Sign with CryptSignMessage

[mauriciov51614002]

Hello. I'm signing a document with CryptSignMessage (C), but when I open the document in Adobe, it tells me it's been modified or corrupted. Any recommendations on where the problem might be?

[Thom Parker]

I opened the file you posted with out any error messages, other than an invalid signature. What the type and version of Acrobat do you have? 

[mauriciov51614002]

I have version 2025.001.20435. The document does open, but when validating the signature, it indicates that it has been modified or corrupted. However, I've tried recalculating the SHA256 after adding the signature to the document, and it matches the one created before signing. I don't know what else I should check...

[Thom Parker]

Something must have happened to the document.  There is no way for us to debug this.  Try contacting Adobe support. Perhaps they have a bug. 

https://www.adobe.com/products/wishform.html

[AnandSri]

Hello!

I hope you are doing well, and thanks for reaching out.

As highlighted by our community product experts, if you have the source file, try creating the PDF again and adding the signature. If the PDF structure doesn't fully comply with Adobe's expectations for digitally signed documents, you may get the error message.

Ensure PDF Signature Compliance: Adobe expects signed PDFs to follow the PDF digital signature specification (as per ISO 32000-1 and ETSI PAdES standards😞

• Signature must be embedded in a dedicated signature field within an incremental update.

• The byte range specified in the PDF must exclude the signature value itself.

• The signature should be DER-encoded and embedded correctly within the /Contents field.

Even if the SHA256 hash matches, if the byte range is incorrect or the document was not signed in a proper incremental save, Acrobat will flag it as modified.

Use Adobe's Validation Tools

After signing, use Preflight (in Acrobat Pro) to validate the document structure and confirm that:

• The signature field is present and well-formed.

• The document hasn’t been incrementally saved incorrectly.

• No invisible changes were introduced after signing.

Use Adobe's Validation Tools: After signing, use Preflight (in Acrobat Pro) to validate the document structure and confirm that: The signature field is present and well-formed. The document hasn’t been incrementally saved incorrectly. No invisible changes were introduced after signing.

Ensure that the CSP used for signing is correctly configured and called during the signing process. Refer to this article for more information: https://adobe.ly/4jChpLp

Download and install the latest build from the Menu > help > check for updates, restart the machine after installing the updates, and check. 

I hope the above information helps.

Thanks,

Anand Sri.

[ls_rbls]

Hi @mauriciov51614002 ,

In my initial review, it appears that you may have used an invisible certification signature, possibly through Adobe Acrobat Reader. However, after further investigation into the CryptSignMessage function you applied, I am beginning to doubt whether the SHA1 digest has been compromised.

I recommend looking into the following discussions for additional information:

• https://crypto.stackexchange.com/questions/22425/is-rsa-with-sha1-broken

• https://stackoverflow.com/questions/11052048/how-to-use-result-of-cryptsignmessage-with-openssl-to-v...

• https://community.adobe.com/t5/acrobat-discussions/print-to-pdf-aptos/m-p/14394751

Moreover, after several more reviews of the file you shared, it seems the main issue stems from the missing Aptos Font Type.

This font has not been embedded in the document, which causes significant issues when the file is accessed in Adobe Acrobat Reader or Adobe Acrobat Pro DC.

As @Thom Parker noted, the document is fundamentally corrupted and cannot be examined using other methods or tools, such as the Print Production tool or the Preflight utility.

While I successfully ran the Validate Signature and confirmed the certificate's authenticity along with the signer's details without any errors, the key issue remains the unembedded Aptos font.

Thus, this problem is more related to the CryptSignMessage function than to Acrobat Pro DC, and it may be beneficial to seek advice in the Microsoft Support forums:

• https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptverifymessagesignature

Please verify if any steps were missed with any method that you deployed  prior to the encryption of your message.

[mauriciov51614002]

Thanks for your feedback. I changed the test document, but I'm still getting the same error message.

I'm starting to think it's a bug in pkcs7, but I haven't been able to find anything concrete.

[JR Boulay]

[MOVED TO THE ACROBAT FORUM]