Pulling my hairs for a valid pdf signature

Question

Using Acrobat Pro 9 with a new server certificate from a different CA I've been trying to put a valid signature in a pdf file. For some reason acrobat is giving me the "Signature is invalid" message with a red cross. When I open the Certificate-details dialog I see a "!" at the bottom with the message "The selected certificate path has errors: Invalid policy constraint". I'm not really sure what this means? which constraints are invalid? Then I read acrobat can make a log file during the validation process so I wondered if this could help, I got something like this (I edited some parts to protect my client):
20110913195706Z:
20110913195706Z: Validating cert graph with 1 chains
20110913195706Z: Validating chain: CertChain_[edit] Length = 5
   20110913195706Z: ----ChainBuilder----
      20110913195706Z: Processing Certificate: DN: cn=[edit] CA - G2, o=[edit], c=NL Serial: [edit]
      20110913195706Z: verification time = 20110913131236+0200
      20110913195706Z: Processing Certificate: DN: cn=[edit] - G2, o=[edit], c=NL Serial: [edit]
      20110913195706Z: verification time = 20110913131236+0200
      20110913195706Z: Processing Certificate: DN: cn=[edit] - G2, o=[edit], c=NL Serial: [edit]
      20110913195706Z: verification time = 20110913131236+0200
      20110913195706Z: Processing Certificate: DN: cn=[edit] - G2, o=[edit], c=NL Serial: [edit]
      20110913195706Z: verification time = 20110913131236+0200
      20110913195706Z: Processing Certificate: DN: cn=[edit], ou=[edit], o=[edit], l=[edit], st=[edit], c=NL Serial: [edit]
      20110913195706Z: verification time = 20110913131236+0200
      20110913195706Z: Chain builder added trouble flags 0x200
   20110913195706Z: Finished Chain Validation.  TroubleFlags: 200
20110913195706Z:
I'm particularly interested if anyone knows what this line "Chain builder added trouble flags 0x200" means???
Any help is greatly appriciated!

Answer 1

Hi lullolullo,
You've come the right place. Signature validation starts with trust. If you don't trust the signer, or one of the certificates in the signing chain then nothing happens. A signature chain looks something like this:
Big Time CA Root Cert
    Intermediate Certificate Authority
        End-Entity (the signer, or in this case, you)
You have to assign trust to at least one of the certificates in the signature chain. You can either add trust via the Manage Trusted Identities dialog, or, via a preference where you can inherit trust from the Windows Certificate Store (Windows only, no Mac). To see the chain in the signature you are looking at do the following:
Right Mouse Click on the signature
Select Show Signature Properties from the pop-up menu
Click the Show Certificate button on the Signature Properties dialog
The chain is displayed in the tree view on the on the left side of the dialog
If you select the Trust tab and then select the different certificates in the chain view you will be able to see which one is the trust anchor.
Enough about trust, on to Policy Restrictions. When a Certificate Authority (CA) issues certificates they will often add the Certificate Policy extension. You can find this by selecting the Details tab and scrolling the list box for  Certificate Policies. The policy is a long dotted number that acts as a marker for a specific set of rules. The rules themselves tend to be published online in a "Certificate Practice Statement" document, but that's getting a little beyond the scope of your problem. The rule might mean something like all certificates issues under this policy constraint are issued to employees of Company XYZ and have to be on a hardware token. That's an example of something you might see, but I'm not saying it the exact scenario you are facing.
The Root CA usually doesn't have a Certificate Policy extension, but all of the certs under it do meaning that this particular chain obeys a specific set of rules.
On to enforcing the rules. Let's say you have Big Time CA that issues certificates for IBM, Microsoft, Apple, and Adobe. Each one of those chains would contain a different Certificate Policy. Now let's say that I've trusted Big Time CA, which means every signature that created that chains up to Big Time CA would be trusted and valid. Now lets say I only want to trust the signatures that come from my fellow Adobe employees. What I would do is add a Policy Restriction to the trust setting, thus making trust more granular.
Next up, where to find the Policy Restriction. Select the Policies tab on the Certificate Viewer. When you are viewing the same certificate that is designated as the trust anchor do you see something in the Policy Restrictions group box? By something I mean data in the Certificate Policies edit field that will appear to be grayed out. If so then the signers certificate, and all of the other certificates in the chain have to have the Certificate Policy Extension with that number in it.
If the restriction is there, you can remove it by going to the Manage Trusted Identities dialog, which you get to from the Advanced menu. From there you need to select Certificates from the Display drop-down list. Find the certificate that corresponds to the trust anchor, selected from the list box, and then click the Edit Trust button. Finally, select the Policy Restrictions tab on the Edit Certificate Trust dialog. However, I'm not advising you to break any company policy if they want the restriction in place.
Steve