Participant

Question

Signature verification - the name after 'Signed by' differs case by case.

Forum|Forum|3 years ago
August 4, 2022
1 reply
678 views

I use GlobalSign AATL digital certi to PDF for signing certificate.

After signing, I found that the name after 'Signed by' differs case by case.

I wonder why this happens and what should I do to fix the name?

If you have any idea, I really appreciate.

Have a nice day!

This topic has been closed for replies.

MikelKlink

Participating Frequently

I use GlobalSign AATL digital certi to PDF for signing certificate.

I have google'd for "GlobalSign AATL digital certi" but couldn't find a specific GlobalSign service by that name. Thus, do you sign using a single, fixed X.509 certificate? Or is that a service that assigns you different X.509 certificates in different signing runs?

After signing, I found that the name after 'Signed by' differs case by case.

Please explain how it differs.

I wonder why this happens and what should I do to fix the name?

Adobe Acrobat in default configuration validates the signature on load of the PDF and uses a name derived from the subject of the signer X.509 certificate of the signature. If it cannot parse that certificate, it uses the Name entry of the signature dictionary which is the value of the signature field.

If your use case is such a default use case, you can fix the name by using the same X.509 certificate (or only certificates with the same subject) in all your signatures and making sure your signing software creates a signature dictionary Name entry with the corresponding value.

Y

yjkoyjkoAuthor

Participant

1. Actually we use two digital certi, one is 'GlobalSign GCC R6 AATL CA 2020' and the other is 'DigiCert Organization (2000)'. In common, only GlobalSign certi is used and when GlobalSign certi get any problem, the Digicert certi became used automatically. Not at the same time.

And I wonder: the fact that we use two different digital certi can be the reason of this error?

2. 'the name after 'Signed by' differs' means,

3. Our IT developer said that he already knew about the fact that using name derived from the subject of the signer X.509 certificate of the signature. And still he wonders why, at the same condition, the name is marked differently. specific below.

4. This qusetion is more about develop thing:

● If PDF documentCatalog's /PageMode is null, after sign, the name from certi is marked correctly. (CRScube Inc. <pm@crscube.io>)

●BUT when /PageMode is UseOutlines, after sign, the name is not became from certi, it just represent /AcroForm/Fields/${order}/V/Name (cubeTMF)

● If /AcroForm/Fields/${order}/V/Name is null and/PageMode is UseOutlines, the name from certi is marked correctly. (CRScube Inc. <pm@crscube.io>)

THIS MEANS: Though /PageMode is UseOutlines, the name from certi is marked correctly

● we think, only when system cannot use the name from certi, then /AcroForm/Fields/${order}/V/Name should be marked instead. BUT why it represent /AcroForm/Fields/${order}/V/Name in condition of /PageMode is UseOutlines though system can mark the name of certi?

Really sorry for asking about difficult and complex thing.

Please be a nice day!

MikelKlink

Participating Frequently

Well, these observations are definitively interesting; as soon as I find some free time, I may experiment around a bit to understand that a bit better.

I don't think, though, that this behavior is planned by Adobe, let alone documented. It feels more like some side effect of the timing of PDF loading activities.

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.

Scanning file for viruses.

This file cannot be downloaded