Frappe Sign Settings

Open Frappe Sign Settings from the Frappe Sign workspace. This single document controls how the whole app behaves for everyone.

General signing configuration

• Enabled - the master on/off switch for the whole app.
• Internal Signers Only / Allow External Signers - whether signers must be internal Frappe users, or can be external people who only ever see the signing portal.
• Require Login For Internal Signers - whether an internal signer must log in to sign, or can use their unique signing link alone.
• Default Expiry Days - how many days a new request is valid for before it expires.
• Default Reminder Days - the interval for the daily reminder scheduler (see Tamper Detection & Notifications).

Security settings

• Require Signature Consent - signers must explicitly consent to using their saved signature/initials before completing a request. You already saw this in action if you followed Sending a Request & the Signing Portal - it's the "Consent Required" step before the signature capture dialog.
• Append Audit Certificate - when enabled, the generated audit certificate is appended to the final signed PDF, producing a combined final verification package.
• Enable Tamper Detection - lets Frappe Sign periodically check whether stored files still match their recorded hashes.
• Enable Certificate Based PDF Signing - applies a real cryptographic PDF signature to the final PDF, using a configured .p12/.pfx signing certificate.

PDF signing certificates

Certificate-based PDF signing uses a dedicated document-signing certificate - this is a different thing from your website's SSL/TLS certificate, and Let's Encrypt certificates should never be reused for this.

• A self-signed certificate is fine for internal integrity checks, audit evidence, and testing - external PDF viewers will just show it as unknown/untrusted unless someone manually trusts it.
• A CA-issued document-signing certificate is what you want for externally trusted signatures - upload the .p12/.pfx file and its password, and Frappe Sign will read back the certificate's Subject, Issuer, Serial Number, Fingerprint (SHA256), validity dates, and status.

Use the Certificate menu to manage it:

• Generate Self-Signed Signing Certificate - creates a private .p12, attaches it, stores its password, and reads back the metadata. Good for a quick start.
• Inspect Certificate - re-reads whatever certificate file is currently attached and refreshes the metadata fields.
• Clear Certificate - removes the configured certificate (existing signed documents are untouched).

Next: tell Frappe Sign which DocTypes in your system can actually be used as signing sources - see Configured Source DocTypes.