Digitally sign IFS report PDFs

Explore this learning path

Documentation-based guide draft · Reviewed against sources on 2026-09-27 · Not executed in an IFS environment. IFS references use 26R1 unless stated otherwise. Confirm available APIs, components, and permissions in your installed release.

Configure an IFS Report Rule that digitally signs one report PDF. You will create a test keystore, restrict the rule to one report, and verify the cryptographic signature in a PDF reader. A visible signature image by itself is not a digital signature.

Before you start

Use a development environment with the FNDRRE Report Rule Engine component, a working Report Designer report, permission to manage Keystores and Report Rules, and a test signing identity. Choose a report with fictional data. Record its exact Report ID and a blank area on its first page.

Use a development certificate approved for this exercise. A self-signed certificate is suitable for checking the mechanics but will not automatically be trusted by recipients.

1. Save a baseline PDF and current configuration

Run the report without the new rule and save its PDF. Record the report ID, layout, language, and parameters. Export any existing rule you plan to change; preferably create a separate lab rule instead.

Open Report Rules Overview and inspect other enabled rules for the same report. Note actions that insert PDFs or change layouts, since those affect the final document you intend to sign.

2. Configure the signing key

Open Keystores through Solution Manager/navigation search. Create a lab entry with a unique ID such as LAB_REPORT_SIGN. Import the approved PFX containing its private key using the page’s import/create flow, or generate a self-signed test certificate if that option is available to your administrator.

Confirm that the certificate is valid for the intended period and that the entry contains the private key required for signing. Keep the original key material in the organization’s approved secure storage: IFS does not provide a general key-export recovery path.

For the first test, use this explicit keystore rather than relying on different users having personal signing keys.

3. Create a narrowly scoped rule

1. In Report Rules Overview, create a rule named Lab PDF signature.
2. Set Report ID to the selected report. Do not leave it blank, which would broaden the rule.
3. Keep No Multi enabled for the initial single-report test.
4. Open the rule details and add a Sign PDF action.
5. Open Edit Action Properties and populate the following values:

Property	Lab value
UserSignature	NO
KeystoreId	LAB_REPORT_SIGN
SignatureReason	Development signature verification
Page	1
Style	DetailsOnly
X, Y	Coordinates in centimetres in the blank area you selected
Zoom	Start with 30, then inspect the result
CertifyDocument	NO while proving the workflow
PreferredSize	Leave unset for the initial test

Choose page coordinates from your actual layout rather than assuming every report is A4 or has an empty footer. Save and enable the action and rule. The signing reason is required.

4. Generate and inspect a fresh PDF

Run the same report again and preview or print to the appropriate PDF output. Open the newly generated file in a PDF reader with a signature-validation panel.

Verify the signer certificate, signature status, signing reason, page placement, and whether the document has changed since signing. A trust warning for the lab’s self-signed certificate differs from a corrupted/invalid signature. Do not claim recipient trust from a successful visual stamp.

If the rule did not run, temporarily enable Report Rule Advance Logging with the administrator and inspect the Report Rule Log for condition/action results. Restore the previous logging setting after diagnosis.

5. Add appearance and certification only after the baseline works

For a handwritten appearance, import a lab PNG through Report Images → Signatures, with the filename matching the keystore ID, such as LAB_REPORT_SIGN.png. Change Style to SignatureAndDetails and regenerate the PDF.

Apply certification only after all intended document assembly is complete. In this report-rule route, plan for one signature per document. Do not assume the broader Document Management signing workflow has identical capabilities.

6. Test failures and restore the environment

Test a missing keystore, an empty reason, and a different report ID that should remain unsigned. Confirm a report without the new rule still produces its original output. Keep copies of the unsigned and signed fictional PDFs with your review record.

Disable the lab rule before removing the keystore or signature image. Restore prior rule/logging settings. Promote the setup only after the approved signing identity, trust chain, report scope, and downstream document handling have been verified in your environment.

Sources and scope

• IFS keystores and digital signatures
• IFS reporting rules

Older IFS Applications examples are historical context, not evidence of Cloud compatibility. No third-party code, screenshots, or downloadable workflows are reproduced.