# Sign PDF Documents with PFX Certificates from Azure Key Vault in .NET C# > This article shows how to sign PDF documents with PFX certificates from Azure Key Vault in .NET C#. The sample code shows how to load a certificate from Azure Key Vault and how to sign a PDF document with that certificate. - **Author:** Bjoern Meyer - **Published:** 2025-01-07 - **Modified:** 2025-11-16 - **Description:** This article shows how to sign PDF documents with PFX certificates from Azure Key Vault in .NET C#. The sample code shows how to load a certificate from Azure Key Vault and how to sign a PDF document with that certificate. - **4 min read** (722 words) - **Tags:** - ASP.NET - ASP.NET Core - Azure - PDF - Key Vault - **Web URL:** https://www.textcontrol.com/blog/2025/01/07/sign-pdf-documents-with-pfx-certificates-from-azure-key-vault-in-net-c-sharp/ - **LLMs URL:** https://www.textcontrol.com/blog/2025/01/07/sign-pdf-documents-with-pfx-certificates-from-azure-key-vault-in-net-c-sharp/llms.txt - **LLMs-Full URL:** https://www.textcontrol.com/blog/2025/01/07/sign-pdf-documents-with-pfx-certificates-from-azure-key-vault-in-net-c-sharp/llms-full.txt --- Azure Key Vault is a cloud service provided by Microsoft Azure for securely storing and accessing sensitive information such as API keys, passwords, certificates, and cryptographic keys. It provides strong protection for data at rest and in transit by acting as a central vault for managing secrets and cryptographic operations. Azure Key Vault provides several key benefits for signing PDF documents with PFX certificates. Most importantly, it increases security by storing sensitive certificates in a centralized, highly secure environment, eliminating the risk of exposure on local devices or servers. Private keys never leave the vault because cryptographic operations are performed inside the vault. This approach simplifies certificate management and allows organizations to centralize and streamline key rotation, revocation, and auditing. Azure Key Vault also provides scalability to seamlessly meet the needs of growing applications while maintaining high availability and robust performance. Compliance is another key benefit, as the service helps meet stringent industry standards and regulations such as GDPR, HIPAA, and PCI DSS, ensuring data protection and privacy. These benefits combine to provide a secure, reliable, and cost-effective way to manage certificates for PDF signing and other cryptographic operations. ### PFX Certificate in Azure Key Vault This article shows how to use a PFX certificate stored in Azure Key Vault to sign a PDF document. The following screenshot shows the Azure Key Vault portal with a PFX certificate uploaded: ![Azure Key Vault Portal](https://s1-www.textcontrol.com/assets/dist/blog/2025/01/07/a/assets/vault1.webp "Azure Key Vault Portal") ### Azure SDK The following NuGet packages are required for Azure: - Azure.Identity - Azure.Security.KeyVault.Certificates - TXTextControl.TextControl.ASP.SDK ![Azure Key Vault Portal](https://s1-www.textcontrol.com/assets/dist/blog/2025/01/07/a/assets/nuget.webp "Azure Key Vault Portal") ### Uploading a PFX Certificate to Azure Key Vault The following code shows one way to upload a local PFX file to Azure Key Vault, although this article should not focus on how to upload the certificates. You can also upload the certificates to the portal if you have the appropriate user access rights. ``` using System; using System.Security.Cryptography.X509Certificates; using Azure.Identity; using Azure.Security.KeyVault.Certificates; string keyVaultUrl = "https://txtestvault.vault.azure.net/"; string certificateName = "txselfcert"; string password = "123"; // Create a CertificateClient using DefaultAzureCredential for authentication var credential = new DefaultAzureCredential(true); var client = new CertificateClient(new Uri(keyVaultUrl), credential); // Read the PFX file into a byte array byte[] pfxBytes = await File.ReadAllBytesAsync("certificate.pfx"); // Import the certificate into Key Vault var importOptions = new ImportCertificateOptions(certificateName, pfxBytes) { Password = password }; var importedCertificate = await client.ImportCertificateAsync(importOptions); Console.WriteLine($"Certificate '{certificateName}' imported successfully."); ``` ### Signing a PDF Document After uploading the PFX certificate to Azure Key Vault, you can use the Azure SDK to access the certificate and sign a PDF document. The following code snippet demonstrates how to sign a PDF document using a PFX certificate stored in Azure Key Vault: ``` using System; using System.Security.Cryptography.X509Certificates; using Azure.Identity; using Azure.Security.KeyVault.Certificates; using TXTextControl; string keyVaultUrl = "https://txtestvault.vault.azure.net/"; string certificateName = "txselfcert"; // Create a CertificateClient using DefaultAzureCredential for authentication var credential = new DefaultAzureCredential(true); var client = new CertificateClient(new Uri(keyVaultUrl), credential); // Retrieve the certificate from the Azure Key Vault var certificateWithPolicy = client.GetCertificate(certificateName); byte[] pfxBytes = certificateWithPolicy.Value.Cer; // Extract the certificate's byte array // Load the certificate into an X509Certificate2 object for digital signature purposes var cert = new X509Certificate2(pfxBytes, (string)null, X509KeyStorageFlags.PersistKeySet); // Initialize TXTextControl to create and save a document with the digital signature using (var tx = new ServerTextControl()) { tx.Create(); tx.Text = "Hello, World!"; // Prepare the digital signature for the document var saveSettings = new SaveSettings { DigitalSignature = new DigitalSignature(cert, null) }; // Save the document as a PDF with the digital signature tx.Save("result.pdf", StreamType.AdobePDF, saveSettings); } Console.WriteLine("PDF saved with digital signature."); ``` When you open the created PDF document in Acrobat Reader, you can see the valid certificate in the *Signatures* panel. ![Signed PDF Document](https://s1-www.textcontrol.com/assets/dist/blog/2025/01/07/a/assets/result.webp "Signed PDF Document") ### Conclusion Using Azure Key Vault to store PFX certificates for PDF signing provides a secure, scalable, and compliant solution for managing sensitive cryptographic operations. By using Azure Key Vault, organizations can increase security, simplify certificate management, and ensure compliance with industry standards and regulations. --- ## About Bjoern Meyer As CEO, Bjoern is the visionary behind our strategic direction and business development, bridging the gap between our customers and engineering teams. His deep passion for coding and web technologies drives the creation of innovative products. If you're at a tech conference, be sure to stop by our booth - you'll most likely meet Bjoern in person. With an advanced graduate degree (Dipl. Inf.) in Computer Science, specializing in AI, from the University of Bremen, Bjoern brings significant expertise to his role. In his spare time, Bjoern enjoys running, paragliding, mountain biking, and playing the piano. - [LinkedIn](https://www.linkedin.com/in/bjoernmeyer/) - [X](https://x.com/txbjoern) - [GitHub](https://github.com/bjoerntx) --- ## Related Posts - [Deploying the TX Text Control Document Editor from the Private NuGet Feed to Azure App Services (Linux and Windows)](https://www.textcontrol.com/blog/2026/03/25/deploying-the-tx-text-control-document-editor-from-the-private-nuget-feed-to-azure-app-services-linux-and-windows/llms.txt) - [Why Structured E-Invoices Still Need Tamper Protection using C# and .NET](https://www.textcontrol.com/blog/2026/03/24/why-structured-e-invoices-still-need-tamper-protection-using-csharp-and-dotnet/llms.txt) - [Create Fillable PDFs from HTML Forms in C# ASP.NET Core Using a WYSIWYG Template](https://www.textcontrol.com/blog/2026/03/17/create-fillable-pdfs-from-html-forms-in-csharp-aspnet-core-using-a-wysiwyg-template/llms.txt) - [Why HTML to PDF Conversion is Often the Wrong Choice for Business Documents in C# .NET](https://www.textcontrol.com/blog/2026/03/13/why-html-to-pdf-conversion-is-often-the-wrong-choice-for-business-documents-in-csharp-dot-net/llms.txt) - [A Complete Guide to Converting Markdown to PDF in .NET C#](https://www.textcontrol.com/blog/2026/01/07/a-complete-guide-to-converting-markdown-to-pdf-in-dotnet-csharp/llms.txt) - [Why PDF Creation Belongs at the End of the Business Process](https://www.textcontrol.com/blog/2026/01/02/why-pdf-creation-belongs-at-the-end-of-the-business-process/llms.txt) - [Designing the Perfect PDF Form with TX Text Control in .NET C#](https://www.textcontrol.com/blog/2025/12/16/designing-the-perfect-pdf-form-with-tx-text-control-in-dotnet-csharp/llms.txt) - [Why Defining MIME Types for PDF/A Attachments Is Essential](https://www.textcontrol.com/blog/2025/12/10/why-defining-mime-types-for-pdfa-attachments-is-essential/llms.txt) - [Validate Digital Signatures and the Integrity of PDF Documents in C# .NET](https://www.textcontrol.com/blog/2025/11/14/validate-digital-signatures-and-the-integrity-of-pdf-documents-in-csharp-dotnet/llms.txt) - [Validate PDF/UA Documents and Verify Electronic Signatures in C# .NET](https://www.textcontrol.com/blog/2025/11/13/validate-pdf-ua-documents-and-verify-electronic-signatures-in-csharp-dotnet/llms.txt) - [How To Choose the Right C# PDF Generation Library: Developer Checklist](https://www.textcontrol.com/blog/2025/11/12/how-to-choose-the-right-csharp-pdf-generation-library-developer-checklist/llms.txt) - [Why Digitally Signing your PDFs is the Only Reliable Way to Prevent Tampering](https://www.textcontrol.com/blog/2025/10/30/why-digitally-signing-your-pdfs-is-the-only-reliable-way-to-prevent-tampering/llms.txt) - [Automating PDF/UA Accessibility with AI: Describing DOCX Documents Using TX Text Control and LLMs](https://www.textcontrol.com/blog/2025/10/16/automating-pdf-ua-accessibility-with-ai-describing-docx-documents-using-tx-text-control-and-llms/llms.txt) - [Converting Office Open XML (DOCX) to PDF in Java](https://www.textcontrol.com/blog/2025/10/14/converting-office-open-xml-docx-to-pdf-in-java/llms.txt) - [Extending DS Server with Custom Digital Signature APIs](https://www.textcontrol.com/blog/2025/10/09/extending-ds-server-with-custom-digital-signature-apis/llms.txt) - [Why PDF/UA and PDF/A-3a Matter: Accessibility, Archiving, and Legal Compliance](https://www.textcontrol.com/blog/2025/10/07/why-pdf-ua-and-pdf-a-3a-matter-accessibility-archiving-and-legal-compliance/llms.txt) - [Convert Markdown to PDF in a Console Application on Linux and Windows](https://www.textcontrol.com/blog/2025/09/23/convert-markdown-to-pdf-in-a-console-application-on-linux-and-windows/llms.txt) - [Mining PDFs with Regex in C#: Practical Patterns, Tips, and Ideas](https://www.textcontrol.com/blog/2025/08/12/mining-pdfs-with-regex-in-csharp-practical-patterns-tips-and-ideas/llms.txt) - [Streamline Data Collection with Embedded Forms in C# .NET](https://www.textcontrol.com/blog/2025/08/02/streamline-data-collection-with-embedded-forms-in-csharp-dotnet/llms.txt) - [Adding QR Codes to PDF Documents in C# .NET](https://www.textcontrol.com/blog/2025/07/15/adding-qr-codes-to-pdf-documents-in-csharp-dotnet/llms.txt) - [Adding SVG Graphics to PDF Documents in C# .NET](https://www.textcontrol.com/blog/2025/07/08/adding-svg-graphics-to-pdf-documents-in-csharp-dotnet/llms.txt) - [Enhancing PDF Searchability in Large Repositories by Adding and Reading Keywords Using C# .NET](https://www.textcontrol.com/blog/2025/06/24/enhancing-pdf-searchability-in-large-repositories-by-adding-and-reading-keywords-using-csharp-dotnet/llms.txt) - [How to Verify PDF Encryption Programmatically in C# .NET](https://www.textcontrol.com/blog/2025/06/20/how-to-verify-pdf-encryption-programmatically-in-csharp-dotnet/llms.txt) - [PDF Security for C# Developers: Encryption and Permissions in .NET](https://www.textcontrol.com/blog/2025/06/16/pdf-security-for-csharp-developers-encryption-and-permissions-in-dotnet/llms.txt) - [Add JavaScript to PDFs with TX Text Control in C# .NET: Time-Based Alerts Made Easy](https://www.textcontrol.com/blog/2025/06/13/add-javascript-to-pdfs-with-tx-text-control-in-c-dot-net-time-based-alerts-made-easy/llms.txt)