Unable to digitally sign document after adding signature appearance.

[centurymantra]

I was experimenting with creating a couple of new signature appearances in Adobe.  Now, after doing this, I cannot digitally sign documents.   After drawing a signature field and selecting the digital ID, I am directed to the next window where you would select an appearaance.  Whether I select the standard appearance or one of the custom appearances, I am unable to sign the document.  Clicking the 'sign' button does nothing.  The 'Sign As' window briefly "flashes" when pressing the button but nothing happens.  The same behavior presents itself in both Acrobat DC and Reader.

[ls_rbls]

What happens if you click on "Help"-->>> "Repair Instalation"?

Other than that, when you say that "After drawing a signature field" are you referring to trying to adding a signature field using the "Fill & Sign" tool or are you referring to using the "Certify" tool?

[centurymantra]

I am using the Certificates tool to sign.

The repair installation option did not resolve the issue.

Thanks.

[ls_rbls]

Sorry, I meant Certificates tool (not Certify), thank you for spotting that.

I forgot to ask, what type of certificate(s) are you trying to use; a self-signed digital certificate or a certificate that was issued to you at work that requires additional downloading and configuration of root certificates from a trusted root certification authority?

In both cases, however,  you may need to check if you've missed a few steps before being able to create an signature appearance.

For example, how the certificate will be used for encryption (for signing, accessing webmail or restricted websites, or all of those actions), must be defined first.

This is done through "Edit"--->>>"Preferences"--->>> "Signature".

The two areas of interest under the "DIgital Signatures" section are:

• Creation & Appearance --->> click on the "More..." button. The "Creation amd Appearance Preferences" dialogue window will open. See the section "Creation" and verify from the dropdown menu "Default Signing Format" you're currently using and if it needs to be changed. Then below in that same dialogue window, see the Appearances" section. Click on the "New" button to create the desired signature appearance.

• Identities & Trusted Certificates --->> click the "More..." button, then on the "Digital ID and Trusted Certifocate settings" dialogue window that will open up, select Windows Digital IDs --->> "Certifcate Details"-->>> go to the "Trust" tab of the certificate viewer window dialogue box and click on the button "Add to Trusted Certificates", then click OK.

If none of these steps help, can you confirm if this is happening with every PDF document that you try to sign using the Certificates tool, or is this happening with just one particular PDF?

[centurymantra]

This is a certifcate for a trusted authority.  I am actually the admin for the digital signature program at a state agency and it is our trusted certificate.  All the appropriate settings are in place.  I have been using this certificate to sign for several years now and I just now ran into this issue after creating a new appearance.  I am working with one of our externnal partners with this problem, and that is how the issue came to my attention.  We both now have this problem, so it is not isolated to my machine.

It is doing this with all PDFs.

[ls_rbls]

And what is the operating system , Micrososft Windows or macOS?

I am thinking if this has anything to do with the certificate chain. Maybe when the new appearance was created it was saved to a different location? 

Are there any external  time stamp servers required in the appearance of this digital signature?

Also, what happens if you update the Adobe Approved Trust List (AATL) server?

I'm just shooting from the hip here, just trying to be helpful. That said, can you confirm if these trusted certificates are not expired?

[centurymantra]

If I uncheck both of the 'Windows Integration' settings in the Signatures>Verifications area, I am able to sign documents.  If I re-select them, I cannot sign documents.

[ls_rbls]

You should leave those uncheck anyway. See the disclasimer below those two checkboxes.

You should be cautious with those two options, specially if you're using expired certificates. 

[centurymantra]

Yes....I do understand the disclaimer, but we need these options checked in order to verify our trusted root certificate.

We have always had that setting in place without any issues until this week...after creating a new graphic appearance.  Our certificate is not expired, but we did just renew it.  The issue could be linked to this.  I am not having this issue with other PDF readers...Bluebeam or Kofax Power PDF.

[ls_rbls]

Ok, I see what you're saying.

I think the issue is due to the Internet Explorer integration with Adobe Acrobat.

There's plenty of documentation available on how to add trusted certificates via Adobe Acrobat but very little or confusing documentation about how to remove the old certificates since this step is not done through Acrobat directly.

If you go to Edit--->>>Preferences--->>> Internet, note the section "Internet Options".

Click on the button "Internet Settings".

This will open the Internet Explorer's "Internet options" dialogue window (which you can also access directly via Internet Explorer "Tools" file menu bar --->>>"Internet options").

Click on the "Content" tab then click on the "Certificates" button.

If you see the old certificates there, remove them completely and import the new ones.

In addition, Clicking on the "Advanced" button will open up the "Advanced Options" dialogue window, which will present the user with  a list of "Certificate Purposes" (as I mentioned in one of my replies earlier...defining the certificate's purpose is also important before you proceed to signature appearance in Acrobat).

Note that, the export format should be PKCS #7 Certificates, and below that also tick the checkbox "Include all certificates in the certification path".

You may have to do the same procedure under the "Trusted Root Certification Authorities" tab if it is really necessary, but I don't think that in your particular case this is needed.

Now, unless you know how to manually access the Windows Certificate Store and be able to visually identify all of your old certificates in there, this is the easiest method that I learned a while ago when I was assisting another user.

I found this method referenced in an old Microsoft guidance.

It seems like the only user-friendly way to clear the Windows Certificate Store is only accessed via Internet Explorer, which is also tightly integrated with the Windows File Explorer shell environment.

As I ran out of ideas already, I hope this helps as an additional insight.

[DMerces]

Hello ls_rbls. Thank you for your very useful tips. Could you reveal the location of the source of the information that you have mentioned (old Microsoft guidance)? I'm facing complex problems with my digital certificate settings and use. I would really like to dive deeper into this subject, to try to solve my access problems. I thank you in advance for your support.

[ls_rbls]

@DMerces ,

Here are some of the old sources:

• https://answers.microsoft.com/en-us/windows/forum/all/how-to-delete-a-certificate-from-local-machine...

• https://learn.microsoft.com/en-us/answers/questions/792999/how-to-completely-delete-a-certificate-fr...

Let us know if this helps.

[ls_rbls]

There's plenty more guidance here:

https://helpx.adobe.com/in/acrobat/using/certificate-based-signatures.html#setting_up_certificate_ba...

[centurymantra]

The guidance document did not contain any info that was relevant to this situation, but I was able to resolve the issue by uninstalling and reinstalling the software.  I have jsut tried this with Adobe Reader, but will follow up with Acrobat soon - hopefully with the same results.  It would still be good to know why this occurred for future reference, but can just suggest a reinstall to users with this issue for now.

I have one more question regarding Adobe support.  Our agency has an enterprise account and access to the support that comes along with this.  However, the designated contact on our contract has retired.  Can you tell me how we could update this and change the contact to the employee who has taken over the postiion?

[ls_rbls]

Use this support link: 

https://helpx.adobe.com/contact/enterprise-support.html

Sign in with your enterprise ID.

Have you also tried the support option via the admin console?

Or are you saying that the IT contact that retired didn't leave any trace of EnterpriseID and password account for the next person in charge?

I would say to call support directly and ask them to update the IT contact in your contract:

https://helpx.adobe.com/contact/phone.html

[DMerces]

@ls_rbls, thank you very much for your reply. Fortunately I have no problems deleting certificates. In fact, I would like to understand in greater depth the settings in Internet Options regarding certificates and, mainly, the effects of each setting. I was unable to find advanced documentation on the settings behind the "Advanced" button, as shown in the attached image. I would greatly appreciate any tips on documentation in this regard.

My best regards.