Digital Signature Introduction

By digitally signing a document you are providing a mathematical way for you and others to verify the signed documents authenticity.  pdfMachine creates signatures that adhere to the PDF specification on signatures.   Readers such as Acrobat Reader natively support digital signature verification.

A full explanation of digital signatures is beyond the scope of this help file, but numerous explanations are available on the internet. e.g.
http://www.google.com.au/search?hl=en&ie=UTF-8&q=digital+signature+explained&meta=
 

And from Adobe:
http://www.adobe.com/security/pdfs/acrobat_security_wp.pdf

To create a signature, you need a digital certificate.  A digital certificate establishes your identity.  pdfMachine uses Certificates that are present in your Windows Personal Certificate Store.

You can get Certificates from Certificate Authorities (CA's).  CA's  are companies or organizations that generate Certificates and allow you to install them on your PC.

pdfMachine also allows you to make your own certificates, which are called "Self signed" certificates.  

Digital Signature Options  - 2 ways to sign a PDF

Method 1:
When enabled from the options, pdfMachine will automatically place a digital signature in PDF files as they are generated by printing to the pdfMachine printer.  This is the "sign everything" approach.

Method 2:
If invoked from the pdfMachine Tools menu, the digital signature will only apply to the current document.

 

 

 

Select When clicked, a dialog showing all the certificates that can be used for signing is displayed.

pdfMachine Signing Server Certificate Store

This is a list of certificates that reside on pdfMachine servers that you can use to sign your PDFs.  This works without sending the PDF to the pdfMachine servers.  Only a 20 byte "message digest" of the PDF is sent to the server, where it is signed and time stamped.  The signature is then sent back to the client machine to and inserted into the PDF. 

Windows Certificate Store



The certificates in the Windows Personal Certificate store can be managed by opening up Internet Explorer, selecting the menu option "Tools -> Internet Options, then selection "Content ->Certificates".

 
Create New When clicked, the following dialog is displayed, allowing you to create your own self signed certificate.

 

 
Location Optional. Text is placed in the signature. Usually a city or town.
 
Reason Optional. Text is placed in the signature. Select or type in a reason for signing. This option is not available if server signing is enabled.
 
Certified Document If enabled, the document is said to be "Certified".  A Certified PDF is a digitally signed PDF that makes its signed status more obvious.  When a certified PDF is viewed in Adobe Reader, a dialog box will automatically appear showing the document status, such as the following:

 

A Certified PDF can have the following document rights set:

* no changes allowed
* allow only form fill ins
* allow only form fill ins and commenting
 

These rights will be adhered to by PDF editors such as Adobe Acrobat.
 
Time Stamp Authority A space separated list of Time Stamp Authority server URL's.

If more than one URL is in the list, Time Stamp Requests are load balanced between servers in the list.  If a server is down, the next in the list is attempted.

What is a Time Stamp Authority (TSA) ?

A time-stamping service supports assertions of proof that a document
existed before a particular time.   This is all done in a cryptographically secure manner. 

Put simply, if you can trust the time of a TSA, then you can trust the document signing time in the PDF. 

This is described in detail in RFC 3161 at  http://www.ietf.org/rfc/rfc3161.txt


Adobe Reader Signature Properties, Time Stamp Information:

 

Show Signature Optional. If you wish the signature to be visible in the document then tick this box, otherwise the signature will only be visible in the "signature tab" of the reader software.
Image File This can be any jpeg, gif or bmp file.
Image as background Image becomes the background of the signature area, underneath the signature text.  If this option is not enabled, the image has no text on top of it.
Display Items Select which fields are to be displayed.
Dimensions Width Height You can increase or decrease the size of the signature area.
Font Size Size of the font used for the text in the signature area.
Last Page Tick this to make the signature appear on the last page of the document.
Load PDF This can be used to load a "PDF template" file for accurately positioning the signature.   The "PDF template" will not be shown in the final PDF, its just there for positioning guidance.

 

 

Digital Signature -  Acrobat Reader Configuration Tips
 

Digital Signatures that pdfMachine generates need at least Acrobat Reader 6 to verify them.

To have Acrobat Reader automatically validate digital signatures in PDF's we recommend you start Acrobat Reader, Select "Edit -> Preferences" and adjust the settings as shown below. 

This will let Acrobat reader know about Certificates in the Windows Certificate Store. 

Of course you may be happy with the default settings, in which case you don't need to do anything.

Adobe have a product called "InstallShield Tuner 6.0.1 for Adobe Acrobat"

It allows system administrators to pre-configure acrobat reader, do silent installs, setup all the digital certificate options such as LDAP directories and more. It may be useful when installing Acrobat Reader in a large organization.
 

Set Adobe Reader to use certificates in Windows Certificate Store

From the Adobe Reader menu, select "Edit -> Preferences", then select the "Security" category.
 

Press on the "Advanced Preferences" to get: