Digital Signature validation with expired TSA certificate

Hi,
I used Adobe Acrobat 8.2 to sign a PDF document with "certifying signature" (note: not approval signature) using a self-signed certificate and a remote TSA. I did NOT embed long term validation information as described here
http://help.adobe.com/en_US/Acrobat/9.0/Standard/WS934c23d7cc8877da1172e0811fde233c98-8000 .html
The TSA certificate expired on a few days ago and now I am getting "not time valid" error on the TSA certificate (see attached mage)
The signature validates fine since I get the ribbon icon at the top for certified document as described here:
http://www.adobe.com/devnet/acrobat/pdfs/validation_cheat_sheet.pdf
The problem is that I don't get the Clock symbol on the timestamp because Signature Properties says
"signature is timestamped but timestamp could not be verified"
The trust settings for all certificates are fine.
I also changed "Verification Time" in Edit-->Security-->Advanced preferences to be "Time signature was created".
I validated the signature using Adobe Reader 8 as well as 9 and got the same error.
What am I doing or expecting that is wrong ?
Appreciate any help!

Thanks. That worked! Back in the sunshine again
The message is as seen below : "signature is timestamped but TS has expired"
I am assuming this is the right message. If not, do respond.

Similar Messages

Please help me with the digital signature validation problem?

Please help me with the digital signature validation problem?

Hi
Execute the program in the Debuggin mode.
In the Debugger Window
Select Breakpoint -> Break point at -> Breakpoint at source code Menu Item and enter the details of the program/include/line no..
Activate the System Debugger On from the Settings Menu.
Hope this would help you.
Murthy
Edited by: Kalyanam Seetha Rama Murthy on Jul 18, 2008 7:20 AM

Digital Signature validation issue in Adapter Module

Hi guys,
we have developed an adapter module for digital signature validation, unfortunately, it simetimes work, sometimes doesnt. Strange is, that the same adapter module works for one customer, while for another one doesn't.
We have sent through some "invalid" messages, which should have been valid at the client, where the module works and theu were flagged as valid. It seems the problem is caused by "special" spanish characters, because validation works for the messages where are only standard chars.
Any idea, what to check? Java version, system encoding?
Any help appreciated,
Olian

Hi,
Not really sure about what causes such issues, but if your module coding uses String and byte[] manipulation, are you using explicite encoding when declaring such types ? I remember facing strange issues with XML field values, and "forcing" encoding to "UTF-8" when appropriate, it solved all my errors (string typed object, when converted internally by the JVM, were not always represented by the same bytes object)
Hope this helps
Chris

How do I control the certificate chain construction performed by Acrobat Reader during digital signature validation?

I work in the federal government where there are many certificate authorities and cross certified certificate authorities. Acrobat Reader is building hundreds of certificate chains in attempting to find a trusted root for the signers certificate. It is taking 4 minutes to validate the signature!
The image is the 15th screen shot showing three chains per screen shot. The window elevator has barely moved!

I am now using Adobe Acrobat Reader 11. Signature validation is much better! Perhaps 10 seconds. The only issue I see that the detail pages have misleading messages. The Signature Properties window has no complaints about the signature but the Show Signer's Certificate page still complains about not valid trust anchor.

Digital Signature validation

I have been using digital certificates to sign pdf documents for approximately a year. The signatures can be checked against a CRL which is provided on the internet. So far Adobe Acrobat Reader has worked fine, retreiving CRLS and validating certificates.
Today I found out that since renewing expired certificates ( the default lifetime was set to 1 year) the signatures on old signed documents are unverified . The local time of the computer was stored in the signature not a timestamp.
I found that reader defaults to using the local time of the computer to validate an old signature when a timestamp is not used, this has been rectified in 9.1 so that it uses to date that the signature was generated (why on earth would it use anything else!). I now have the signatures validated by changing this setting providing the date range of the CRL in the reader encompases the end date of the certificate.
However, when the reader updates the CRL in the cache and the new CRL date range does not include that of the original signature the reader throws up an error stating that the CRL is invalid or expired.
How can I get it to agree pass the validation without turning off revocation checking? I have the CRLs that were in force at the time of the signing but there is no way I can provide them to the reader. How can I make the reader apply the current and valid CRL to the old documents. The expiry date of the old certificates are still in there?
I always thought that not having to keep a CRL history for expired certificates was a dumb idea when I read the documents, but I didn't imagine that old signatures would become invalid when the certificate expired (mine have become invalid less thant 5 days after the documents were signed. What were the developers thinking.
This is pushing toward creating certificates with lifetimes of 100's or thousands of years so that they can always be validated.
Anybody have a working solution.

I have found a solution.to this
Using a virtual machine I set the date on the system back to a point in time when the certificates were all valid. I then create a new crl with a lifetime which makes it valid for one month from the real date (today). I then set the date back and copy the crl to the distrubution point.
Hey presto, acrobat reader loads the crl and is quite happy to accept it even though it has events recorded in it that happened after the date on which it was created!.
Problem solved, but for how long?

Digital signature valid or invalid depending on the signing Windows user

I have a very strange problem and was not able to determine how to resolve it because I quite don't undestand the mechanisms of signing, it seems.
I have a digital signature issued by a member of the "Adobe Approved Trust List". If I sign a document with Adobe Reader XI or Adobe Acrobat XI Standard logged in with one Windows user account the signature appears valid on any other Windows user account. If I use another Windows user account and sign the document with the same digital signature the signature is invalid in this Windows user account and any other.
I didn't change any settings in any of the Adobe products. I use the standard configuration as present just after a fresh install.
One thing I already checked, which nevertheless doesn't explain this strange behavior, is to enable Windows-Integration in the signature configuration of the Adobe products. If this is enabled both documents (the one signed with the "good" Windows user account and the other signed in a "bad" one) show the signature as valid on any Windows account.
So I am wondering if, besides the signature itself, anything else is integrated into a document while being signed that could explain that behavior and, if this is the case, where the setting, trigger, whatsoever, is, to set up Adobe correctly.
Please help.

What do you mean by "signature is invalid"? Is it a a red X or is it Unknown? A problem with trust results in the "Unknown" status, not "Invalid".
In any case, inspect the signature, first in the Signature panel. It will tell you some info about what's wrong with this signature. Then right-click on the signature and select "Show Signature Properties". You'll get a dialog with more info. In this dialog select "Show Signer's Certificate". Check the chain (in the left pane) and "Revocation" tab for each certificate in the chain.
Compare this info for signatures created on a "good" account and "bad". My guess is that the "bad" account is lacking some certificate-related component.and the "good account has it. The fact that if you turn on Windows integration signature becomes valid tells me that it is something related to account.
Another thing to try is this. Go to C:\Users\<username>\AppData\Roaming\Adobe\Acrobat\11.0\Security folder and see if it has CRLCache folder. If it has, delete it and try to sign again.
Also compare the preferences. Check the Edit->Preferences->Signatures->Verification->More->Verification Time preference. Is it the same on both accounts? Is it "Time when the signature was created"? Is the "Include signature's revocation status" check box in Edit->Preferences->Signatures->Verification->More->Creation and Appearances->More checked in both accounts?

Send a digital signature along with xml file

My requirment is that I am to send a file along with digital signature,authorizing the envoys, which are conducted by the algorithm MD5
(cryptographic algorithm reduction of 128 bits) and RSA PCKS1. How to send it and at receiver end(SOAP Adapter) how to authenticate it?
What is algorithm MD5 (cryptographic algorithm reduction of 128 bits) and RSA PCKS1?

Hi Jaideep,
do chk this links
Using Digital Signatures in XI
How to use Digital Certificates for Signing & Encrypting Messages in XI
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/9727ea90-0201-0010-be8e-b649280fe6ff
Regards
Sampath

Can I bring digital Signatures and with a page when I extract it?

I have a client who is adding their own digital signature to documents after reading them. Our current methodology involves extracting the page with the signature and adding said page to another adobe document for our records. However, the digital signature never follows. I am thinking this is by design, but I cannot find unequivocal confirmation. Does anyone have documentation or knowledge on this topic that will clearly state whether digital signatures cannot be copied when extracting pages, or if it can. Of course, if they can, I would also like to know how. Thank you very much.
Eric

You are correct that this is by design. A digital signature provides an assurance about the entire contents of the document, not just the page that it is on (e.g., the signature field is on the last page of the contract, but the signature covers the entire contract).
Extracting just the page with signature would never leave you with a valid signature because all the other bytes of the file would be missing so the signature would not validate.
If you want a validatable record of the signature, you will need to save the entire document. If all you really need is an informal, non-verifiable record, you could try printing the page with the signature to another PDF file which should show what the page looks like. But that is all you'd have so make sure that meets the legal requirements of your situations.

Digital Signature Validation process goes into unending state

Hi all
I am working Adobe Digital Signatures in Web Dynpro Java applications. I have been using [this|https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/com.sap.km.cm.docs/media/streamingmedia/developer-areas/user-interface-technology/interactive-forms/securing%20online%20interactive%20forms%20by%20adobe%20(Session%208)/index.html?slide=] webinar to follow steps to configure SSL and validation of Digital Signatures.
After doing all necessary configurations, I am able to run my web dynpro applications containing interactive forms in secure mode.
But when I sign with digital signature and try to validate the form, the application keeps on processing and shows no result.
I tried debugging my application but control does not reach my button action code. I am clueless.
I would be thankful to receive any hints or pointers from you.
Thanks in advance.
Kapil

Following blog discusses solution to this prob
/people/kapil.kamble/blog/2009/07/08/experimenting-with-digital-signatures-in-sap-interactive-forms-by-adobe
Kapil

Digital Signature Validation Issue

Hi All,
I have a problem with my digital signature fields. Whenever the user digitally signs the form, there is a message that says that the form is "Signed and all signatures are valid, but with unsigned changes after the last signature". When I open the signature panel (in Adobe Reader or in the Preview PDF tab of Livecycle) the form indicates that a bunch of fields located on the Master Page were deleted and then added (see below). Does anyone know what is causing this or how to fix it?

I'm having the same issue as well. In addition to the additions/deletions to the master pages, the signature panel indicates that a field on the title page of my form was filled in after validation. I ran a temporary script on the signature field's postSign event, using Acrobat's signatureGetModifications() method, to narrow down where the updates are occurring, and it seems that they're taking place either at the same time the signature is validated or just after. The form is set to automatically preserve scripting changes when it is saved; switching to "manual" doesn't help. Turning field locking on/off doesn't work, either. Once the form has been saved and reopened, though, the problem disappears and the signature validates correctly.
UPDATE 30 DEC 14: The master pages that are being "modified" have separate content areas for navigation buttons; it's these CAs, and their associated subforms and buttons, that Acrobat reports as being modified. I tried commenting out the scripts on the buttons' click events without success.
UPDATE 15 APR 15: I've compared the preSign version of the XML for the field that's being modified with the postSign version and found that the XML is somehow being modified by the act of signing the document. To clarify: I need to fill in a date field on my form to indicate when the form is closed out. I have the signature field's preSign set up to add the current date to the date field. The preSign XML includes <value> and <date> tags, which are missing from the postSign version. Why would applying a signature modify the form's XML?

ITunes 9 download - invalid digital signature error with Windows 7 Ultimate

Since I have upgraded to Windows 7 Ultimate when I try and download the latest version of iTunes 9 I get Invalid Digital Signature error message. I've tried downloading with IE8, Opera and Firefox.
Help please!!

Perfect, thanks.
I see that one's got an SPI firewall:
http://www.netgear.co.uk/pdfs/dgn2000ds18july08
By way of experiment, try disabling the firewall and doing another iTunes download. Are you able to get a working installer this time?

Digital Signature problem with 8.2.3

In my group, some associates have Adobe Professoinal 8.1.3 (me included) and others have 8.2.3. I am having people digitally sign documents using their PKI token given to us by the company. When digitally signing, I am still able to write in my own reason in the reason drop-down, but the users with 8.2.3 are unable to do so. Ultimately, I have 2 questions:
1) How can I enable those users of 8.2.3 to write in their own reasons?
2) How can I clean up that drop-down list and delete reasons that I don't use at all or stopped using?
Thanks.

Hi,
Here is how to enable the Reason field to show on the Sign dialog:
Select the Edit > Preferences menu item (Windows), or the Acrobat > Preferences menu item (Mac)
Select Security from the Categories list box
Click the Advanced Preferences button on the Security Preferences panel
Select the Creation tab on the Digital Signatures Advanced Preferences dialog
Select the Show reasons when signing checkbox. I would also highly recommend you select the Include signature's revocation status when signing checkbox as well.
Click the OK button on the Digital Signatures Advanced Preferences dialog
Click the OK button on the Preferences dialog
The Reasons are stored in the registry at HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\<version>\Security\cPubSec\cReasons on Windows on in the corresponding location in the plist file in the users Preferences folder on the Mac.
Steve

Digital signature issues with windows 7

My iphone won't open on my computer like it use to. This all happened when I updated my itunes software. I get a digital signature error. Apple says its a Windows problem. Windows says its an apple problem. Someone please help.

Perfect, thanks.
I see that one's got an SPI firewall:
http://www.netgear.co.uk/pdfs/dgn2000ds18july08
By way of experiment, try disabling the firewall and doing another iTunes download. Are you able to get a working installer this time?

Adding digital signature field with LC Designer vs. LC Digital Signatures

Hi All,
When digital signature field named "SignatureField1" is added to PDF document using LC Designer it appears as "form1[0].#subform[0].SignatureField1[0]" in Adobe Reader signatures tree.
Same field added by LC Digital Signatures service appears as "SignatureField1" in the same tree.
Why? What is the difference between those objects?
LC Digital signatures ES2
Adobe Reader 9.3.0
Thanks, Yan

Yan
First off, there is no difference between the two signature field objects.
I'll do my best to explain why there is a difference in how the signature objects are named in the Signature pane of Reader\Acrobat. When you add the signature field using LC Designer, the object is defined in the underlying XML (XFA) that defines the form. The (SOM expression) you see in Reader (via the signature pane) matches the structure of the form.
When you add a signature field to a form using LiveCycle Digital Signatures ES2, you are appending a signature field "on top" of a PDF form (the underlying XML has been rendered into PDF). The signature field is not defined in the XML, therefore Reader\Acrobat do not display the same naming syntax.
Does this help?
Thanks
Steve

Digital Signature issue with Adobe Form

Dear members,
I have a Adobe Form in my current development which is having Digital Signature set and working fine.
When I have created a new Adobe Form, in which I am calling the same Digital Signature, I am getting below error -
com.adobe.ProcessingException: Signature failure error detected while certifying a PDF for credential alias: DocumentCertification
Processing exception during a "Certify" operation.#Request start time: Mon May 26 16:16:45 BST 2014#com.adobe.ProcessingException: Signature failure error detected while certifying a PDF for credential alias: DocumentCertification##Specific error informat
Am I passing wrong parameters or missing something.
fp_params-NODIALOG   = 'X'.
   fp_params-connection = 'ADS_HTTPS'.
   fp_params-getpdf     = 'X'.
   fp_params-dest       = ls_itcpo-tddest.
   fp_params-nodialog   = 'X'.
   fp_docparams-FILLABLE   = 'N'.
Its not an interactive form.
Any advice would be helpful.
Thank you.
Regards,
Arpit Varma.

Hi,
Just try creating that signature again on that form. Sometimes, copy might not do!
Thanks,
Nitin

Digital Signature validation with expired TSA certificate

Similar Messages

Maybe you are looking for