Configure LibreOffice Certificate Stores for Signing

This guide explains how to configure digital certificate stores in LibreOffice across different operating systems to enable cryptographic document signing. You will learn how LibreOffice interacts with system-level and third-party certificate databases, how to set the correct certificate path in the application settings, and how to apply digital signatures to OpenDocument and PDF files.

Operating System Differences for Certificate Stores

LibreOffice relies on different certificate management systems depending on your operating system:

• Windows: LibreOffice automatically accesses the Windows Certificate Store. Any personal X.509 certificate installed in your user account is immediately available for signing without manual path configuration.
• macOS: LibreOffice integrates with Apple Keychain to retrieve your installed digital certificates automatically.
• Linux: LibreOffice relies on Network Security Services (NSS). It typically reads certificates from your Mozilla Firefox or Mozilla Thunderbird profile directories, or a custom NSS database directory.

Step-by-Step Configuration in LibreOffice

To ensure LibreOffice points to the correct certificate store, follow these steps:

1. Open LibreOffice.
2. Open the preferences menu:
   • Windows/Linux: Go to Tools > Options.
   • macOS: Go to LibreOffice > Preferences.
3. In the left navigation pane, expand the LibreOffice section and select Security.
4. Locate the Certificate Path section on the right-hand panel.
5. Click the Certificate… button.
6. Select the preferred certificate store from the available profiles (e.g., Firefox or Thunderbird profile directories containing your cert9.db or cert8.db files).
7. If your store is located elsewhere, click Select NSS path to manually browse to the directory containing your certificate database.
8. Click OK, then click Apply and OK to save the changes.
9. Restart LibreOffice to apply the new path settings.

How to Sign a Document in LibreOffice

Once the certificate store is configured, you can apply a digital signature to your files:

1. Open the document you wish to sign (ODT, ODS, ODP, or existing PDF).
2. Go to File > Digital Signatures > Digital Signatures…
3. In the dialog box, click Sign Document.
4. A list of available certificates from your configured store will appear. Select your valid digital certificate.
5. (Optional) Add a signing reason or timestamp authority URL.
6. Click Sign and enter your certificate’s private key password or PIN if prompted.
7. Click Close. A signature icon will appear in the status bar indicating the document is securely signed.

Verifying Certificate Requirements

For a digital certificate to appear in the selection list:

• The certificate must be an X.509 certificate containing a private key suitable for digital signatures.
• The certificate must be active and not expired.
• The issuing Certificate Authority (CA) should be trusted by your local trust store to prevent validation errors when recipients open the document.