Documenso

Last reviewed Aug 26, 2026 · 685 words

The step that decides whether a self-hosted Documenso instance is worth anything is the one the quick-start hides: the PKCS#12 certificate the server uses to seal every signed PDF. Skip it and nothing signs. Generate a throwaway self-signed one and documents sign fine, but the seal proves only that your server touched the file, which is legally adequate for most agreements and inadequate for the ones lawyers care about. Get that decision right up front and the rest of Documenso, a TypeScript app with 14,757 stars under AGPL-3.0, is a pleasant afternoon.

What the certificate actually does

When the last signer finishes, Documenso flattens the signature fields into the PDF and applies a digital signature using the certificate you provide. The path and passphrase are set with two environment variables, NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH and NEXT_PRIVATE_SIGNING_PASSPHRASE. The docs walk through creating a self-signed .p12 with OpenSSL, and for internal paperwork (NDAs with contractors, parental consent forms, club memberships) that is what I use. If you need signatures that validate in Adobe Reader without a warning, or that count as an advanced electronic signature under eIDAS, buy a certificate from a recognised issuer and load that instead. The audit trail Documenso keeps (who opened, who signed, from which address, when) is the part that carries evidentiary weight under ESIGN and similar laws regardless of which certificate sealed the file.

The compose that works

Documenso needs Postgres and an SMTP relay, and it is unusable without the second one because signers get their links by email.

services:
  documenso:
    image: documenso/documenso:latest
    ports:
      - "3000:3000"
    environment:
      - NEXTAUTH_URL=https://sign.example.com
      - NEXT_PUBLIC_WEBAPP_URL=https://sign.example.com
      - NEXTAUTH_SECRET=change-me-32-chars
      - NEXT_PRIVATE_ENCRYPTION_KEY=change-me-too
      - NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=and-this-one
      - NEXT_PRIVATE_DATABASE_URL=postgres://documenso:pw@db:5432/documenso
      - NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=/opt/documenso/cert.p12
      - NEXT_PRIVATE_SIGNING_PASSPHRASE=certpass
      - NEXT_PRIVATE_SMTP_TRANSPORT=smtp-auth
      - NEXT_PRIVATE_SMTP_HOST=smtp.example.com
      - NEXT_PRIVATE_SMTP_PORT=587
      - [email protected]
      - NEXT_PRIVATE_SMTP_PASSWORD=smtp-password
      - [email protected]
    volumes:
      - ./cert.p12:/opt/documenso/cert.p12:ro
    depends_on: [db]
  db:
    image: postgres:16
    environment:
      - POSTGRES_USER=documenso
      - POSTGRES_PASSWORD=pw
      - POSTGRES_DB=documenso
    volumes:
      - ./pgdata:/var/lib/postgresql/data

Put Caddy in front for TLS; the two URL variables must match the public address exactly or signing links break. Budget 1 GB of RAM as a floor; the Next.js process idles around half that and spikes when rendering large PDFs. Test the SMTP path before inviting anyone, because a signer who never receives the email will assume the platform is broken rather than your relay.

Templates, fields, and the API are the daily value

Once running, the workflow is upload a PDF, drag signature, date, text, and checkbox fields onto it, add recipients in signing order, send. Templates turn a recurring document into a two-click send, and the API and webhooks let a script generate an offer letter and fire it off without anyone opening the UI. Store the finished PDFs somewhere sensible: Paperless-ngx consumes them from a watched folder and indexes the signed copy, which is the pairing I run.

Where it is younger than DocuSign

The project dates from 2023 and it shows in the edges: bulk send from a spreadsheet, in-person signing, and some team-management features arrived recently or live in the paid tiers. Documenso sells a hosted version and an enterprise edition, and a few capabilities are gated behind that even on your own server, so check the current feature matrix before promising your finance team a specific workflow. For a lighter alternative with similar aims see DocuSeal; for the broader field the document management category lists the archival tools Documenso hands off to.

What I'd do

Run it for anything you currently pay DocuSign a per-envelope fee for and that does not need a qualified signature. Self-signed certificate for internal forms, a purchased certificate the day a contract is worth arguing over. Caddy for TLS, a real SMTP relay, nightly Postgres dumps plus the certificate file in the backup set, and Paperless-ngx catching the signed output.