Skip to main content
P
Paul Klerkx
Participant
June 3, 2026
Question

How do I report files signed with expired certificates

  • June 3, 2026
  • 1 reply
  • 17 views

HI, is it possible to report to Adobe that there are several dll’s signed with expired certificates. The following files appeared in logs, and it seems the likely reason for the “Hash Mismatch” report is their use of expired certificates.  
All are signed with a cert that expired last year.  

[DETECT-SUSPECT] Suspicious SIGNED file: C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_asym.dll . Status: HashMismatch
[DETECT-SUSPECT] Suspicious SIGNED file: C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_base.dll . Status: HashMismatch
[DETECT-SUSPECT] Suspicious SIGNED file: C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_base_non_fips.dll . Status: HashMismatch
[DETECT-SUSPECT] Suspicious SIGNED file: C:\Program Files\Adobe\Acrobat DC\Acrobat\ccme_ecc.dll . Status: HashMismatch
[DETECT-SUSPECT] Suspicious SIGNED file: C:\Program Files\Adobe\Acrobat DC\Acrobat\cryptocme.dll . Status: HashMismatch

version is 2026.001.21563

      1 reply

      T
      Community Manager
      Tariq Ahmad DarCommunity Manager
      Community Manager
      June 4, 2026

      Hi ​@Paul Klerkx,

       

      Thank you for bringing this to our attention and for the detailed information you've shared. We take certificate integrity and security flagging seriously, and we want to ensure this is properly investigated.

      We will be escalated this internally to the Adobe Acrobat engineering and security teams for review.

      To help us investigate further, could you please provide the following information?

      1. Adobe Acrobat DC version (Help > About Adobe Acrobat DC) - We already have that.
      2. Operating System version and build (e.g., Windows 10 22H2, Windows 11 23H2)
      3. Installation type: Was Acrobat installed via Creative Cloud, direct download, or enterprise deployment (MSI/PKG)?
      4. Date when these alerts were first observed
      5. Security/endpoint tool generating the DETECT-SUSPECT logs (e.g., EDR, AV solution name, and version)
      6. Was Acrobat recently updated or patched prior to the alerts appearing?
      7. Are the flagged DLL files present at the default path: C:\Program Files\Adobe\Acrobat DC\Acrobat\?
      8. Has a clean re-install of Acrobat DC been attempted? If so, did the issue persist?

      We appreciate your patience while we look into this and will follow up as soon as we have more information.

       


      ~Tariq

      Terms & ConditionsAccessibility statement
      Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices