Issue with certificate not showing in Adobe Reader

[jotolo]

Hi @gettalong . Thanks for hexapdf!
We are having issues with a solution we implemented using hexapdf. I was wondering if this is the right place to ask these questions and I thought it would be better that opening an issue. Let me know if any other form of communication is better.

We are able to sign documents with hexapdf, the signature looks good and everything with the document seems to be right.

When using hexapdf info on one of the signed documents it shows the following:

We started asking ourselves about the certificate and if it was the right certificate for it.

Then we went and check the file in adobe reader:

Something is off about this case and we would like to ask you if you could advice or if you have seen this case before.
I've tried checking documentation and I couldn't find anything regarding this topic. We really appreciate any help about this topic.
Is there anything special that the certificate should contain in order to be shown normally in Adobe Reader?

Thanks for the help in advance and again, thanks for creating hexapdf.

[gettalong]

Yes, as the error message of hexapdf info says a certain "key usage" indication called "Digital Signature" is missing from the certificate. This means that the issuer of the certificate has not issued the certificate for signing documents but only for other purposes. Viewers can ignore this restriction but most don't.

Furthermore, only certain certificate authorities are trusted by default by Adobe Reader, see https://helpx.adobe.com/acrobat/kb/approved-trust-list1.html. If the certificate is not issued by one of those CA, there may be indications that the signature validity is unknown. This can be remedied by either using a certificate from a trusted root CA or by telling Adobe Reader that the certificate can be trusted. I did the latter with my test certificates to ensure that, apart from not being on the AATL, everything else is accepted by Adobe Reader.

[jotolo]

Hi @gettalong ,
It seems the issue we are having is exactly as you mentioned it. We are checking the details with the provider to get the right certificate. We were using one of those providers but they sold us the wrong certificate.
To other people having this issue, please, make sure you have right certificate.

Thanks @gettalong