Signing with a certificate

I am having the same problem, help.

Those are good questions and you are indeed missing a couple of basic ideas which make this all seem very confusing.

First, to sign a document, you need to have a digital identity (ie, a certificate) for YOU that was issued by someone else (your "certificate authority") or one that you create yourself (a "self sign" certificate). Nothing needs to be in the address book or trusted identities to sign. If you have the file with your certificate you can add it during the signing process (select the "identity from a file" option), or you can install the certificate into acrobat from Advanced : Security Settings (click the Add ID) button. Either way, this should be enough to sign. If you don't have the digital id file, you need to contact your CA issuer.


The trusted id comes in when you validate a signature when you open a signed file. To be valid, three conditions must hold:
1) the document must not have been modified in ways that are not allowed
2) there needs to be some evidence that the signer's certificate is not revoked
3) there must be a trust relationship between you (the validator) and the signer.

Item 3 is where adding the issuer to trusted identities comes in. This establishes a trust relationship between you and identities issued by that organization.

Another item that is often confusing is the meaning of "trust" in this context. What is meant by a trust relationship is "I trust that you are who you say you are". It does not grant privileges or anything else, although there is an option to grant additional privileges as part of trust. Those provileges are not related to signature validity, however.

For more information, see the Digital Signatures User Guide at www.adobe.com/go/acrobat_security

Hope this helps.

Apparently the client certificates don't include extensions, adobe requires the extension keyUsage=digitalSignature

I think a lot of the confusion came b/c the initial obvious solution didn't work, and acrobat doesn't tell you why the digital id is not valid at all.

I asked on cacert's mailing list for a workaround, but no response yet

http://forums.adobe.com/message/2163184

Key Usage is an industry standard field that is common to all uses of digital certificates. There are international standards defining the meaning of the field and Adobe product comply with that standard. I don't think you will find a "workaround". You need to let your certificate issuer know that you need a digital identity suitable for signing and they can issue you a certificate with the appropriate key usage values.

I'll send a note to the development team about issuing a better error message.

Yeah, workaround might be being nice ;) I want them to include the extension, hehe It looks like in a draft they had planned to but then didn't for some reason. I don't know why, they are a pretty open non-profit certificate system.

Oh well, going self-signed for now. :)