Digital Signature Shows Valid in Bluebeam and DocuSign Prepare & Sign but not Adobe

[Brandy5E62]

I have updated Adobe AATL listings in trusted certificates preferences, but still all signtures show up invalid in Adobe but show up valid in Bluebeam. Anyone know why? See image of th same document opened below in teh two applications. I am using Adobe Reader DC. 

Document attached.

[Brandy5E62]

Document attached in pdf 

[margueritek]

If you examine the errors from the signature panel "click to view this version" then click "View Report" in the banner bar of the signed version, you will see that Acrobat believes some content may have been altered;

Acrobat doesn't just validate the digital signature itself to determine signature validity, it also checks that the document doesn't have modifications that might alter the appearance. You can see that the digital signature portion is valid, but that the signature is marked invalid because of potential document modifications. I suspect that other viewers are not so careful.

[Brandy5E62]

Ok - I see the "recognized PDF Content" code above. Maybe that is the resason. The documents were produced in Bluebeam for designers and maybe Adobe is not recognizing it. Opening the same document in all other readers poses no errors in signatures (they are third-party validated" and no changes were made form teh time of signing so we eliminated that issue.

[margueritek]

The issue isn't with the digital signature itself:

• Source of Trust obtained from Adobe Approved Trust List (AATL)
• Signer's identy is valid
• Signing time is from the closk on the signer's computer
• Signature is LTV enabled

But somewher in Acrobat's Document Modification Analysis code

• Document has been altered or corrupted since it was signed.

That code doesn't throw detailed enough errors for me to see just what Acrobat doesn't like. Sorry. You would need to find a real Acrobat engineer who has access to debugging development versions of Actobat to analyze that further. If Bluebeam is doing the signing, you might look to them and see if they are adding custom keys to the Signature Dictionary or using a custom appearance that Acrobat doesn't understand. Certainly any change to a page content stream would be disqualifying. Beyond that, I can't help. There are others on this forum who might have more tools available.

[MikelKlink]

In short:

When the first signature was applied, the document has been saved with a minor error. As we know, PDF viewers in general ignore or repair a lot of minor errors, so no viewer warns about it. Adobe Acrobat also ignores it. Usually that is. Except when checking for a signature (except the final signature of the document) whether there are any disallowed later changes, in that case that error results in such a validation failure.

(Most other validators ignore that error. But most other validators also do not even check for disallowed changes after a signature...)

Thus, tell the initial signer that their signing software has a bug and ask them (and all later signers) to sign again with a signing software without such a bug.

In detail:

At the end of each revision of a PDF there is a cross reference table or stream mapping object numbers to their respective position in the file. According to the PDF specification the cross reference of the initial revision must not be segmented.

In case of your document, though, it is segmented:

...
xref
0 5
0000000000 65535 f 
0000000018 00000 n 
0000001081 00000 n 
0000001148 00000 n 
0000001229 00000 n 
6 383
0000000000 65535 f 
0000000000 65535 f 
0000001402 00000 n  
...
0003339748 00000 n 
0003355369 00000 n 
0003356639 00000 n 
trailer
...

Thus, Adobe Acrobat will consider each signature in your PDF broken except the signature of the full document.

For more details see these stack overflow answers:

• https://stackoverflow.com/a/30551466/1729265
• https://stackoverflow.com/a/45163411/1729265
• https://stackoverflow.com/a/55939114/1729265
• https://stackoverflow.com/a/67641001/1729265
• https://stackoverflow.com/a/68806481/1729265

[mikeh40071053]

Has an actual fix been found for this?  We experience the same issues and it's quite annoying as we were told everything in Bluebeam works seemlessly with Adobe.  

[Brandy5E62]

Not that I have seen. Adobe Support told our IT folks that Microsoft has to issue a fix for it and Microsoft Support also told our IT folks that Adobe has to issue a fix for it. So far NEITHER Adobe and Microsoft have reported that THEY are working together on issuing a fix for it. We are stuck right now between the two waiting or a fix that is impactg all of our users. Frustrating!

[MikelKlink]

Has an actual fix been found for this?

You should ask Bluebeam support. After all, Bluebeam creates a broken PDF to start with.

(If Microsoft support doubts that it's their issue, point to the technical explanation above and pray that you have someone with a technical background on the line.)

[Zak27230354wk0z]

I am now just starting to have these issues after over a year of using BlueBeam. If I sign the document in adobe, everything is fine but I dont want to use adobe bc it takes forever so sign multi-page files. The Batch Signature feature of Bluebeam saves me so much time. 

[Zak27230354wk0z]

Has anyone found a solution?

[MikelKlink]

Which version do you use?

In the Revu 21 release notes I find the entry

• Fixed an issue where signatures were incorrectly showing as invalid.

https://support.bluebeam.com/articles/revu-21-release-notes/

which might refer to the bluebeam bug this thread is about.