8

I can't validate a signature on a PDF.

Some important information about the PDF certificate:

Validity Start : 2011/12/21
Validity End   : 2012/12/20
Signature Date : 2012/12/23

The error is The selected certificate path has errors: Not time valid

I have set my Adobe Reader certificate security preference to Use expired timestamps, but to no avail.

What should I do?


This is an e-Aadhaar PDF, a government initiative of India. I have followed the steps from here, but to no avail. This is what the website said:

1) Right click on the ‘validity unknown’ icon and click on ‘Validate Signature’.

2) You will get the signature validation status window, click on ‘Signature Properties’.

3) Click on ‘Show Certificate..’

4) Verify that there is a certification path named 'CCA India 2011'. This identifies CCA India as the owner of the digital certificate that has been used when signing the document.

5) Mark the certification path named 'CCA India 2011', click the 'Trust' tab and then 'Add to Trusted Identities'.

6) Answer 'OK' to any security question that follows.

7) Check(v) the field for 'Use this certificate as a trusted root' and click 'OK' twice to close this and the next window.

8) Click 'Validate Signature' to execute the validation.

enter image description here

3

6 Answers 6

1

The security preference set to Use expired timestamps means that an expired signature / expired validity is treated as valid. However, a signature date after the end of the validity of document doesn't make sense, which is the case here. Hence, the problem is with the document signer, and not with the person who was issued this PDF from the Indian government. The Indian government has rectified the issue and newly downloaded PDFs are valid now.

2
  • 3
    I disagree, since a once-valid signature is never really invalidated. Apparently what happens is that Adobe doesn't honor "Use expired timestamps" for signing-date later than validity-date, which is not the correct action. Another pdf reader might only give a warning for this case. Remark: No need to downvote answers - not accepting is enough and the answers might be useful to others.
    – harrymc
    Jan 10, 2013 at 12:17
  • 2
    @harrymc, thanks for your input! However, the signature on my PDF was never valid in the first place, ever. Other PDF readers didn't give a just a warning, they also mentioned that signature had errors. So, main point is that: if a signature date doesn't fall between the validity dates, the PDF can NEVER be validated without using dirty measures. Jan 11, 2013 at 5:33
0

Check your system time. Frequently when I first install Windows the BIOS time (and hence Windows time) is set to some incorrect value. This in turn messes up certificates if the time is after the validity period of the certificate, or predates the certificate issuance. Note that Windows' "Internet time" function (NTP synchronization) will not work if the time difference between real and your computer's clock is too great. You will have to manually set it using something like http://www.time.gov/ or your country's official timesource.


This is a quick and dirty hack, but can you set your system time to be within the validity period of the certificate and then try and validate it? If it validates within that time, you will know it is legitimate, and then can trust it, even though you are now outside the time of validity.

6
  • Since this is my office laptop, my Windows time is always correct and synchronized. Jan 6, 2013 at 17:39
  • I have set my Adobe Reader certificate security preference to "Use expired timestamps" Jan 6, 2013 at 17:45
  • Can you show us what the certificate's start/end dates are? These should be under the Details tab. According to Microsoft technet.microsoft.com/en-us/library/cc700843.aspx the error you are getting is caused by "improper" start/end dates, or ones that do not bracket the current time.
    – K.A.Monica
    Jan 6, 2013 at 18:17
  • Start: 2011/12/21, End: 2012/12/20. That should not matter, since my certificate security preference is "Use expired timestamps" as aforementioned. Jan 6, 2013 at 18:21
  • Have you restarted Adobe and/or Windows since you set that preference? The cryptographic part of the software may need to be restarted to accept that new preference.
    – K.A.Monica
    Jan 6, 2013 at 18:23
0

It would help us to analyze the problem, if you provided us with a not-too-private document signed with this signature.

As a workaround (and also as another test), try using another pdf reader such as Foxit Reader (which is perhaps the world's best pdf reader).

0
  1. In Acrobat or Reader, click Edit > Preferences.
  2. From the Preferences dialog box, select Security on the left.
  3. Click Advanced Preferences, and then click the Verification tab.
  4. Select Verify Signature using 'The Current time'

Restart the pdf and validate the signature

0
  1. In Acrobat or Reader, click Edit -> Preferences.
  2. From the Preferences dialog box, select Security on the left.
  3. Click Advanced Preferences, and then click the Verification tab.
  4. Select Verify Signature using The time as which the signature was created
0

If you are using Windows XP, try using Adobe Reader 9 version only.

I had the same problem while using Adobe Reader 11 but when I reverted to 9 it worked.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .