Digital Signature Checking

Hi,
I have a large number of PDF files signed with a digital signature.
I would like to extract from each file the certificate and call OpenSSL to check the validity of this certificate.
Does anybody knows a way to extract the certificate without opening the file?
Does anyone used the app 'Document Security Livecycle' for this purpose?
Thanks for your inputs!

The Document Security product has APIs to validate signatures on PDFs.

Similar Messages

Temporarily disable Digital Signature Checks to Install MS SQL Server 2008 with no Internet Access

I am attempting to install a licensed copy of MS SQL Server 2008 in a Private Enclave that does NOT have Internet access on a Win2008 R2 SP1 server (that is VM - thus I can't reboot and press F8 to select "Disable Driver Signature Enforcement"
). The installation fails with an error of the vc_red.cab file being found either corrupt or a bad digital signature. The file is good, but the signature has an expiration of 2011. I understand that a DOTNET SDK v1.1 program called setreg.exe
will enable disabling the digital signature check, but I am not permitted to use that program.
I might be permitted to use the "Signtool.exe" utility, but it is not clear what command sequences are necessary to disable and then re-enable the Digital Signature checks.
I saw a thread that recommended using the command:
bcdedit.exe /set nointegritychecks ON
However, the comments indicated that this might not have worked.
Are there Registry settings I can use with regedit to make the necessary changes to be able to install the application? I anticipate running into this problem with other software when I do not have Internet connectivity. I already tried
downloading the Microsoft CRL files; updated the lists on the Server; and rebooted. This did not solve my problem.

Hi,
As far as I know, it is not recommended to disable digital signature check.
Since we are not familair with installing MS SQL server, please also refer to SQL forums below to see if experts there have more insights regarding the matter.
https://social.technet.microsoft.com/Forums/sqlserver/en-US/home
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Validate Digital Signature - Check CRL

Hi all,
(1) Is it possible for LiveCycle Document Security to validate the digital signature and check CRL, if there is NO CRL Distribution Point in the certificate itself?
(2) Can I hardcode the CRL's URL in the LiveCycle Document Security's configuration file?
Thanks.
Sanney

Sanney,
I don't know about the CRL URL question, but if I understood correctly what you are trying to achieve, then:
If you already have CRLs or certificate files at your disposal, you can store them in disk. You can then select "advanced" option when installing. This will allow you to point at the directories containing the credentials , so these can be included as an integral part of the overall server deployment.
If later on you want to update the credentials, you can run Configuration Manager. You must then rededploy the updated server components to the application server.
I'm currently writing this out of memory, but the documentation is very clear about this procedure.
HTH,
Evangelos

Digital Signature Check Printing issue

Hi ,
I have one issue in check printing for Tcode : F110 .
When i take printout signature comes below the line   , i want to move digital signature above the line .
in Script Code is like this
T3
T3
/:           HEX TYPE PCL LEFT '5.00' CM
/=           1B2831511B2873317033362E307630733062305453
/:           ENDHEX
Now Can you tell me how to move signature from below the line to Above the line .
Regards,
Sandeep Jadhav

Hi,
When you say adjustment how did you pass the adjustment ? what transaction code was used? normally to post a payment without printing check you can use F-53 and that should not print any checks.
Thanks and Regards
K.Raghavendran

Software Update - digital signature incorrect

I have several update packages that were consistently reporting the error:
*The update "xxxxxxx" can't be saved.*
The digital signature for this package is incorrect.
The updates are:
iLife Support 9.0.3
Java for Mac OS X 10.5 Update 4 1.0
Safari 4.0
Several other updates (eg. recent iTunes and QuickTime) downloaded and installed OK.
I tried all of the following to no avail:
Repair disk permissions
Reinstall 10.5.7 combo package manually
Delete Software Update preferences & cache files
Multiple restarts
Finally I tried running Software Update under a fresh admin account and they downloaded OK. (Different issue that the Java Update later said it couldn't install).
So seemingly this is related to something in my usual admin account. Does anybody know what other preference files I should look to delete, or any other hidden setting that is affecting the digital signature checking?

I tried all of the following to no avail:
Repair disk permissions
Guess Carolyn didn't notice this.
This was happening fairly frequently about a month ago when 10.5.7 came out. The Apple servers were overloaded apparently and some incomplete downloads occurred so some type of checksum prevented running the update. Waiting and downloading later seemed to be the best solution.
http://discussions.apple.com/thread.jspa?messageID=9456350&#9456350
So seemingly this is related to something in my usual admin account. Does anybody know what other preference files I should look to delete, or any other hidden setting that is affecting the digital signature checking?
Perhaps by the time you did all the troubleshooting steps, if you tried it from the original admin account it would have downloaded correctly.

Checking to see if a document has a digital signature

Hello,
I have created a stand alone static PDF document using the Designer 7.0.
I have some code that checks the document to ensure the proper data fields have been filled out before the user can sign the form. After signing the form the, the user is supposed to click a submit button where 2 things happen, first the data is sent for processing (do not the the digital signature info here) and second a copy of the PDF is save for archiving purposes (with digital signature).
What I need to know is how do I verify the digital signature field is not null or empty?
If I check its raw value, before and after are the same (null or empty even thought I can see that the form has been signed by looking at the screen). If I used the signatureInfo functions available in professional, I get a security violation error. The form is filled out using Adobe Reader and the forms have digital signature right added via the Reader Extensions v6.0.
Any help is greatly appreciated.
Thanks
Ben

Hi Ben, First advice is upgrade to designer 7.1. There are major improvements in the stability of designer. 7.0 kept crashing on me constantly.
I created a little function which should help you out.
function isSigned(sigField){
var oState = event.target.getField(sigField).signatureInfo().status;
/* if (oState == -1)
//app.alert("Not a signturefield");
else if (oState == 0)
//app.alert("Signature is Blank");
else if (oState == 1)
//app.alert("Unknown Status");
else if (oState == 2)
//app.alert("Signature is invalid");
else if (oState == 3)
//app.alert("Sig of Document is valid, identity of signer could not be verified");
else if (oState == 4)
//app.alert("Sig of Document is valid, identity of signer is valid");
else
//app.alert("Value was " + oState); */
return oState;
You need to pass this function the fully qualified SOM so if the signature field is in form.subform.page1.sigField you would call it like this isSigned("form[0].subform[0].page1[0].sigField[0]").
Good luck.

Fault in adobe digital signature revocation checking schema

Hello,
I have found some fault in adobe digital signature revocation checking schema. If OCSP response signing certificate contains CRL distribution point (in my case CDP (CRL) and AIA (OCSP)), online OCSP check executes, but after getting all chain certificate OCSP responses, validating signature against CRL (it’s looks from Local cache). It means you never get OCSP validation data in Adobe Acrobat or Reader signature revocation tab.
Adobe Revocation Checking Quick Key schema is following:
Check      Embedded revocation responses
Check      local CRL cache C:\Documents and Settings\<user>\Application      Data\Adobe\Acrobat\9.0\Security\CRLCache
Check      Online OCSP response
Check      Online CRL response
LAB environment:
Certificate      chain E-ME SSI      (RCA) (Root Certificate) -> E-ME PSI (PCA) (Policy Certificate) -> E-ME IS (CA1) (Issuer certificate) -> User      certificate (Document signing certificate)
Sign      PDF document (Ocsp-CHECK.pdf)      using Adobe Acrobat 9 with User certificate (Don’t add revocation information in signature)
Test steps:
Sign      PDF document using Adobe Acrobat 9 with User certificate (Don’t add revocation      information in signature)
Clear      Local CRL cache under C:\Documents and Settings\<user>\Application      Data\Adobe\Acrobat\9.0\Security\CRLCache
Open      signed file using Adobe Acrobat 9 or Reader 9
Verify      signature. Verification process finishes successfully. Under signature      properties in certificate windows and user certificate revocation tab you      can see that revocation information data comes from CRL. The same for all      chain certificates. But if we look in chain and user certificate its holds      AIA record for OCSP service.
After      a couple of tests I tried to disable access for Acrobat to local CRL cache      folder (Everyone – Full control deny).
After      disabling access to local CRL cache folder - verify the same signed PDF      file. Opening document you can see OCSP checking progress and verification      process finishes successfully. Under signature properties in certificate      windows and user certificate revocation tab you can see that revocation      information data comes from OCSP. The same for all chain certificates.
Resolution:
Its looks when Adobe starts online OCSP checking and receives OCSP response they start parsing OCSP response signer certificate and check OCSP signer certificates revocation information. In this process CRL for OCSP signer certificate is downloaded and placed in Local CRL cache C:\Documents and Settings\<user>\Application Data\Adobe\Acrobat\9.0\Security\CRLCache
Somehow when Adobe gets all chain certificate OCSP responses and have verified also all OCSP signer certificates, online OCSP check is no more continued and revocation information are taken from Local CRL cache.
Can you please help me to clear how to deal with this problem, to make sure that procedure works correctly?
Message was edited by: Gatis Žeiris

Sorry i add corect link to Signed test file: http://www.dsistemas.lv/files/Ocsp-CHECK.pdf

Checking Digital Signatures

I have a form with a number of digital signatures on.
When a user clicks on one digital signature, I need to be able to check the status of the other signatures so I can determine which fields on the form should be locked down. I.E. If signature1 and signature2 are signed then I want to lock down TextField1, where if signature1 and signature3 are signed I wasnt to lock down TextField2.
Does anyone have some code to check for the signing of a dig sig and can anyone indicate how I might achieve the above please? I tried some other code from the forum but it doesn't seem to work.
Thanks
Phil Rimmington

I have a form with a number of digital signatures on.
When a user clicks on one digital signature, I need to be able to check the status of the other signatures so I can determine which fields on the form should be locked down. I.E. If signature1 and signature2 are signed then I want to lock down TextField1, where if signature1 and signature3 are signed I wasnt to lock down TextField2.
Does anyone have some code to check for the signing of a dig sig and can anyone indicate how I might achieve the above please? I tried some other code from the forum but it doesn't seem to work.
Thanks
Phil Rimmington

The error occurs by correspondence check (WinVerify Trust) of the signature when Windows Installer with the digital signature is executed.

The following errors occur by correspondence check (WinVerify Trust) of the signature when Windows Installer with the digital signature is executed.
"Error 1330. A file that is required cannot be installed because the cabinet file C:\<tool>\Data1.cab has an invalid digital signature. This may indicate that the cabinet file is corrupt. Error 8230 was returned by WinVerifyTrust."
Please teach the following of Error 8230.
1) Occurrence condition.
2)Approach to avoiding.

So I found my own answer to the issue. The error was being caused by an the following xml in the assertion:
<ds:Reference URI="">
The value of URI attribute must have a '#' followed by the same value of the ID attribute in the parent 'Assertion' element (in our case a random string):
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="a5k42vnhsywezqzyufq15c4bb9xuzeozrmbppj38xe" IssueInstant="2012-03-12T14:33:25.986Z" Version="2.0">
<saml:Issuer>ISSUER_NAME</saml:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
*<ds:Reference URI="#a5k42vnhsywezqzyufq15c4bb9xuzeozrmbppj38xe">*
How this is related to the digital signature is beyond me, though I admit I'm very new to saml and digital signing. However I spent a great deal of time investigating my certs and how I was creating the signature, which it seems is unrelated to the actual issue. I also wasn't able to find any docs specifying that this attribute was required, though I might have just missed it.

How to digital signature in check printing.

Hi Team,
A new digital signature has been given to me by payroll team and requested me for some configuration changes so the new digital signature appears on the check during check printing program.
Can some one give me step by step procedure of how to do this in SAP.
thanks and appreciate your help in advance.

Hi Team,
Please let me know how to do this in SAP?

Checking Digital Signature Field

Hi There,
How do I check if a digital signature field has a signature without having to call validation, for example signatureValidation()?
Issue - I have a script that hides some text in PreSign event and if the user clicks cancel during the singing process, I want to undo the hiding. The idea is to have a script in the PostSign event to check if the signature exists and then undo. I'm trying to avoid calling signatureValidation() and invoke a send validation if the signature validation already took place.
Please help.
Regards,
RT

refer to -
http://forums.adobe.com/message/1334907#1334907

Update on 10.6.8 fails due to digital signature on update is missing

wanting to install the Parallels version 10 and it won't work on 10.6.8 version of my Mac OS so I learned how to go to the software update which indicates an update is available. When I go ahead and load the update it runs fine and then stops with a message that the Macbook Pro EFI Firmware Update can't be saved. It says the digital signature on the update is missing or invalid.
I don't know if the digital signature is on my computer or the update? I would upgrade to a more recent version of the OS but don't know what will work.
Can anyone help?
Dan

Parallels 10 isn't compatible with 10.6 according to the web site.
Mac Requirements
Hardware:
A Mac computer with an Intel Core 2 Duo, Core i3, Core i5, Core i7, or Xeon processor (Core Solo and Core Duo processors are no longer supported)
Minimum 2 GB of memory (4 GB of memory is recommended to run Windows 7 in a virtual machine or if your host OS is Lion)
About 850 MB of disk space on the boot volume (Macintosh HD) for Parallels Desktop installation
About 15 GB of disk space for each virtual machine
Software:
OS X Yosemite 10.10 or later
OS X Mavericks 10.9.4 or later
Mac OS X Mountain Lion 10.8.5 or later
Mac OS X Lion 10.7.5 or later
Check that your computer is compatible with Mountain Lion/Mavericks/Yosemite.
To check the model number hold down the option/alt key, go to the Apple menu and select System Information.
MacBook (Late 2008 Aluminum, or Early 2009 or newer) model number 5,1 or higher
MacBook Pro (Mid/Late 2007 or newer) model number 3,1 or higher
Your Mac needs:
OS X v10.6.8 or OS X Lion already installed
2 GB or more of memory (More is better - 4 GB minimum seems to be the consensus)
8 GB or more of available space
Check to make sure your applications are compatible. PowerPC applications are no longer supported after 10.6.
Application Compatibility
Applications Compatibility (2)
Do a backup before installing.
If you can/do upgrade, I recommend you make a copy of the installer and move it out of your Applications folder. The installer self-destructs. The copy will keep you from having to download the installer again. You can make a bootable USB stick to install using this free program.
Bootable USB Flash Drive – Diskmaker X
Mountain Lion
Note - Mavericks is no longer available.

HOWTO: Create a Boot Configuration That Has No Driver Signature Checks. Disable Driver Integrity Checks and Install a Custom Non-Signed Driver

Hello,
Recently, I had a task where I needed to install a custom non-signed driver onto my Windows 8 64-bit setup. As it is known, Windows has driver enforcement policies that, as a security measure, do not allow you to install non-signed drivers.
I did not want to alter my current boot configuration so I decided to create a separate boot entry that would have driver signing policies disabled. For some reason I did not find any good source that would contain a step-by-step instruction on completing
this task, so I decided that I'd better share my experience here.
Lastly, there are multiple ways how you could turn off driver enforcement policies, but I find the way to do this via boot manager.
Here's how you can do that.
1. Press WindowsKey and type 'cmd' (without quotes) to find Command prompt, then click Command prompt icon. If you have User Account Control turned on, hold Ctrl+Shift keys pressed when clicking the icon.
This will force Windows to ask you for elevation of command prompt. Elevation is necessary for editing Boot Configuration Database (BCD), the database used by Windows boot manager to store boot settings.
2. In the User Account Control window click Yes to confirm elevation of command shell.
3. At the command prompt type
bcdedit
to list your BCD entries.
This will give you an output like:
Windows Boot Manager
identifier {bootmgr}
device partition=\Device\HarddiskVolume2
path \EFI\Microsoft\Boot\bootmgfw.efi
description Windows Boot Manager
locale en-US
inherit {globalsettings}
integrityservices Enable
default {current}
resumeobject {a329b5cf-fb29-11e1-a74d-f2c962d62240}
displayorder {a329b5d0-fb29-11e1-a74d-f2c962d62240}
{a329b5cc-fb29-11e1-a74d-f2c962d62240}
{a329b5ca-fb29-11e1-a74d-f2c962d62240}
{a329b5c2-fb29-11e1-a74d-f2c962d62240}
{current}
{a329b5d8-fb29-11e1-a74d-f2c962d62240}
toolsdisplayorder {memdiag}
timeout 30
Windows Boot Loader
identifier {a329b5d0-fb29-11e1-a74d-f2c962d62240}
device vhd=[D:]\win8prowmc01.vhdx
path \Windows\system32\winload.efi
description Windows 8
locale en-US
inherit {bootloadersettings}
recoverysequence {a329b5d1-fb29-11e1-a74d-f2c962d62240}
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice vhd=[D:]\win8prowmc01.vhdx
systemroot \Windows
resumeobject {a329b5cf-fb29-11e1-a74d-f2c962d62240}
nx OptIn
bootmenupolicy Standard
The section that starts with Windows Boot Manager lists current settings for the boot menu. Here you find what boot entry is chosen by default, this is the one what you will boot into if you do not select any boot entry in the
boot menu.
The following record
default {current}
indicates that by default my Windows boots into configuration which I use at the moment (currently booted Windows configuration).
To find out what exactly is current configuration, look into the list of boot entries, records that contain boot loader configuration and are titled as Windows Boot Loader in the bcdedit output.
For example, the entry shown above is one of my boot configurations. This is one of the boot entries listed on the boot manager screen when I start my PC and it looks like:
Windows Boot Loader
identifier {a329b5d0-fb29-11e1-a74d-f2c962d62240}
device vhd=[D:]\win8prowmc01.vhdx
path \Windows\system32\winload.efi
description Windows 8
locale en-US
inherit {bootloadersettings}
recoverysequence {a329b5d1-fb29-11e1-a74d-f2c962d62240}
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice vhd=[D:]\win8prowmc01.vhdx
systemroot \Windows
resumeobject {a329b5cf-fb29-11e1-a74d-f2c962d62240}
nx OptIn
bootmenupolicy Standard
This record has a unique GUID identifier that can be used to reference this boot entry, which is:
identifier {a329b5d0-fb29-11e1-a74d-f2c962d62240}
If we look at the Windows Boot Manager settings, we'll see this entry is the first in order to be displayed in the boot menu on OS start (I marked the unique bits):
displayorder {a329b5d0-fb29-11e1-a74d-f2c962d62240}
{a329b5cc-fb29-11e1-a74d-f2c962d62240}
It references my VHD drive, a virtual hard drive where my Windwos 8 setup is residing:
device vhd=[D:]\win8prowmc01.vhdx
And it also specifies that the boot manager must use UEFI BIOS extension code to access my Windows boot partition:
path \EFI\Microsoft\Boot\bootmgfw.efi
3. Now locate the current boot entry.
Current boot entry contains boot settings used to boot into Windows configuration to which you are currently booted. It is referenced in the list of boot entries as a Windows Boot Loader record that has the {current} keyword inside and may
look like:
Windows Boot Loader
identifier {current}
device vhd=[D:]\win8rtm.vhdx
path \Windows\system32\winload.efi
description Windows 8 Enterprise RTM
locale en-US
inherit {bootloadersettings}
recoverysequence {a329b5c3-fb29-11e1-a74d-f2c962d62240}
integrityservices Enable
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice vhd=[D:]\win8rtm.vhdx
systemroot \Windows
resumeobject {a329b5c1-fb29-11e1-a74d-f2c962d62240}
nx OptIn
bootmenupolicy Standard
hypervisorlaunchtype Auto
Because we are more than happy with current configuration and want to base our new boot configuration on these settings, we need to copy this boot entry ({current}) to a new boot entry.
This is done by running the following command:
C:\Windows\system32>bcdedit /copy {current} /d "No Driver Signature Check"
Parameter /d here indicates that the following sequence of characters specifies the display name for the new boot entry that we are creating. The name inside the double quotes will be displayed in the boot menu when you boot your Windows.
In other words, if you know restart your system, you'll see the new No Driver Signature Check in the boot menu.
When copied, the entry is automatically given a new GUID identifier, so upon running the command above, you'll see the following line returned (you'll have an other GUID since these are unique identifiers):
The entry was successfully copied to {a329b5d8-fb29-11e1-a74d-f2c962d62240}.
4. Make sure the entry has been successfully created.
Run the same bcdedit. (You may specify /enum or /v, or both /enum /v parameters at the prompt to get more detail about boot entries, but simple bcdedit is just enough to see the new entry):
C:\Windows\system32>bcdedit
Windows Boot Manager
identifier {bootmgr}
device partition=\Device\HarddiskVolume2
path \EFI\Microsoft\Boot\bootmgfw.efi
description Windows Boot Manager
locale en-US
inherit {globalsettings}
integrityservices Enable
default {current}
resumeobject {a329b5cf-fb29-11e1-a74d-f2c962d62240}
displayorder {a329b5d0-fb29-11e1-a74d-f2c962d62240}
{a329b5cc-fb29-11e1-a74d-f2c962d62240}
{a329b5ca-fb29-11e1-a74d-f2c962d62240}
{a329b5c2-fb29-11e1-a74d-f2c962d62240}
{current}
{a329b5d8-fb29-11e1-a74d-f2c962d62240}
toolsdisplayorder {memdiag}
timeout 30
Windows Boot Loader
identifier {current}
device vhd=[D:]\win8rtm.vhdx
path \Windows\system32\winload.efi
description Windows 8 Enterprise RTM
locale en-US
inherit {bootloadersettings}
recoverysequence {a329b5c3-fb29-11e1-a74d-f2c962d62240}
integrityservices Enable
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice vhd=[D:]\win8rtm.vhdx
systemroot \Windows
resumeobject {a329b5c1-fb29-11e1-a74d-f2c962d62240}
nx OptIn
bootmenupolicy Standard
hypervisorlaunchtype Auto
Windows Boot Loader
identifier {a329b5d8-fb29-11e1-a74d-f2c962d62240}
device vhd=[D:]\win8rtm.vhdx
path \Windows\system32\winload.efi
description No Driver Signature Check
locale en-US
inherit {bootloadersettings}
recoverysequence {a329b5c3-fb29-11e1-a74d-f2c962d62240}
integrityservices Enable
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice vhd=[D:]\win8rtm.vhdx
systemroot \Windows
resumeobject {a329b5c1-fb29-11e1-a74d-f2c962d62240}
nx OptIn
bootmenupolicy Standard
hypervisorlaunchtype Auto
The entry has been created and given a unique a329b5d8-fb29-11e1-a74d-f2c962d62240 ID. It now has exactly same boot settings as the boot entry we used to boot into current configuration of Windows.
5. Modify created No Driver Signature Check entry and specify that Windows must have driver integrity checks disabled when booted using this boot entry.
Any modifications to boot entries are made using /set parameter. To indicate that we modify a specific boot entry, we must specify the GUID for the No Driver Signature Check record, which is:
identifier {a329b5d8-fb29-11e1-a74d-f2c962d62240}
In other words, to edit (add or change) an option for the boot entry, we need to use the following command syntax:
C:\Windows\system32>bcdedit /set GUID <boot_option> [<option_value>]
First, we must specify that we don't want integrity checks be made. This is done by adding the loadoptions option and setting it to DISABLE_INTEGRITY_CHECKS value:
C:\Windows\system32>bcdedit /set {a329b5d8-fb29-11e1-a74d-f2c962d62240} loadopti
ons DISABLE_INTEGRITY_CHECKS
The operation completed successfully.
6. Verify that load option has been added.
Run the bcdedit command:
Windows Boot Loader
identifier {current}
device vhd=[D:]\win8rtm.vhdx
path \Windows\system32\winload.efi
description Windows 8 Enterprise RTM
locale en-US
inherit {bootloadersettings}
recoverysequence {a329b5c3-fb29-11e1-a74d-f2c962d62240}
integrityservices Enable
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice vhd=[D:]\win8rtm.vhdx
systemroot \Windows
resumeobject {a329b5c1-fb29-11e1-a74d-f2c962d62240}
nx OptIn
bootmenupolicy Standard
hypervisorlaunchtype Auto
Windows Boot Loader
identifier {a329b5d8-fb29-11e1-a74d-f2c962d62240}
device vhd=[D:]\win8rtm.vhdx
path \Windows\system32\winload.efi
description No Driver Signature Check
locale en-US
loadoptions DISABLE_INTEGRITY_CHECKS
inherit {bootloadersettings}
recoverysequence {a329b5c3-fb29-11e1-a74d-f2c962d62240}
integrityservices Enable
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice vhd=[D:]\win8rtm.vhdx
systemroot \Windows
resumeobject {a329b5c1-fb29-11e1-a74d-f2c962d62240}
nx OptIn
bootmenupolicy Standard
hypervisorlaunchtype Auto
7. Add the option that turns on test signing mode and disables checks of driver signature.
Adding the testsigning option and setting it to ON does the trick for us:
C:\Windows\system32>bcdedit /set {a329b5d8-fb29-11e1-a74d-f2c962d62240} TESTSIGNING ON
8. Now we have a boot entry that enables Windows not to do integrity checks and digital signature validation.
We check it by running bcdedit:
Windows Boot Loader
identifier {a329b5d8-fb29-11e1-a74d-f2c962d62240}
device vhd=[D:]\win8rtm.vhdx
path \Windows\system32\winload.efi
description No Driver Signature Check
locale en-US
loadoptions DISABLE_INTEGRITY_CHECKS
inherit {bootloadersettings}
recoverysequence {a329b5c3-fb29-11e1-a74d-f2c962d62240}
integrityservices Enable
recoveryenabled Yes
testsigning Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice vhd=[D:]\win8rtm.vhdx
systemroot \Windows
resumeobject {a329b5c1-fb29-11e1-a74d-f2c962d62240}
nx OptIn
bootmenupolicy Standard
hypervisorlaunchtype Auto
9. Type 'exit' without quotes to exit from command prompt, and restart Windows.
Upon booting you will be present with a new boot option to start Windows in configuration that allows you to install custom non-signed drivers.
Hope this will help anybody to create their own custom boot configurations.
Well this is the world we live in And these are the hands we're given...

Hi,
Thank you for sharing the solutions & experience here. It will be very beneficial for other community members who have similar questions.
Regards,
Kelvin hsu
TechNet Community Support

Excel 2013 crash - related to digital signature?

This is a cross-posting of a thread originally started in Microsoft Answers (Office- Excel) forum, advised to post in this forum by MS support engineer Mohan Suryanarayan (link to other forum: here).
I have a VB macro in file A (which otherwise contains only several Excel Tables with named ranges). My digital signature (for signing code) is attached to file A.
As the macro executes, the Open file dialog is called up so that the User can select a secondary file to open (file B or C).
Files B and C contain several sheets with formulas and Excel Tables, and also their own extensive VB macros. My digital signature is also attached to files B & C.
The remainder of the macro in file A simply executes an update of the Excel Tables in the secondary file, before saving & closing it.
I have been finding that during execution of the file A macro, Excel crashes and closes all open Excel files.
If I remove the digital signature from the secondary files then the macro in file A executes with no problem.
The macro was written in Excel 2007 and on a different laptop, with different digital signature, and used to have no problem at all. When a new laptop was purchased a new digital signature was obtained and placed into all of the files.
Execution of file A is a critical process - I need help with stopping the crash, while maintaining a digital signature in the secondary files (so that their own macros can execute).
Event Viewer error shows the following:
Faulting application name: EXCEL.EXE, version: 15.0.4667.1000, time stamp: 0x543d366c
Faulting module name: mso.dll, version: 0.0.0.0, time stamp: 0x5447696f
Exception code: 0xc0000602
Fault offset: 0x011aafdd
Faulting process id: 0x2d58
Faulting application start time: 0x01d01e17eafcd0bb
Faulting application path: C:\Program Files\Microsoft Office 15\root\office15\EXCEL.EXE
Faulting module path: C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\mso.dll
JL Latham replied:
Tom, all I can give you is relatively non-information. I haven't experienced that type of behavior even in Excel 2013 with digitally signed macros in multiple workbooks. But my digital signature is a commercial one from DigiCert, not
self-cert. I'm not even sure what piece of Excel or Office processes the digital signature (that is, whether it is mso.dll or not). But your whole process has more moving parts than most of mine involving multiple workbooks do - I quite often turn
off .EnableEvents when doing things like that just so event driven macros in the other workbook(s) do not execute.
Do the macros in the 'B files' have to execute during all of this processing in file A? If not, have you tried turning interrupts off:
Application.EnableEvents = False
before starting to work with the B-files? Maybe something in them, such as a Worksheet_Change() or other event triggered process is messing things up?
If you do use Application.EnableEvents=False, remember that you MUST re-enable that later in the code with Application.EnableEvents=True to get responses to things like button clicks, changes in a worksheet or other event driven processes
to run 'normally' again.
Have you looked at this discussion:
http://answers.microsoft.com/en-us/office/forum/office_2013_release-excel/excel-2013-crashing-immediately-when-attempting-to/ea2ab100-5525-4a0d-a3cf-6977319f954f
Sounds very similar to yours - original signature created in 2007, and crashing in 2013. Some suggestions were made, but whether they fixed the issue or not is unknown: OP never came back and said "fixed it" or "didn't fix it".
I replied:
In answer, the secondary B files don't execute any part of their macros during the A file process, and I hadn't included an EnableEvents = False within the file A code. However, I have just tried it to check if it made any difference and unfortunately it didn't.
I had read the thread you gave a link to before posting, and also the sub threads given within that one, but didn't see anything I thought of immediate parallel other than an Excel 2013 crash.
The way I read the linked thread was that a User added a signature in Excel 2007 and when they tried to open the file Excel (2007?) crashes, although other people using Excel 2013 can open it (not clear whether it means others can open the one with
the 2007 signature or without it).
Anyway, the differences in my situation are that:
(1) my B-files were originally created in Excel 2007 on a different laptop to current and had their own signature attached. I maintain a 'stock' of B-file versions, some of which have the old signature and some the new. If I run the A-file macro
on one of the B-files with the old signature then it executes ok;
(2) I am able to open the B-files ok, no matter whether the signature in them derives from the old laptop with Excel 2007 or the new laptop with Excel 2013;
(3) the macros within the B-files execute ok (this includes any versions of the B-files which still have an old signature attached, by removing the old signature and replacing with the new and executing on the new laptop);
(4) the offending operation which triggers the crash (when the B-files have the new signature attached) is a Resize of the Excel Tables within the B-file. I understand that I may eventually have to find a workaround for this operation but initially
I want to sort out the signature issue (I'm reasonably sure the signature issue is not a red herring where the Resize is the 'real' problem).
Regards, Tom

Hi,
According to your description, this issue occurred with some particular files that stored in SharePoint site. Did the user download the file to local disk to print?
Based on the event log >>Faulting module name: EXCEL.EXE<<, it does not show the root Faulting module. Thus, please try to follow this KB to do general troubleshooting:
https://support.microsoft.com/en-us/kb/2758592
Then, if you have used "printer status application", please go to Device settings -> Installable options -> Printer Status notification and select disable.
If this issue still exists, we may need to collect the App crash dump file:
https://technet.microsoft.com/en-us/sysinternals/dd996900.aspx
You can try to analyze dump by yourself if you would like to：
How to analyze app crash dump file:
http://blogs.technet.com/b/askperf/archive/2007/05/29/basic-debugging-of-an-application-crash.aspx
Regards,
George Zhao
TechNet Community Support
It's recommended to download and install
Configuration Analyzer Tool (OffCAT), which is developed by Microsoft Support teams. Once the tool is installed, you can run it at any time to scan for hundreds of known issues in Office
programs.
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]

How to add a digital signature in xml publisher report

The problem is: There is a existing pick slip report.This is a xml publisher report and the data source is RDF. We have to add digital signature there. Now this signature is stored in a table with type Long Raw and format BMP. XML Publisher do not support Long Raw and BMP format. It supports BLOB and jpg format.
Could you please guide how to add this signature in the existing RDF with datatype as BLOB and format as jpg.
Please provide the steps with example.

Hi,
Have a look at this thread.
Implementing electronic signatures on an existing AP check run
Re: Implementing electronic signatures on an existing AP check run
Regards,
Hussein

Digital Signature Checking

Similar Messages

Maybe you are looking for