PDF/PAdES Signing Attributes
Having selected PDF (PAdES) within the Signing Profile configuration the following form is shown. Each option is discussed in the table below:
The configuration items are as follows:
| Items | Description |
| Signature Settings |
Select the signature format to be produced. For more details see the section Supported Signature Types.
|
| Document timestamp only | This setting requests the ADSS Signing Service to only add a new document timestamp to the PDF . |
| Timestamp (TSA) Settings |
Select the required timestamp authorities from the list of registered TSAs.
The configuration of TSA address(es) is described in this section: Configuring Time Stamp Authorities (TSA).
Note: If the issuer CA of the signing certificate in Trust Manager has an associated TSA then this TSA (or TSAs) override any TSAs defined in this signing profile. |
| RevocationStatus InformationUnavailableError |
If the following long-term signature formats are selected:
Then an extra check box is offered to decide if ADSS Server
should return an error if it cannot embed the revocation information
when creating the Long-Term signature.
Such
signatures require embedded status/ revocation information for the
signer's certificate chain. This is useful to stop basic signatures
being created when a communication failure prevents revocation
information being obtained from external resources. If this check box
is not selected then the signature will be produced but it may not
contain the embedded revocation if this was unavailable at the time of
signing, e.g. if the relevant OCSP is not responding or if the dynamic
CRL is unavailable. ADSS Server is generally configured to cache CA CRLs
locally and it also has a short-life cache for dynamic CRLs and OCSP
responses.
Note: It is recommended you always tick this box.
|
| Hashing Algorithm |
The selected hashing algorithm is used within the signature generation process. These algorithms are supported:
|
| Signature/Document Relationship |
This defines how the signature and the document exist i.e. is one inside the other or do they exist separately. These options are available:
|
| Visible Signature |
This defines whether a visible or invisible signature will be created. If True is selected a further option is added below. |
| Apply Certify (author) signature |
A Certify signature option is very useful to lock the document against further unauthorised changes. These options are presented:
|
| Use a PDF editor to draw signature field(s) |
If this option is selected then signing location(s) can be defined by opening the target PDF in the PDF editor.
The details of how this works is explained below.
|
| Use a default signing field |
If selected then following option are shown: 1. Default Signing Area
This option allows you to select a default location on the page where the signature appearance will be stamped. You have choices of:
If this does not adequately position the signature field on a document (e.g. engineering drawings have specific requirements where the signature field should go) then use the precise locations option.
2. Signing Page
This defines which page of the document to sign on when using a default signing location.
3. Signature Appearance
Select one of the PDF Signature Appearances already generated as mentioned in the section PDF Visible Signatures.
Overrideable flag indicate whether the details configured in the signing profile can be amended by the client application by passing parameters in the signing service request message. Select the check boxes for those values that the client application is able to override in this signing profile. This provides a great deal of flexibility to the client application to override the signing profile settings at the time of sending the request to ADSS Server. |
| Use an existing blank signature field |
If selected then following options are shown: 1. Signing Field
If the document already has a blank signature field, then the name of the signature field can be specified using this option. When ADSS Server signs a PDF document using this signing profile it will then search for this signing field and embed the signature details within that field. This is also a good way of positioning the signature in an exact location rather than just the default locations mentioned above.
Note: Signature field names are case-sensitive so ensure you enter a valid field name as used in your documents, e.g. field1 and Field1 are not the same.
2. Signature Appearance
Select one of the PDF Signature Appearances already generated as mentioned in the section PDF Visible Signatures.
Overrideable flag indicate whether the details configured in the signing profile can be amended by the client application by passing parameters in the signing service request message. Select the check boxes for those values that the client application is able to override in this signing profile. This provides a great deal of flexibility to the client application to override the signing profile settings at the time of sending the request to ADSS Server. |
| Embed font to be used for PDF signature appearance text objects |
Select the fonts used in the signature appearance to be embedded in the signed PDF document. Using this option, PDF/A compliant documents will retain PDF/A compliancy after signing. Supported PDF/A documents are:
|
| EPES signature |
Explicit Policy Based Electronic (EPES) signature settings are only available for the PAdES signature types. By enabling the check box Add Signature Policy Identifier, the signing profile can be used to produce (EPES) signatures where a signature policy OID, URI and user notice are added in the digital signature as specified below. 1. Signature Policy Object ID
A Mandatory field
Provide the Signature Policy OID to be added for EPES signatures.
2. Signature Policy URI
An Optional field.
Provide the Signature Policy URI to be added for EPES signatures.
If there is no Policy URI defined inside the signing profile then EPES configurations should be made in policy.properties file located at: [ADSS Installation Directory]/service/
Open this file in any text editor and enter policy OID and path to the policy document
e.g. 1.2.3.4.5 = "F:/Policy_File"
The ADSS Signing Service can retrieve the signature policy document in either one of the following ways:
Using Policy URI defined in signing profile. The ADSS Signing Service will use this policy URI to retrieve the online available policy document and its hash value will be calculated and embedded in the signed properties of the signature.
Using locally configured signature policy document. The ADSS Signing Service will use this text file pointer to retrieve the locally-saved policy document, hash and embed it in the signed properties of the signature.
3. Signature Policy User Notice
Provide the user notice to be added to the EPES signatures.
|
Use a PDF editor to draw signature field(s) as required
Going back to how to define a precise signing location for your documents, enabling the radio button "Use a PDF editor to draw signature field(s) as required" shows the following screen:
PDF Signature Location drop down will list all configured preferred signature locations. For more details please see the PDF Sig. Locations sub-module, you can also create new signature appearance(s) there if none of the already available signature appearances meets user needs. Multiple signature fields can be created in this way. ADSS Server will sign all fields with the associated signature appearance when this signature profile is referenced by client applications.
Use a default signing field location
Enabling the radio button "Use an existing blank signature field in the target document" shows the following screen:
PDF Signature Location drop down will list all configured preferred signature locations. For more details please see the PDF Sig. Locations sub-module, you can also create new signature appearance(s) there if none of the already available signature appearances meets user needs. Multiple signature fields can be created in this way. ADSS Server will sign all fields with the associated signature appearance when this signature profile is referenced by client applications.
Use a default signing field location
Enabling the radio button "Use an existing blank signature field in the target document" shows the following screen:
The configuration items are as follows:
| Items |
Description |
| Signing Field |
If the document already has a blank signature field, then the name of the signature field can be specified using this option. When ADSS Server signs a PDF document using this signing profile it will then search for this signing field and embed the signature details within that field. This is also a good way of positioning the signature in an exact location rather than just the default locations mentioned above. Note: Signature field names are case-sensitive so ensure you enter a valid field name as used in your documents, e.g. field1 and Field1 are not the same. |
| Signature Appearance |
Select one of the PDF Signature Appearances already generated as mentioned in the section PDF Visible Signatures. |
| Overrideable |
This flag indicate whether the details configured in the signing profile can be amended by the client application by passing parameters in the signing service request message. Select the check boxes for those values that the client application is able to override in this signing profile. This provides a great deal of flexibility to the client application to override the signing profile settings at the time of sending the request to ADSS Server. |
Selecting "False" in the the Visible Signature shows the following screen:
Configure the Signing Reason, Location and Contact info to be included in the signature.
Overrideable flag indicate whether the details configured in the signing profile can be amended by the client application by passing parameters in the signing service request message. Select the check boxes for those values that the client application is able to override in this signing profile. This provides a great deal of flexibility to the client application to override the signing profile settings at the time of sending the request to ADSS Server.
