How to Digitally Sign a PDF with a CAC Card on Windows 10

To digitally sign a PDF with a CAC (Common Access Card) on Windows 10, plug in a smart card reader, insert your CAC, and open the PDF in Adobe Acrobat Reader. Click the signature field, or choose All tools > Use a certificate > Digitally sign and drag a box where the signature should go. Pick your CAC signing certificate, select Continue and then Sign, save the signed copy under a new name, and enter your CAC PIN when Windows asks for it.

Applies to: Windows 10 22H2 with the current Adobe Acrobat Reader (free) or Acrobat Pro. The same steps work on Windows 11. Keep in mind that Windows 10 support ended on October 14, 2025, and Extended Security Updates for consumers run only through October 12, 2027, so many agencies are moving CAC users to Windows 11.

What you need before you sign

• A CAC reader. A USB smart card reader, or a keyboard or laptop with a built-in smart card slot.
• Your CAC and its PIN. The card must be current. An expired card has expired certificates, and Acrobat won’t sign with them.
• Adobe Acrobat Reader or Acrobat Pro. The free Reader can apply certificate-based signatures, so you don’t need a paid plan just to sign. Download it only from Adobe.
• DoD root and intermediate certificates. These let Windows and Acrobat trust the certificates on your card. DoD users usually get them from their IT team or with the InstallRoot tool published on the DoD Cyber Exchange site. Don’t install root certificates from unofficial download sites.
• Middleware, if your organization requires it. Windows 10 can read many CACs on its own, but some organizations require a specific package such as ActivClient. Install only the one your IT team approves; two competing packages can stop the card from working.

Military and DoD machines usually come with all of this set up. On a personal PC, the reader, certificates and middleware are the parts you’ll have to add yourself.

Which CAC certificate signs documents?

A CAC holds several certificates, and only one of them is meant for signing documents. Acrobat lists every certificate it can find, so knowing the difference saves you from the most common error.

• Signature certificate: the one to use. In its details, Key Usage shows Digital Signature and Non-Repudiation.
• Authentication (identity) certificate: used to log in to websites and networks. Some organizations don’t accept it on signed forms.
• Encryption certificate: used to encrypt email. Its Key Usage shows Key Encipherment, and Acrobat typically refuses to sign with it.

If your unit or agency tells you which certificate to use, follow that rule. Otherwise, check the Key Usage as described in step 4 below.

Step 1: Make sure Windows can read your CAC

Do this once on a new PC or reader. If you already use your CAC to log in to websites on this computer, you can skip to Step 2.

1. Plug the reader into a USB port directly on the PC rather than an unpowered hub, and wait a few seconds for Windows to install its driver.
2. Insert the CAC chip first, with the chip facing the way the reader shows. On most readers, a light turns solid or stops blinking when the card is read.
3. Right-click Start, select Device Manager, and expand Smart card readers. Your reader should appear without a yellow warning icon.
4. Press Windows + R, type certmgr.msc and press Enter. Open Personal > Certificates. You should see certificates issued to your name. Windows’ Certificate Propagation service copies them from the card into this store when you insert it, as Microsoft’s smart card documentation explains.
5. Double-click a certificate, open the Details tab and select Key Usage to see what it’s for. This is how you spot the signature certificate.

If you need more help with this console, see opening Certificate Manager in Windows 10. To list the certificates on the card itself instead, open Command Prompt and run certutil -scinfo. It doesn’t need your PIN; press Esc if a PIN box appears.

Step 2: Sign the PDF in Acrobat Reader

Before you start: make every other change first. Fill in the form fields, add comments and attach anything needed, because editing a PDF after you sign it marks the signature as invalid or changed.

1. Open the PDF in the Acrobat app. Right-click the file in File Explorer and choose Open with > Adobe Acrobat. Don’t sign in a browser tab, an email preview, or Microsoft Edge’s PDF viewer, because they can’t use your CAC certificate. If a yellow Protected View bar appears, select Enable All Features.
2. Start the signature.
   • If the form has a signature field (usually a box with a red tab or a “Click to sign” label), click it.
   • If there’s no field, select All tools, then Use a certificate (you may need to select View more to find it), then Digitally sign. Acrobat asks you to drag a rectangle; draw it where the signature should appear.

3. Pick your digital ID. A window lists the digital IDs Acrobat can see, with the name, issuer and expiration date of each. With your CAC inserted, your certificates appear here.
4. Choose the signing certificate. Select the one whose details show Digital Signature and Non-Repudiation (use View details if you’re unsure), then select Continue.

5. Review the appearance. Acrobat previews how the signature will look, normally your name, the date and a distinguished-name line from the certificate. You can select Create to add a typed name or a signature image to the appearance. If the form tells you to, check Lock document after signing; leave it unchecked if other people still need to fill in fields.
6. Select Sign. Acrobat opens a Save As window.
7. Save a new copy. Give it a clear name such as Leave-Request-Jordan-Signed.pdf and save it. Saving under a new name keeps your unsigned original in case you need to fix something.
8. Enter your CAC PIN. A Windows Security box asks for the smart card PIN. Type it and select OK. The CAC must stay in the reader until the signature appears.

When it works, your signature appears in the box with the date and time, and a blue bar at the top says the document is signed. If a second person needs to sign, send them the signed copy; each signer adds their own signature to their own field in turn.

If your Acrobat menus look different

Adobe redesigned Acrobat’s interface, and you may still see the older layout on a managed PC. In that version, choose Tools > Certificates > Open, then select Digitally Sign in the toolbar that appears. Everything after that (drawing the box, choosing the certificate, signing, saving and entering the PIN) works the same way.

Preferences moved too. In the new layout, select Menu > Preferences; in the older one, choose Edit > Preferences. Adobe’s help page on adding digital signatures in Acrobat covers both the signing tool and appearance options.

If Acrobat doesn’t list your CAC certificates

When Windows shows your certificates in certmgr.msc but the Acrobat list is empty, point Acrobat to them.

1. Close the PDF, reinsert the CAC, and wait for the reader light to settle.
2. In Acrobat, open Menu > Preferences and select Signatures in the left pane.
3. Next to Identities & Trusted Certificates, select More.
4. Under Digital IDs, select Windows Digital IDs. Your CAC certificates should be listed. If your organization uses middleware that works through a PKCS#11 module, check PKCS#11 Modules and Tokens instead; IT may need to attach the module.
5. To stop Acrobat offering the wrong certificate, select your signature certificate, choose Usage Options and select Use for Signing.
6. Close the dialog, restart Acrobat, and try signing again.

Check the signature and fix mistakes

Open the signed copy and select the signature (or open the Signatures panel from the right side) to see its status.

• Valid: Acrobat trusts your certificate and the document hasn’t changed since you signed it.
• Validity unknown: the signature is fine, but this computer doesn’t trust the DoD certificate chain. This is common when a recipient outside DoD opens the file. Installing the DoD root certificates on that computer fixes it.
• Invalid or “document has been modified”: something changed after signing, or the certificate was expired or revoked when you signed.

To see the details, right-click the signature, choose Show Signature Properties and then Show Signer’s Certificate. You’ll see who signed, who issued the certificate and when it expires.

There’s no clean way to undo a signature in a saved file, which is why you saved a copy. If you signed the wrong document or need to change a field, delete the signed copy, reopen the unsigned original, make your changes and sign again.

Other ways to sign, and when they don’t count

Not every “signature” in a PDF is a CAC digital signature. Pick the method based on what the person asking for it requires.

• Acrobat’s Fill & Sign or a drawn signature in Edge. These place an image of your name on the page. They’re fine for informal forms but don’t use your certificate and won’t satisfy a form that asks for a CAC or “digital” signature. For that kind of quick signature, see typing on and signing a PDF in Windows 10.
• Other desktop PDF editors. Several commercial PDF apps can also sign with a smart card certificate. Use one only if your organization has approved it, and check that recipients can validate the result.
• Online PDF signing websites. A website can’t use the private key on your CAC the way a desktop app does, so these sites produce ordinary electronic signatures, not CAC signatures. They also mean uploading the document, which many government forms forbid.
• Word documents. If the file is a .docx instead of a PDF, Word can sign it with the same CAC certificate. The steps are in inserting a digital signature in Word.

Troubleshooting

“The selected digital ID cannot be used to sign”

You picked the encryption certificate. Start again and choose the certificate whose Key Usage lists Digital Signature and Non-Repudiation.

Digitally sign or the signature field is grayed out

The PDF may have security settings that block signing, may already be locked by an earlier signature, or may be open in Protected View or a browser. Open it in the Acrobat app and enable all features. If the file itself restricts signing, ask the sender for a signable copy rather than trying to bypass the restriction.

No PIN prompt appears

The Windows Security PIN box sometimes opens behind Acrobat. Press Alt + Tab to look for it. If it isn’t there, close Acrobat, remove and reinsert the CAC, and sign again.

The reader or card isn’t detected

Try another USB port, then check Device Manager > Smart card readers. If the reader is missing, select Action > Scan for hardware changes. Also open services.msc and make sure Smart Card is running; Microsoft’s smart card troubleshooting page lists the commands IT staff use to check and restart it. Some readers need a driver from the manufacturer’s own site.

The signature shows as invalid for everyone

Check that your PC’s date, time and time zone are correct, and that your CAC hasn’t expired. A wrong system clock can make a valid certificate look expired or not yet valid.

The PIN is rejected

Check that Caps Lock and Num Lock are set the way you expect, and type slowly. Stop after a second failure: a CAC locks after a small number of wrong attempts, and a locked card has to be unlocked or reset by your ID card office or local security office.

Acrobat can’t save the signed file

Save to a different folder, such as Documents, with a new name. Files in email attachments, network shares with read-only access, or folders synced by another app can block the save.

FAQ

What is a CAC?

The Common Access Card is the Department of Defense smart ID card for active-duty service members, Selected Reserve members, DoD civilians and eligible contractors, according to the DoD ID Card Reference Center. Its chip stores the certificates used to log in, encrypt email and sign documents.

Do I need Acrobat Pro to sign with a CAC?

No. The free Acrobat Reader can sign PDFs with a certificate from your CAC. Pro adds tools for preparing forms, such as adding your own signature fields, certifying documents and editing text.

Does signing with a CAC need an internet connection?

The signature itself is created on your PC with the card, so you can sign offline. Acrobat may go online to check whether certificates have been revoked when it validates a signature, so a recipient’s status check can depend on their connection.

Can I sign the same PDF more than once?

Yes. Several people can sign one PDF, each in their own field and each with their own CAC. Sign in the order the form expects, and don’t leave the “lock document” option on if someone still has to sign.

Is a password-protected PDF the same as a signed one?

No. A signature proves who approved the file and shows whether it changed; a password controls who can open it. If you need both, here’s how to password protect a PDF in Windows 10, then confirm the signature still shows as valid.

Will these steps work on Windows 11?

Yes. Acrobat’s menus are the same, and the reader, certificate and middleware setup is the same idea. The main difference is that Windows 11 still gets regular security updates.

Once your first signature shows as valid, the setup is done. Next time, insert the card, open the PDF in Acrobat, and you can sign in a few clicks.