -nick <string>                    : use the certificate with the given nickname/fingerprint for signing
  -kpw <string>                     : password for the signing key (might be missing if the key isn't password protected)
  -digest <string>                  : name of the digest algorithm (default: SHA256)
  -reason <string>                  : reason for signing (default: no reason given)
  -list-nicks                       : list available nicknames in the NSS database
  -list-backends                    : print cryptographic signature backends
  -opw <string>                     : owner password (for encrypted files)
  -upw <string>                     : user password (for encrypted files)
  -v                                : print copyright and version info
  -h                                : print usage information
  -help                             : print usage information
  --help                            : print usage information
  -?                                : print usage information