REST API for Digital PDF Signing and Key Management - n8n Workflow

Software Developers: Needing a private, robust API endpoint for incorporating digital signature functionality into their applications.
IT Administrators: Looking to automate secure document processing using a powerful n8n node structure.
Self-Hosters: Running n8n on Docker who need to leverage advanced Node.js modules for document security.
Automation Specialists: Seeking complex n8n templates that showcase custom code execution and dynamic flow control.

Handling digital signatures typically requires complex cryptographic libraries and secure file management. This comprehensive n8n workflow transforms these complex operations into simple API calls. Utilizing multiple custom code n8n nodes, it allows users to upload source PDFs and PFX keys, generate new self-signed certificates, digitally sign documents, and securely download the final output—all controlled by a primary n8n trigger Webhook. This particular n8n workflow is ideal for internal business process automation where security and document authenticity are critical.

This powerful n8n workflow starts with two primary n8n trigger endpoints:

1. API POST Endpoint (/docu-digi-sign): This n8n trigger handles all functional requests (upload, key generation, signing).


2. API GET Endpoint (/docu-download): This n8n trigger is used exclusively for retrieving files saved by the system.

The POST request first passes through a set file path n8n node to define temporary storage directories. The subsequent Switch Operation n8n node analyzes the method parameter (e.g., upload, genKey, signPdf) to route the request accordingly.

Upload Logic: If the method is upload, the flow preprocesses the binary data and uses Convert to File n8n nodes followed by Write File to Disk n8n nodes to save the PDF or PFX key securely.
Key Generation (genKey): The Validate Key Gen Params n8n node ensures all necessary parameters (CN, validity dates, password) are present. The Generate Keys n8n node, using custom cryptographic libraries, creates and saves the PFX, private key, and certificate files.
PDF Signing (signPdf): The Validate PDF Sign Params n8n node checks for the input PDF path, PFX key path, and password. The Sign PDF n8n node leverages specialized modules to add a digital signature placeholder, sign the document using the provided PFX file, and save the final signed PDF to disk.
Response: All processing branches converge at an If n8n node to check for success. The final output is formatted and delivered back to the client via a Respond to Webhook n8n node, completing the n8n workflow execution.

• Download Logic: The GET n8n trigger sets the full path, reads the file from disk using a Read download file from Disk n8n node, and sends the binary data back to the user.

To deploy this advanced n8n template, follow these steps:

1. Import: Copy the provided JSON and import it into your n8n instance via the Workflows page. This will create the full n8n workflow structure.


2. Dependencies (Crucial): Since this n8n node relies on external Node.js modules (node-forge, @signpdf/signpdf, @signpdf/signer-p12, etc.), you must ensure they are installed in your n8n environment, especially if running n8n via Docker. This typically involves modifying your Dockerfile or using custom images to install these NPM packages into the n8n execution context.


3. Webhook Activation: Ensure the two Webhook n8n trigger nodes (API POST Endpoint and API GET Endpoint) are activated and note the resulting URLs. These will be your API endpoints.


4. Testing: Test the endpoints using a tool like Postman, ensuring you send the appropriate body parameters (like method, file paths, and necessary cryptographic data) as expected by the custom n8n code nodes.

API POST Endpoint (Webhook): This is the primary n8n trigger for all document and key operations. It listens on /docu-digi-sign and routes execution based on the request body.
Switch Operation (Switch): A critical core logic n8n node. It dynamically routes the n8n workflow based on the method parameter (upload, genKey, signPdf, download) provided in the incoming API call.
Generate Keys (Code): An essential custom n8n node. It utilizes Node.js cryptographic libraries (node-forge) to generate a new RSA key pair, create a self-signed X.509 certificate, and bundle them into a password-protected PKCS#12 (PFX) file, saving the output files to the defined path.
Sign PDF (Code): The core document processing n8n node. It reads the input PDF and PFX key, uses @signpdf libraries to add a signature placeholder, executes the digital signing process, and saves the final signed document.
Read/Write File to Disk (ReadWriteFile): Multiple instances of this n8n node are used throughout the n8n workflow to persist uploaded documents, generated keys, and final signed PDFs to the local file system (e.g., in /tmp or /data/files/).
Validate Key Gen Params / Validate PDF Sign Params (Code): These input validation n8n nodes ensure required fields are present before attempting complex cryptographic operations, improving the reliability of the overall n8n workflow.