Flattening PDF with digital signatures

[traceyc28668387]

Can someone explain to me what exactly is 'flattening' a PDF ?  Is it done so a document can't be tampered with?  Why would you need to flatten a PDF?  For printing?  

I was taught to save our documents by Printing to Adobe and told that was flattening, which I've learned now it is also referred to as 'refrying', not a practice supported by Adobe.  The reason we were instructed to 'refry' was so the document could not be tampered with after we save it.  We work with Acrobat so even Optimizing seems like a better alternative, although, I don't think either is necessary.  Several digital signatures are applied to the document but can still be editted after they are applied.  However, I've added a script on my particular form so it locks when the last signature is applied by the manager, which is how I save now.   The other departments are still saving the document by refrying.  As far as I understand, the final digital signature is enough by locking it so it can't be tampered with.  The other departments don't lock after they are signed (for now at least) but I do not think flattening the PDF is necessary, am I correct?  How can I explain that 'refrying' is not good practice?  I kind of understand but I really need help expaining it.  

[abracadabraJRB]

Hi.

All you want to know about refrying is in this document, wroten by Leonard R., aka the "PDF father": Refrying PDFs – the good, the bad and the ugly

==> https://abracadabrapdf.net/file/Refrying_PDF.pdf

Flatten means merging all form fields and comment into the layout, so they become just graphic objects, loosing their field/comment features.

[margueritek]

There is an option to "Lock" the document after a Digital Signature, and that should be used with the last signature. Note that flattening a signed document will invalidate all Digital Signatures. The Digital Signature itself, if the document is locked, is evidence that the document has not been tampered with -- the signature will be invalid if the document is changed.

[traceyc28668387]

Thank you so much for the replies, it has been super helpful for me!  I hope this isn't a stupid question, but is there a way to track if any changes were made before the last signature has been applied and locked?  Is there something in the PDF that says if the second or third person prior to signing made some changes?  Just curious

[ls_rbls]

Please see links below:

[margueritek]

The Signature panel will tell you if there were any changes prior to signing, and you can view the previous signed version.

[ls_rbls]

https://helpx.adobe.com/story/help/track-changes-settings.html  <<-------- how to see changes made in a document

https://helpx.adobe.com/acrobat/using/validating-digital-signatures.html <<--------how to validate sigantures applied in a document

[traceyc28668387]

So I checked the signature panel on a document I saved and all the signatures applied says 'Signature validity is unknown', 'Signer's identity is unknown' etc. I checked out the attachment you sent and went to Preferences/Signatures and 'Verify Signatures When The Document Is Opened' is checked off. I'm lost, how to I made sure the signatures are valid?.

[ls_rbls]

When you are validating signatures You have right-click on the signature field, then click on "Show Signer's Certificate". This will bring up another dialogue box; from that dialogue box click on the "Trust" tab. Then on a button below in that tabbed window click on "Add to Trusted Certificates"; tick the check boxes that apply to whatever you want that signature to validate for. Then click OK button. This will bring you back to the previous dialogue box, where you are going to click on "Validate Signature" button again for the validation to take effect. You will notice in the right pane to the left of the screen that the validated signature will now show a green circle with white checkmark icon instead of a yellow triangle with white exclamation mark

[ls_rbls]

Please see slides below:

[traceyc28668387]

So a fix to this is to change the trust settings.

[traceyc28668387]

I can't seem to insert an image so I'll have to explain, ugh.

[traceyc28668387]

I click on Certificate Viewer and click on the Trust tab. A security box appears 'If you change the trust settings, you will need to revalidate any signatures to see the change. Trusting certificates directly from a document is usually unwise. Are you sure want to do this'. That worries me but anyways, I click ok and tick off Certified documents and the boxes below that. The signature is now verified

[traceyc28668387]

Aside from the box with the scary message saying this is unwise, I assume all the signatures applied should be validated.

[traceyc28668387]

If so, can I default the original fillable form so the signatures are always validated so I don't have to manually change it every time?

[ls_rbls]

Yes that is one way to look at it. But in my place of work I prefer to make it a standard practice to check for the validity of signatures and if changes have taken place in the original document that was sent for signatures... specially if some of those signatures belong to an approving authority that will be certifying like some sorr of legal binding agreement, or money allowances to the other party involved for example

[traceyc28668387]

Absolutely, I think this is very important for what we are using them for! Thank you so much, you have been so helpful, I'm very happy!!

[ls_rbls]

Yes, you're welcome

[traceyc28668387]

So I verified the signatures on the documents fine and saved into our central filing system (we use edocs). Another co-worker opened the same document I verified the signatures on but when he opened the same document none of the signatures were verified, however, I was seeing that they were. Is trusting the certificates bases on the individual's computer? Is there a fix for this on adobe or could it be an edocs issue? Or is it issue at all? Sorry to be a pain, I was so excited thinking it would be all good.

[ls_rbls]

In your other thread I posted an answer that also applies to this one. You were asking if adding AAT lists would resolve this issue . See here: https://helpx.adobe.com/acrobat/kb/approved-trust-list2.html#HowdoesthisprogramcomparetotheCDSprogra...

[traceyc28668387]

Digital signatures have been difficult to wrap my head around, however I think I have a pretty good idea how it works after researching everything I can find to death. I've had concerns with the form that I created displaying 'At least one signatures has a problem' and when clicking on signature field 'Signature validity is unknown'. However, several documents I have read say that say this does not mean the signature is invalid, it just hasn't been trusted. Is this correct, do I need to worry about this message? I understand that Adobe does not trust identities by default, which can be resolved by manually trusting the identities, but this needs to be applied to the user's computer. I understand if the signatures were to show as valid on every computer they would have to be trusted by a third party from the Adobe Approved Trust List. However, this is not necessary considering the individual can only apply their self-signed signature with their personal login and password, subsequent a Microsoft Outlook email our organization's ITS department sets up for them. Considering this, is it possible for our ITS department do something that could ensure the signer's identity is added to the list of trusted identities in Adobe so it shows on every computer within the organization? If not, at least I'll know. Thank you!!

[ls_rbls]

Hi, yes I believe what you are trying to achieve is using the action wizard with the Enterprise toolkit. There is an option to enable and push the loading of trusted certificates "Enable and Install Silently" . You can get more info here: https://www.adobe.com/devnet-docs/acrobatetk/tools/AdminGuide/advancedconfig.html

[ls_rbls]

This uses group policy enforcement with a manual option to use feature lockdowns via registry keys and other methods

[traceyc28668387]

Thanks for the reply. It's kinds over my head but I assume achieving this would have to be applied on each PDF form?

[ls_rbls]

Well, with the Group Policy (GPO) template that task is made easy for the network administrators and IT managers. You just create one template per Active Directory domain and will be enforced in that particular group of user profiles, so there is no need to do ot manually one by one. This is what is known as a push install where the installation does not depend on user interaction at the desktop level, plus each push installation is deployed remotely and centralized from the server