To all of those having this problem, if you would put an example PDF somewhere in a public share, we could take a look at the file internals and try to diagnose the problem. I am not currently an Acobe employee (and probably also the case for try67).  However we do know a lot about PDF and Acrobat. ... View more

You really need to send an example document, one created without confidential information, to Adobe to analyze. There are many reasons for this behavior, often due to sloppy PDF generation tools. For instance, not marking the PDF as containing digital signatures, or not properly constructing the AcroForm Widget entry. Or using an old version of Acrobat, which doesn't correctly handle deleted signatures. All can be revealed with a PDF debug tool, but the real reason can't be guessed at from "some people can see it and some can't". ... View more

The portal says: "Signatures with digital certificates from infrastructure other than ICP-Brasil are not targets of this verifier and will be refused for verification.". Does your signature comply? ... View more

To beat a dead horse (and then I'll stop). The PDF 32000-2 spec says: "A PDF processor shall attempt to read any PDF file, even if the file’s version is more recent than that for which the PDF processor was created." So that puts the onus on the indexing program to come into line. ... View more

There was ISO 32000-2:2017, and now there is 32000-2:2020. Should we wait for 32000-2:2023? Changes are still being made to the standard. I don't have a copy of the latest version, since ISO charges $200 for a copy. Acrobat will open a file marked as PDF-2.0, as will the Microsoft Edge built-in viewer; but I don't know of any producers that take advantage of any of the new features. There are certainly improvements, especially in the area of PDF/A and related archivable formats, but most of them are backward compatible. Let's pull up a chair and see what happens. ... View more

Sorry for the problem. First, you should contact tracker-software and tell them their Print converter is broken. There is no such thing as PDF 2.0 yet, and even if there was, they shouldn't over-label a version if the features of that version aren't present. Next, tell the folks who make the indexing program that a file labeled 2.0 is just the same as a file labeled 1.7, and to fix their program. Even when 2.0 is released, it will be largely backwards compatible with earlier versions -- it just has a few more features. Finally, you can get a scripting plugin for Notepad++ which may allow you to convert your files in batch mode (replace '%PDF-2.0' with '%PDF-1.7').   Good luck. ... View more

If you change the version number, any signatures will be invalidated. However, all the PDF will be unchanged. How likely is it that one of the files with version 2/0 is digitally signed? If that's a real possibility, maybe you need to get a new version of your indexing program. ... View more

Just so. Change the version to 1.7. If the file is not signed, this should not render anything invalid. GhostScript might work, or a Hex Editor in Visual Studio. Perhaps Notepad++ (though I haven't looked to see if it preserves binary)   Followup: Notepad++ seems to preserve binary, and you can install a Hex editor from Plugins-admin ... View more

What program is generating PDF 2.0? That version is still in the voting stage at ISO, I think. Will Acrobat open the file? If so, SaveAs Optimized and set the version to 1.7 or something.   The very first bytes of the file probably say %PDF-2.0 change that to %PDF-1.7 You might need to use a Linux command that can preserve the binary bytes in the file. ... View more

You say that the Manager Signature is st to Lock when signing. But have you ensured that the other signatures (specifically the Timekeeper signature) are explicitly set to "Don't Lock" when signing? ... View more

Most 3rd party signature validators only check the cryptographic validity of the CMS signature, and may also check the revocation status of the signing certificate. Acrobat, in addition, performs "Document Modification Analysis" to detect changes to content or field values that may cause the signature to be declared invalid due to "document has been altered or corrupted since it has been signed". The CMS signature may be valid. Adobe has not, to my knowledge, documented the internal checks that Acrobat and Reader make to reach that determination. It's more complicated than you might think. ... View more

There are some theoretical exploits, generally involving invalid objects and misuse of white space, which I have never seen in real life. Rewriting all the unsigned incremental sections (including the linearization section) prevents these exploits (unless you have an evil signing program). ... View more

The first signature in a document should never be an incremental save. Acrobat and Reader should consolidate all non-signature sections into a single section that is signed. The test document you posted was created by PDFMaker 11.0 as a linearized PDF, which has a small section at the head of the file so that the first page can be rendered while the rest of the file is being loaded. I believe the signing process should de-linearize the file, so that the first signed section is the first section of the file (to the first EOF). In this case, the signature is in an incremental section following the linearized head. My analysis may be incorrect, as its been a few years since I had that code in front of me. Can you try signing with an older version of Reader? ... View more

The document wasn't signed by Acrobat or Reader. The first signature in a document should not be in an incremental save section.  ... View more

The issue isn't with the digital signature itself: Source of Trust obtained from Adobe Approved Trust List (AATL) Signer's identy is valid Signing time is from the closk on the signer's computer Signature is LTV enabled But somewher in Acrobat's Document Modification Analysis code Document has been altered or corrupted since it was signed. That code doesn't throw detailed enough errors for me to see just what Acrobat doesn't like. Sorry. You would need to find a real Acrobat engineer who has access to debugging development versions of Actobat to analyze that further. If Bluebeam is doing the signing, you might look to them and see if they are adding custom keys to the Signature Dictionary or using a custom appearance that Acrobat doesn't understand. Certainly any change to a page content stream would be disqualifying. Beyond that, I can't help. There are others on this forum who might have more tools available. ... View more

If you examine the errors from the signature panel "click to view this version" then click "View Report" in the banner bar of the signed version, you will see that Acrobat believes some content may have been altered; Acrobat doesn't just validate the digital signature itself to determine signature validity, it also checks that the document doesn't have modifications that might alter the appearance. You can see that the digital signature portion is valid, but that the signature is marked invalid because of potential document modifications. I suspect that other viewers are not so careful.   ... View more

It's probably complaining that 'mycompany' is not a valid domain. Did you mean 'mycompany.com'? I don't know why it cares, but some developers fixate on funny things. ... View more

When you open the file properties: What is the Application that produced the file, and what is the PDF Producer and PDF Version? ... View more

The idea of LTV is to enable validation of a signature at a time after the signing certificate has expired. This answers the question "was the signature valid at time of signing". You are asking that the signature (and the signed document) be invalid after the certificate expiration date. Is this what you really want? ... View more

Of course, even if that worked, you would have to open the PDF in order to run the Javascript. You want a Content Management System (CMS) or something like LiveCycle. ... View more

Audit trails are part of the Adobe Sign process. I believe there is an option to deliver the audit trail as a separate document, rather than appending it to the signed document. But that won't solve your problem, because the signed document is certifiec with a digital signature and any attempt to change the document will invalidate that certification. ... View more

A copy of the file is NOT contained within the signature. However, the validation information (Certificate Revocation Lists) are included. Some CRLs are huge. You might try not including validation information with the signature. This make long-term validation morer difficult, if the old CRLs are not available. ... View more

I'm not quite sure what you are trying to do. If you apply a digital signature to a document, you are signing the hash value of the document (technically, the hash of everything except the signature itself, since you can't hash that becsuse you don't know what the signature bytes will be until after you generate them). Why would you then need to take another hash of the document? Checking a signature involves taking a hash of all of the bytes of the document except for the signature. If you use a different value for your "hash" then the signature will be invalid. ... View more

A Certification signature will be invalidated or removed if any of the security bypasses are invoked, so you can tell that the form has been modified. It's been a losing battle to convince 3rd party viewers to honor PDF security settings. ... View more

I don't think that's possible. Once an AdobeSign document is completed it is encrypted with an "Owner" password and restricted permissions, AND it is signed with a Certification signature that allows no modification to the file. That's all so that anyone receiving the document will know that it is exactly what what signed, with no changes.   There should be no "User" password, so anyone can open and read the file. If you are having problems with that part, you need to see that you are using a viewer with sufficient capabilities, such as Adobe Reader or Acrobat. Unfortunately, many of the built-in browser viewers are deficient in that area. ... View more

There are actually two different things going on, here. First is the Certification signature by AdobeSign. That, in itself, does not encrypt the file. Second is an "Owner" password applied by AdobeSign that encrypts the file and restricts the actions that can be performed on the file. Unless you specifically asked for password encryption, there should be no "User" password, but the file will be encrypted. That should not preclude access, however. What are you trying to do with the file? ... View more

There were changes made to Acrobat/Reader at version XI specifically to support digital signatures for Adobe Sign. Any later version should be OK. If you are seeing this in a web browser, that's because the web browser's PDF viewer doesn't support digital signatures. Download the file and open in Acrobat/Reader. ... View more

If the signature was really ECDSA it would have an ECDSA algorithm, which is not shown in your dump. It would also have a curve specifier, which again is not shown in your dump. You might ask where Acrobat would get the algorithm and curve for signing, if not from the final certificate in the chain (the one on the Smart Card). We know it is using the Smart Card certificate because the signature shows as Qualified, and the private key is on a Secure Signature Creation Device (the Smart Card). You need to get a real ECC certificate from ADIC. ... View more