Exclude Internal Corporate Certificate from Adobe Acrobat Reader Signing Certificate Selection

Hello,

We are experiencing an issue with certificate selection in Adobe Acrobat Reader and would like to know if there is a supported way to manage which certificates are displayed in the digital signing dialog.

In our organization, users have multiple certificates available in their Windows Certificate Store (Current User\Personal\My):

• An internal corporate signing certificate used for internal business processes and corporate applications.
• A qualified digital signature certificate issued by an external trusted provider, used for legally valid document signing.

The problem is that Adobe Acrobat Reader displays both certificates when users sign PDF documents. Since the certificates often appear very similar to end users, they frequently select the wrong one and sign documents with the internal corporate certificate instead of their qualified certificate.

The internal corporate certificate cannot be removed from the Windows Certificate Store, because it is also required by other applications for authentication, authorization, and internal business processes. Therefore, removing the certificate from Windows is not a viable solution.

We would like to know:

• Is there a way to prevent Acrobat Reader from displaying specific certificates from the Windows Certificate Store?
• Can Acrobat filter certificates based on issuer, certificate template, EKU, OID, key usage, or any other certificate attribute?
• Is there a registry setting, configuration file, enterprise policy, GPO, or scripting method that controls which certificates are shown in the signing dialog?
• Does Acrobat Reader maintain its own certificate list or cache, and if so, where is it stored?
• Is there a supported enterprise method to hide internal corporate certificates while keeping qualified certificates available for PDF signing?

We have already reviewed the Windows Integration settings in Acrobat Reader, and all related checkboxes are currently unchecked. However, Acrobat Reader still displays certificates from the Windows certificate store.

Our goal is to prevent users from accidentally selecting the internal corporate certificate and to present only qualified signing certificates in the certificate selection dialog.

Has anyone encountered a similar situation or implemented a solution in an enterprise environment?