Trusted (not) Certificate

Question

I have two digital IDs in the Acrobat system.  One is self-signed, created, somehow, within Acrobat, if I remember correctly.  It is considered a trusted root, or something to that effect.  And, is totally useless for sending and having sent back forms created in the Designer.  The other certificate was purchased from VeriSign, exported (backed up) from Firefox, and added to the Digital IDs in Acrobat.  The issuance chain seems not to go back to some root certificate, and it is not trusted.  So, I cannot use it to send and receive the forms securely.
How do I find the proper information for Acrobat to "trust" the furshluganeh thing?

Answer 1

Hi,
There are a couple of different concepts in play here.
First, let's discuss trust. When it comes to digital signatures, without trust being assigned to a certificate in the signing chain, nothing happens. As an aside, trust is granted by the document recipient (the person that is verifying the signature), it is not assigned by the document signer. There is no way for the signer of the document to imbue the PDF with trust.
When I talk about the signing chain I mean something that looks like this:
Root CA Intermediate CA End-entity
Note: I could have put the list in the opposite order; it's like being in outer space, there is no up or down, just moving in some direction.
The recipient of the signed PDF may elect to make any of the three certificates (in this example, there could be more or less than three) in the signing chain the trust anchor (aka the trusted root). Acrobat only does revocation checking on the certificates below the trust anchor (below being relative to the way I typed out the signing chain), but not the trust anchor itself nor any certificates above the trust anchor. If you were to make the end-entity the trust anchor Acrobat wouldn't do any revocation checking as part of the signature validation routine. If you were to make the Intermediate CA the trust anchor, Acrobat would only do revocation checking on the end-entity, and if your were to make the Root CA the trust anchor Acrobat would do revocation checking on both the Intermediate CA and the end-entity. Although the signer cannot assign trust to the signature, it is important that they have trust set correctly so Acrobat will do the revocation checks as part of the signature creation process so the revocation information gets downloaded, and ultimately imbedded into the PDF signature in order to facilitate long term validation.
When you tell Acrobat (and when I say Acrobat I always mean both Acrobat and Reader, but I too lazy to type both words) to trust the Root certificates from the Windows Certificate Store we're talking about the certificates listed on the "Trusted Root Certification Authorities" tab on the Windows Certificates dialog. The certificates listed on any of the other tabs (e.g. the Personal tab) are not being trusted for digital signatures in Acrobat.
This brings us to issue #2, secured delivery. In order for secured delivery to work, the recipient must trust the signer that sent them the file. The only way that we can insure that the recipient will trust the signer is to insist that the signer uses a digital ID that chains to the Adobe Root CA. Although I said that the signer can't imbue a signed PDF file with trust, because every copy of Acrobat and Reader comes pre-configured with the Adobe Root CA already install and trusted  for certifying signatures, when using a digital ID issued by one of our partners it insures that the recipient won't need to fuss with the trust settings. Thus, when we added the feature we made it so the only time the Secured Delivery button is enabled is if you have a digital ID that chains to the Adobe Root CA.
One thing about digital signatures, it's a one time creation event, and an many time validation event. I know it's frustrating for you as the signer to deal with this issue, but imagine if you were distributing the form to hundreds of people and they all had to get the trust anchor set before they could securely return their data, the frustration would be growing exponentially.
Steve