How to filter list of digital certificates for signing PDF

Question

Is it possible to change the configuration of Reader installation to filter the list of installed certificates that can be used for digitally signing documents?
The filtered list will appear when users attempt to select a certificate for digitally signing a document.
Thanks.

Answer 1

Hi Carla,
Unfortunately, Extended Key Usage is not one of the properties you can enforce.
The things you can set are:
appearanceFilter (i.e. enforce the use of a custom signature appearance)
certspec(i.e. the signing certificate must meet some specific criteria)  <<<----- This is what you are more interested in, more below
digestMethod(i.e. enforce the use of a specific cryptographic hashing algorithm)
filter (i.e. enforce the use of a specific security handler if you want to use something other than the one built into Acrobat)
legalAttestations (i.e. enforce the reason or purpose of the certifying signature)
lockDocument (i.e. enforce any further changes to the document after the signature is applied)
mdp (i.e. the rules for changing the document applied as part of a certifying signature)
reasons (i.e. a list of one or more reasons the signer can use, as opposed to them adding their own)
shouldAddRevInfo (i.e. force the inclusion on the revocation information (CRL or OCSP response) in the PDF file)
subFilter (i.e. require the use of a specific signature format. This is very arcane)
timeStampspec (i.e. require the use of a specific time stamp server)
version (i.e the minimum version of Acrobat that can decipher the signature. the only two options are versions 6 or 8)
The second item is the certspec, and this is what I've been pointing you towards. For the sake of discussion, think of everything you can read in a certificate as an extension. The serial number is an extension, the subject is an extension, the valid from date is an extension, etc. When a certificate is created, some of these extensions are required, other optional, and you can even add in extension that are not publicly defined, and only you will know about.
Acrobat has the ability to enforce the signer to use a certificate that contains some, but not all of the known extensions. The extensions it can enforce are:
issuer (i.e. require the use of a certificate that is issued by a specific Certificate Authority)
keyUsage (i.e. require the signers certificate contain one or more of the nine possible values that can be included)
oid (i.e. require that the Certificate Policy extension contain a specific value)
subject (i.e. require that the document is signed by one specific person using one specific digital ID)
subjectDN (i.e. require that the document is signed by one specific person, but they get to choose which digital ID to use)
url (i.e. if a required digital ID is not available, where the signer can procure an acceptable digital ID)
urlType (i.e. if the user is directed to the URL, should it be a web server where they can download a digital ID or a remote signing server where the digital ID stays on the remote server)
That's it. If it's not one of these items then Acrobat cannot enforce that the item is available. Extended Key Usage is not on the list.
Steve