---
title: "Frappe Sign Settings"
space: "Frappe Sign Documentation"
url: "https://eben.isambane.co.za/frappe-sign-docs/frappe-sign-settings"
updated: "2026-08-06"
---


# Frappe Sign Settings

Open **Frappe Sign Settings** from the Frappe Sign workspace. This single document controls how the whole app behaves for everyone.

![Frappe Sign Settings - general configuration, security settings, and certificate section](/files/fsign-settings-general.png)

## General signing configuration

- **Enabled** - the master on/off switch for the whole app.
- **Internal Signers Only** / **Allow External Signers** - whether signers must be internal Frappe users, or can be external people who only ever see the signing portal.
- **Require Login For Internal Signers** - whether an internal signer must log in to sign, or can use their unique signing link alone.
- **Default Expiry Days** - how many days a new request is valid for before it expires.
- **Default Reminder Days** - the interval for the daily reminder scheduler (see **Tamper Detection & Notifications**).

## Security settings

- **Require Signature Consent** - signers must explicitly consent to using their saved signature/initials before completing a request. You already saw this in action if you followed **Sending a Request & the Signing Portal** - it's the "Consent Required" step before the signature capture dialog.
- **Append Audit Certificate** - when enabled, the generated audit certificate is appended to the final signed PDF, producing a combined *final verification package*.
- **Enable Tamper Detection** - lets Frappe Sign periodically check whether stored files still match their recorded hashes.
- **Enable Certificate Based PDF Signing** - applies a real cryptographic PDF signature to the final PDF, using a configured `.p12`/`.pfx` signing certificate.

## PDF signing certificates

Certificate-based PDF signing uses a dedicated **document-signing certificate** - this is a different thing from your website's SSL/TLS certificate, and Let's Encrypt certificates should never be reused for this.

- A **self-signed certificate** is fine for internal integrity checks, audit evidence, and testing - external PDF viewers will just show it as unknown/untrusted unless someone manually trusts it.
- A **CA-issued document-signing certificate** is what you want for externally trusted signatures - upload the `.p12`/`.pfx` file and its password, and Frappe Sign will read back the certificate's Subject, Issuer, Serial Number, Fingerprint (SHA256), validity dates, and status.

Use the **Certificate** menu to manage it:

![The Certificate action menu: Generate Self-Signed Signing Certificate, Inspect Certificate, Clear Certificate](/files/fsign-settings-certificate-menu.png)

- **Generate Self-Signed Signing Certificate** - creates a private `.p12`, attaches it, stores its password, and reads back the metadata. Good for a quick start.
- **Inspect Certificate** - re-reads whatever certificate file is currently attached and refreshes the metadata fields.
- **Clear Certificate** - removes the configured certificate (existing signed documents are untouched).

Next: tell Frappe Sign which DocTypes in your system can actually be used as signing sources - see **Configured Source DocTypes**.