Restricting application of Digital Signatures

Question

Hello,
I am trying to determine what options are available natively in Acrobat for restricting the type of certificate that is used for applying a digital signature.  As far as I can tell, Acrobat, by default, seems to allow the use of any certificate which has the "Digital Signature" extension.  This has the potential to create large problems in a regulated environment.
In my organization, our users receive multiple certificates for different applications.  For instance, a user may have a certificate for VPN access, one for SMIME email and finally, one that is specifically for applying eSignatures.  There is a more robust vetting process for obtaining an eSignature certificate, and it also prompts for a passphrase each time the private key is accessed.  Each type of certificate comes from a separate CA.
We've configured the Trusted Identities in each user's Acrobat by deploying an addressbook file to them.  We've only defined our eSignature CA as a trusted CA in Acrobat (along with some other universally trusted authorities).  The result is that when a signature that has been applied using any other CA, Acrobat will not verify the signature.  This is good, but it is not good enough since the dynamic images that come with Acrobat digital signatures do not appear on printed or flattened documents.
Basically, I'm trying to determine whether there is a way to configure Acrobat (natively, out-of-the-box) such that it will only allow application of digital signatures using certificates that are issued from a CA that is defined as a Trusted Identity.
Has anyone encountered this before?

Answer 1

Hi Mike,
The short answer is yes, you can restrict signing to a certain type of certificate. However, you do need to be able to edit each PDF file that needs to be signed.
To expand a bit, the process is know as applying a Seed Value. There are two different types of PDF files and they each have a different method of applying Seed Values. If the PDF is an XML template that was created using LiveCycle Designer, then you can apply the Seed Value to the signature field using the Designer software. On the other hand, if the PDF file is the more ubiquitous AcroForm (e.g. you converted a Word Doc to PDF), then you have to use JavaScript to apply the Seed Value.
Before I get into the specifies of applying a Seed Value, first here is what a Seed Value can do. Among other things, you can use Seed Value to restrict signing to:
a specific user's digital ID
digital IDs issued by a specific CA
a digital ID that has a specific key usage value (it sounds like this is what you are looking for)
If you need to use JavaScript you are doing to want to review the published JavaScript guide. You can find the guide online at http://livedocs.adobe.com/acrobat_sdk/9.1/Acrobat9_1_HTMLHelp/wwhelp/wwhimpl/js/html/wwhel p.htm?href=JS_API_AcroJSPreface.87.1.html#1515775&accessible=true and search search for Seed Value. More specifically, you are looking for the JavaScript call signatureSetSeedValue and the section (about half way down the page) CertificateSpecifier Object. At the bottom of the page are examples of how to set the certspec object.
If you are using LiveCycle Designer you need to display the Object pallet. Select the Window > Object menu item to get the Object pallet to display. Then, select the signature field that you want to apply the Seed Value to, select the Signature tab in the Object pallet, and then click the Settings button. This is the dialog you use to apply the Seed Value.
Good luck and let me know if you need more help,
Steve