LibreSign is a digital signature application for Nextcloud that enables secure document signing workflows directly within your self-hosted environment.
It supports internal and external signers, certificate-based signatures, and full document lifecycle management.
- Fully self-hosted digital signature solution
- Integrated with Nextcloud ecosystem
- Supports internal and external signers
- Open source (AGPL-3.0)
- Extensible API
- 🛠 Nextcloud administrators who want to deploy a digital signature solution
- 👤 End users who need to sign or request signatures on documents
- 🏢 Organizations looking for a self-hosted signature workflow
Complete guides are available for:
- 🔧 Administrators (installation, configuration, certificates)
- 👥 Users (how to request and sign documents)
- 🧪 Developers (architecture and API)
👉 https://github.com/LibreSign/documentation
LibreSign can be installed from the Nextcloud App Store or manually.
After enabling the app, administrators must install required standalone dependencies and configure certificates.
Run the following command as your web server user:
occ libresign:install --java --pdftk --jsignpdf
This will install:
- Java (standalone JRE)
- PDFtk
- JSignPdf
All binaries are installed inside the Nextcloud data/appdata_*/libresign directory.
No system-wide installation is required.
sudo -u www-data php /path/to/nextcloud/occ libresign:configure:check
This command verifies:
- Java availability
- PDFtk setup
- JSignPdf setup
- OpenSSL configuration
- Certificate environment
You can generate a certificate using OpenSSL or CFSSL.
Example using OpenSSL:
sudo -u www-data php /path/to/nextcloud/occ libresign:configure:openssl --cn="Your Organization - Digital Signature" --o="Your Organization" --c="FR" --st="Region" --l="City"
Certificates are generated and stored inside the Nextcloud data directory: nextcloud_data_dir/appdata_*/libresign
No additional server-level configuration is required.
📖 For full configuration details, advanced setups, and troubleshooting: https://github.com/LibreSign/documentation
LibreSign runs entirely inside your Nextcloud environment.
All cryptographic operations are self-contained and executed server-side. No external services are required and no document data leaves your infrastructure.
LibreSign manages its own internal Certificate Authority (CA), ensuring full control over keys, signatures and alignment with data protection regulations.
- A user uploads a document.
- The user defines signers (internal or external).
- Signers receive a notification or link.
- The document is signed and stored in Nextcloud.
- Signature validation and certificate verification are performed automatically.
- poppler-utils
- System locale configured with UTF-8 charset
- GLPI: Plugin to sign GLPI tickets
- Approval: Approve/reject files based on workflows defined by admins
Developer manual: https://docs.libresign.coop/developer_manual/
LibreSign uses certificate-based digital signatures built on a private PKI managed within your Nextcloud environment.
It supports certificate revocation (CRL), trusted time-stamping (TSA), and document certification levels (DocMDP), ensuring integrity, authenticity and long-term validation of signed documents.
All cryptographic operations are performed server-side and remain under your infrastructure control.
For responsible disclosure and security policy, please see SECURITY.md.
LibreSign is an open source project and welcomes contributions.
You can contribute by:
- Opening issues for bugs and feature requests
- Contributing code improvements
- Improving translations on Transifex
- Contributing to the documentation repository
- Supporting the project via GitHub Sponsors
See our Contributing Guide for details.
Thanks go to these wonderful people: