"No Usable Signing Certificates Are Available" — How to Get Your Certificate Back

Symptom fingerprint

The exact strings, error codes, and UI surfaces that map to this issue:

What the app is really checking

When you click Sign, the application enumerates your certificate store and filters it down to certificates that can actually produce a signature. To make the list, a certificate needs three things at once: a matching private key, a current validity date, and a Key Usage that permits digital signatures. If nothing passes all three, you get an empty list and this message.

So the certificate 'existing' isn't enough — plenty of people have the public certificate imported but not the private key, which is like having the lock but not the key. That's the single most common version of this I see.

Why this happens

• The certificate expired (past its "Not After" date) and no longer qualifies.
• Only the public certificate was imported — the private key is missing, so it can't sign.
• The certificate is in the wrong store — Local Machine instead of Current User on Windows, or System keychain instead of login on Mac.
• Key Usage / Extended Key Usage doesn't include Digital Signature — some certificates are encryption-only.
• A hardware token or smart card isn't plugged in, or its middleware isn't loaded, so the on-token certificate never appears.
• You genuinely don't have a digital ID yet and need to create or obtain one.

Step-by-step fix (Windows)

• 1. Press Win+R, type certmgr.msc, Enter. Open Personal → Certificates. This is the Current User store apps read.
• 2. Find your signing certificate. A small key icon overlay means the private key is present — no key means you must re-import the .pfx/.p12 (which contains the private key), not the .cer.
• 3. Double-click it → Details → check "Valid to" isn't in the past, and "Key Usage" lists Digital Signature.
• 4. If it's missing entirely, re-import: right-click Personal → All Tasks → Import, choose the .pfx, and tick "Mark this key as exportable" only if your policy allows.
• 5. For a token/smart card: plug it in, confirm the vendor middleware is installed, and check services.msc → Smart Card (SCardSvr) is Running.
• 6. In Acrobat: Preferences → Signatures → Identities & Trusted Certificates → Digital IDs to confirm the ID is now listed.

Step-by-step fix (macOS)

• 1. Open Keychain Access → login keychain → My Certificates (this tab only shows certificates that have a private key).
• 2. If your certificate appears under Certificates but not My Certificates, the private key is missing — re-import the .p12.
• 3. Expand the certificate to confirm a private key sits beneath it, and check the expiry date.
• 4. Acrobat on Mac doesn't read the login Keychain for signing by default — create or import the Digital ID inside Acrobat: Preferences → Signatures → Identities & Trusted Certificates → Add ID → A file (.p12).

Still not working?

If a valid, private-key-backed certificate is present and it still won't show, the issue is scope or a broken key binding.

• Confirm you imported into Current User, not Local Machine — apps sign as the logged-in user.
• Re-create the digital ID from the original .pfx if the key/certificate pair got separated during an earlier import.
• No digital ID at all? In Acrobat, choose "A new digital ID I want to create now" for self-signed use, or obtain one from a trusted CA (or your IT/PKI team) for anything others must verify.
• On locked-down corporate machines, Group Policy can hide certificates — your IT team may need to deploy the ID through the managed store.

You might also need

More fix guides in PDF and related areas.