How to get a digital signature in Italy

People who receive .p7m files eventually have to sign as well: an engagement, a tender application, board minutes, a filing toward public administration. A qualified digital signature is not improvised with a scan of a handwritten signature. You obtain it from a qualified provider, after identification. This guide describes the practical choices. It is not a commercial comparison and it does not name a supplier to prefer. The reader on this site does not issue certificates and does not sign in your place.

Who can issue the certificate

In Italy a qualified certificate is issued by qualified trust service providers. The public list is kept by AgID. The same perimeter is visible in the European trusted list under the eIDAS regulation. Before you pay, check that the organisation you buy from appears on that list. Chambers of commerce and resellers may intermediate a release. Even then the qualified certificate remains that of a qualified provider, not of the counter itself.

Names often seen on the market include, among others, operators such as Aruba, InfoCert, Namirial and Poste Italiane. Naming them helps you recognise kinds of offer. It does not rank them. Terms, prices and identification channels change. Read them on the site of the provider you have checked on the list, on the day you buy.

Three ways to keep the key

Form	What it looks like	When it is convenient	What to watch
Smart card and reader	The certificate is on the card	Signing from the same desk	Reader, drivers and a card you do not leave unattended
USB token	Card and reader in a stick	Several computers, always with the device	Loss: revoke at once
Remote signature	The provider holds the key and you authorise with an OTP or an app	Phone and different desks	The phone must be available, and you must read the service terms

Remote signature is not “without a certificate”. The certificate exists, but it is not in an object you plug into USB. Smart cards and tokens remain common also because some national services cards use the same support. Ask the provider whether you also need access to chamber of commerce services or only document signing. Those are different needs, sometimes combined and sometimes not.

Identification

The provider must identify the holder. The most common channels are a counter, a video session with an operator and, when the provider allows it, SPID, the electronic identity card (CIE) or a certificate you already hold. You will need a valid identity document and your tax code. Do not send scans of the document to addresses other than those indicated by the provider you have checked.

At the end you receive the device or the remote-signature credentials, and an expiry date. Renew the certificate before that date. After expiry you cannot apply valid signatures with that certificate. Signatures applied while it was valid are not cancelled merely because, months later, the certificate has expired. That is a different point from revocation. If you suspect unauthorised use, ask for revocation at once. Natural expiry does not protect the days already passed.

Which kind of signature you will be asked for

The provider’s software generally lets you choose between CAdES and PAdES.

• CAdES produces a .p7m. It also covers files that are not PDFs and it is the usual format of many signed invoices.
• PAdES signs inside the PDF. The recipient opens the file with a PDF reader.

There is no format that is right for every sending. A tender, a public body or a court states its own. The practical differences are in CAdES and PAdES. If you must check files before uploading them in a tender, use the checklist in P7M files in public tenders.

Keep the other terms apart as well. A simple electronic signature may be an online consent or a scan, and its weight is assessed in the concrete case. An advanced electronic signature follows stricter rules, for example in some banking processes. A qualified signature is the one based on a qualified certificate and a secure signature device, and it is the type to which European law attaches the effect of a handwritten signature. SPID and CIE are digital identities. Some services let you sign using those identities, under that service’s rules. Do not assume that every “sign with SPID” button is your qualified certificate.

Reading P7M files does not require the signing kit

To open a .p7m you have received, you do not need the token and you do not need the provider’s software. Open Lettore P7M, select the file and read the preview and the checks. The preview is free. A license is needed only to download or export. The reader does not sign, does not renew certificates and does not replace revocation at the issuer.

If a document you signed later shows an unexpected result, separate expiry, revocation and a claimed date with Expired or revoked signature. The reader does not rebuild historical validity from a date written in the attributes, except where verified time evidence allows it, and even then it is not a legal assessment.

How to choose without chasing a slogan

Ask yourself three questions, and stop at the answers of the provider you have checked.

1. Where will you sign over the next three years: one desk, several computers, also the phone?
2. Do you only need to sign documents, or also an authentication certificate for services that require it?
3. How many signatures do you expect, and do you need time stamps? Read the price together with duration, renewal and software, not only the first figure.

Be wary of anyone who promises a signature “without identification” or asks you to install a program that arrived as an attachment. Identification is part of qualified issuance. The signing program is downloaded from the provider, not from a link in an unexpected PEC message.

From the first contact to a reading test

Pick a name from the AgID list, not from an advertisement, and note the date on which you checked the list. Book identification with the documents that provider requires. On the same day do not sign real documents. Wait for the credentials and the manual of the device or of the OTP app.

When the certificate is active, sign a test file, for example a page with the date and the sentence “test document”. If you choose CAdES, you will get a .p7m. Open it in the reader and check that the certificate subject is yours and that integrity is consistent. If you choose PAdES, open the PDF in a PDF reader. This site will not give you a result on that inner signature, and that is not a fault.

Put the expiry on the calendar, four weeks before the date written in the certificate. Also write down the provider’s number to call if the token leaves the office or if the OTP phone is replaced. A reading test on the first day stops you, months later, discovering that you were signing with a certificate in a colleague’s name because the stick had been left plugged in.

Frequently asked questions

Does the P7M reader issue a digital signature?

No. It reads and checks envelopes that are already signed. A qualified certificate is requested from a qualified trust service provider, after identification.

Are SPID and a digital signature the same thing?

No. SPID and CIE identify a person on many online services. A qualified digital signature is a certificate used to sign documents, with the effects the law provides.

How do I check that a provider is qualified?

Check the list published by AgID and the European trusted list. Do not rely only on a trade name or on a banner.

What do I do if I lose the token or the remote-signature phone?

Contact the provider that issued the certificate at once and ask for suspension or revocation. Do not wait for renewal.

After activation

Sign a test document and open it again in the reader, to see how it will appear to the recipient. Keep the expiry in the calendar, with a margin of weeks. If you work in an office, note who keeps the token and who may authorise the remote signature. Reading other people’s files, from that moment, remains the separate gesture described in How to open a P7M file.