How to Use S/MIME Certificates in Okular for Signing PDF Files

Did you know that Okular supports S/MIME certificates for digitally signing PDF files? It can access the certificate store of popular mail clients like Thunderbird or Betterbird (which I am using). However, if you’re using Flatpak packages for both your mail client and Okular, as I do, accessing each other’s sandboxed file systems can be a bit tricky. Here’s how to set it up.

Locating the Certificate Database

First, you need to find the .thunderbird folder where the mail client’s profiles and settings are stored. Typically, this folder is located at $HOME/.thunderbird.

But with Flatpak installations, applications use a virtual file system. For Betterbird (installed via Flatpak), the equivalent folder can be found at: $HOME/.var/app/eu.betterbird.Betterbird/.thunderbird/.

Configuring Okular

Open Okular and navigate to Settings > Configure Backends > PDF. Choose a custom path for the certificate database. This path should point to the folder of the profile under which your S/MIME certificate is configured. Use the file chooser dialog to select the folder - this ensures the path is set correctly.

Final Steps

Restart Okular after setting the path. Once done, the available certificates should appear in the list, allowing you to sign documents within Okular.

With this setup, you can streamline your workflow and digitally sign PDFs hassle-free on a linux machine.