Firmador FirmaOKA PWA that signs and validates PDFs with .p12 certificates without anything leaving the device

Web & applications developer at Azirgo SAS. I worked on FirmaOK's web signer: the encrypted certificate vault, PAdES signing with WebCrypto, the visible stamp, multi-signing through incremental updates, the offline validator and the PWA that serves it with no connection.

FirmaOK needed a signer that would run in any browser without bringing back the underlying problem: the usual web signers ask you to upload the document and the .p12 certificate - private key included - to somebody else's server. It had to run entirely in the browser and offline, protect the stored certificate even if someone else used the computer, keep the signatures a PDF already carried, and read the certificates of Ecuador's different accredited authorities correctly, since they do not store the signer's data the same way.

• One-time import of the .p12 / .pfx certificate: it is parsed in the browser, stored encrypted in IndexedDB and unlocked with a master password; several certificates can live under the same password, with no duplicates thanks to the SHA-256 fingerprint.
• Visible PAdES-B signatures on any page of the PDF: the user drags the box over the document and its position is converted to PDF coordinates.
• A configurable stamp with a preview identical to the output: QR code, the signer's name, an optional date, an optional job title for legal entities and a free note of up to two lines, which can be enlarged in a dialog.
• Multi-signing: signing a PDF that was already signed adds the new signature through an incremental update, and the earlier ones stay valid.
• An offline validator: signer, ID or RUC tax number, company name and job title, issuer, certificate validity and fingerprint, PAdES profile (B-B, B-T or B-LTA), integrity and the bytes appended after each signature; it also recognises document timestamps.
• Reading the signer's data according to the Ecuadorian schema used by the accredited CAs - Security Data, BCE, Uanataca, ANF, FirmaSegura, CorpNewBest, Lazzate and AppFirmas -, including the signer type: individual, individual with a RUC, or legal entity.
• Signing is blocked with expired or not-yet-valid certificates, with a direct path to import a valid one.
• Informed consent and a privacy notice (LOPDP) before first use, with each certificate deletable at any time.
• An installable PWA that works offline, with light and dark themes, /firmar and /validar routes, and a “Sign and share” button that opens the system's native share sheet with the signed PDF as an attachment.

A Vite + React SPA with no backend: the whole domain lives in src/modules, one module per responsibility, and the pages only orchestrate.

Every signature is PAdES-B (B-B profile): a detached CMS embedded in the PDF that covers every byte of the file except the slot it is stored in.

• The private key is imported into WebCrypto as non-extractable and with signing permission only, and the PKCS#8 buffer is overwritten with zeros afterwards. An injected script could at most request a signature while the session is open, but never walk away with the key; a strict CSP - default-src 'self' and no inline scripts - closes that door as well.
• A single master password, derived with Argon2id (64 MB of memory and 3 passes, in WebAssembly), encrypts every stored certificate with AES-256-GCM. The AES key is never persisted: it is derived again on every unlock, and the .p12 password is not asked for again after the import.
• Re-signing uses an incremental update (ISO 32000-1 §7.5.6) instead of pdf-lib's normal save: rewriting the file moves every offset and breaks the /ByteRange of earlier signatures. The original bytes stay untouched and only the new objects are appended at the end, with their own xref section.
• The service worker precaches the whole app shell, including the pdf.js worker, so signing and validating work offline. That worker is emitted as .js rather than .mjs because some hosts serve .mjs with a MIME type the browser rejects, and nginx delivers sw.js and index.html uncached so updates get through.
• Privacy from the first screen: consent under Ecuador's LOPDP before using the app, a privacy notice always at hand, and deletion of any certificate whenever the user wants (right to erasure). Only the data needed to tell one certificate from another stays in clear text - name, signer type, ID number, company name and expiry date -, while the key and the remaining metadata are encrypted; when Google Analytics was added, the consent was versioned up so everyone would see it again.
• The stamp is drawn into the page content and the signature field carries a 0×0 widget: with a stamp-sized widget, viewers such as Google Drive or Adobe on mobile painted it with the light-blue highlight used for form fields.

• pdf-lib only knows how to rewrite the whole document. Saving incrementally meant fingerprinting every object when the PDF is loaded, writing only the ones that changed, chaining the new xref with /Prev - on originals with an xref stream (PDF 1.5+) too - and reserving the previous revision's object numbers, because pdf-lib drops object streams while parsing and would reuse the numbers of live objects. On top of that, @signpdf always names the new field “Signature1”, and to viewers two fields with the same name are the same field, so it is renamed to the first free SignatureN.
• Reading the signer from the certificates of every accredited CA: each one uses its own OID arc (1.3.6.1.4.1.<PEN>.3.N), Uanataca adds an intermediate suffix, AppFirmas uses no extensions and puts the ID and RUC in the Subject DN with prefixes, some deliver the RUC in binary, and a legacy ANF OID carries its arc number instead of the RUC. It was solved by detecting the arc by its suffix and accepting only values shaped like an ID (10 digits) or a RUC (13), plus fixing names with accents and Ñ that arrived mis-decoded.
• A validator that does not overstate things offline: it discards /ByteRange matches that are not a real CMS, handles indefinite-length (BER) CMS, tells document timestamps (ETSI.RFC3161) apart from personal signatures, and reports B-T only when a genuine RFC 3161 token is present. What cannot be checked offline - OCSP/CRL revocation and the chain of trust - is marked as not verified in the report itself.
• Biometric unlock with WebAuthn and the PRF extension was actually built, with routing to the platform authenticator, a fallback and a way out when the unlock got stuck, and was later removed to leave a single unlock method: the Argon2id master password.

The signer is a static PWA built with Docker and served by nginx on Railway: it signs and validates PDFs in the browser, with no backend receiving documents or certificates, and keeps working offline. Re-signing a document keeps earlier signatures intact, and the core - .p12 parsing, the encrypted vault, the PAdES CMS, signing, multi-signing and tamper detection - is covered by automated tests, including cases that reproduce the certificate structure of eight Ecuadorian CAs.