Help Needed with Signature Validation Issues in Adobe Pro

[hevin_7295]

Hello,

I, along with some colleagues from our International Unit, have been using the Adobe Pro version primarily for its signing feature. However, we've encountered an issue where our signatures, once certified and opened by other parties, display as having unknown validity (please refer to the attached screenshot for details). For comparison, I've also attached a document received from a partner, whose signature appears validated.

Could anyone in the community advise on why our signatures aren't being validated like our partner's? Are there specific settings or updates that we need to implement to fix this problem?

[MikelKlink]

Whenever you provide screen shots here, it would be nice to first switch the language of Acrobat to English. In this case I used Google Translate to translate the text but in general translated text is only useful to a certain extent.

Nonetheless, in this case I get:

which quite clearly indicates that "the identity of the signer is unknown as it is not in the list of trusted certificates and none of the parent certificates are trusted certificates."

What certificates do you use for signing?

• Do you use self-signed certificates? In that case you cannot someone else's Acrobat to know and trust your certificates.
• Do you use certificates internally issued by your company? Again you cannot expect the Acrobat of anyone outside your company to know or trust your certificates
• Do you use certificates issued by an external certificate authority that is not listed on either Adobe's AATL trust list or the EU trust lists? Once again, by default Acrobat only trusts AATL and EUTL CAs.

In any of these cases it is of no surprise that external recipients of your signatures cannot positively validate your signatures. You should use a certificate issued by a CA listed on the AATL or the EUTL.

If your signer certificates are issued by such a CA, though, there still might be issues.

E.g. if the issuer certificate still is new, it might not yet be in the list Adobe provides for the Acrobat instances. It sometimes has taken Adobe a number of months to update their lists accordingly. In that case contact your CA and ask them for advice.

Other issues also are possible. To analyse them, though, we'd need to analyze example PDFs signed with your certificate.

[hevin_7295]

Thank you for your detailed response. 

I'm not sure how to identify which type of certificates we currently use. Could you advise on how one might determine if our certificates are self-signed, internally issued by our company, or issued by an external CA not listed on Adobe’s AATL or the EU’s EUTL lists? Additionally, any guidance on selecting the right CA and setting up these certificates once chosen would be extremely helpful.

General criteria or tips on identifying, choosing, and configuring a CA recognized on Adobe's AATL or the EU's EUTL lists would be greatly appreciated.

Thank you once again for your help!

[MikelKlink]

If I understand you correctly, your signed PDFs look valid in your Acrobat instances.

When you open the "Signature Properties" dialog of the signature and there select "Show Signer's Certificate...", which certificates do you see? And what do you see when you look at the "Trust" tab for each certificate? In particular, do you see something like this for one of the certificates:

[Tariq Ahmad Dar]

Hi @hevin_7295, 

In addition to what @MikelKlink asked and described. 

You can visit this Help document: https://adobe.ly/3QYyDpR that describes how the validation works. 

In short, if the certificate was created locally on the machine and is local to the system, the signature validation can't happen on the second machine. 

~Tariq