6

I use digital signatures for signing my invoices (required by law for digital invoicing in my country). The problem is, my local authority issues signing certificates that are only valid for a year (pretty much any certificate authority does this).

Each year this leaves me with a bunch of PDF for which Acrobat Reader says that the signature cannot be verified because the certificate might have expired or been revoked. (I use the 9th version for 64 bit Linux, but the X version for Windows does the same thing).

Is there program that can tell me if such an unverifiable signature was ever valid against a given public certificate and when?

(If not, would it be technically possible to piece it together?)

Thanks, Peter

2 Answers 2

7

@ThorX89 - you need to timestamp your signatures. This will solve your problem.

Basically you use a valid (at the time) certificate to sign the PDF, this is timestamped by a third party CA (most Certificate Authorities allow you use of their timestamp servers - check with your provider) and the time stamp itself is verified by a certificate issued by the CA.

In Adobe Acrobat (or Reader) Edit > Preferences > Security > Check Require Certificate revocation Checking to succeed whenever possible during signature verification - then in the box below chose the Secure Time (timestamping) option.

As long as your certificate is valid at the time of signing and the timestamp server is set correctly in Adobe, even if your certificate later expires or is revoked, Adobe checks to see if your certificate was valid at the secure time (i.e. timestamp) of the certificate as certified by a third party trust provider.

To set the time server in Adobe go to Advanced Menu > Security Settings and then on the left you will see time Stamp servers. Enter the New time stamp server and adobe will download a certificate from their server and that will be used to verify the time stamp.

Keep in mind, your Certificate issuer AND the timestamp server's CA both (in case they are different issuers) have to be on the Abode Approved Trust List (AATL) for their to be absolutely no signature verification errors presented to a viewer of the file when they open it in Adobe Acrobat 9.0 or newer. If the issuers are not on the list, they will be presented with 'cannot verify signature' even if it was timestamped. The only solution to this is that (yours and the timeserver's) certificates have to be trusted by the viewer in their Adobe software. Going for a AATL listed provider gets around this problem (for Adobe products).

2
  • Thank you, AeroKnight. I do know about timestamps. I was looking more for something that could verify, with respect to a given date, a signed document that does not contain a timestamp. Thanks anyhow. Hopefully, other people will find it useful. Aug 24, 2012 at 17:30
  • @AeroKnight That solved my issue. Thanks a lot Feb 27, 2015 at 9:11
1

The way you should be handling this is by renewing your certificate well in advance of the expiration date, so that customers have enough time to view the document with a still-valid certificate.

Trying to match an expired certificate against some kind of "previously-valid" certificate is nonsense. For all intents and purposes, an expired certificate is worthless as a security function -- it's no better than creating a self-signed certificate.

The whole point of signature verification and the trust chain is that all of the certificate's parameters must be correct in order for the program to recognize it as valid and authentic. It is just as easy to forge an authentic-looking, expired certificate as it is to create a total nonsense certificate signed by a non-trusted CA chain.

It sounds like what you're trying to do is to somehow reassure users (or yourself) that some digital certificate which is expired is really yours, even though it's expired.

Don't do that.

If you are using the digital certificate as a security/integrity/authenticity/privacy tool, anything but a current, valid, trusted certificate is worthless for all of the mentioned functions. The results of such comparisons could be interesting in forensic analysis or other fields, but if you and your customers are "end-users" of the certificate and are using it for the protection it provides, you (and your customers) need to treat all invalid certificate warnings as equivalent to someone trying to give you a forged document.

1
  • It's not nonsense. There are legitimate reasons why people might have to use such a tool (if it doesn't exist already, which is what I was asking about), and these cases do take security into account. As a matter of fact, I have already found a commercial solution that checks if a signature was valid at the time of signing and if a certified time stamp is present. It costs a lot of money, and I don't really need the time-stamp part. All I need is a tool that tells me if the file was ever valid and when. On the other hand, I do wonder how they deal with CRLs ... Aug 10, 2012 at 23:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .