STATEMENT: SIGNIFICANT SERVER
How to Trust Certain Certificates
Usual Error Message on the Server: Exception: System.Exception: No certificate for thumbprint 811CF8849CA8E0AAF5411F9DAD8BBAB18D8D4BCA found
This document describes how to trust certain certificates in case the verification fails.
Overview
The described procedure defines how to trust a certain certificate for the verification procedure. Usually a signature cannot be verified because not all certificates are available within the xyzmo certificate store. In the following scenario the required certificate is extracted from the signed PDF document or signed XML file. It is also possible to extract the public part of the certificate using other software tools as “D-Trust Tool” or ”Siemens API Tool” for smartcards. For the server configuration adaption the public certificate must be available as “.cer” file.
Exporting the Public Certificate as “.cer”
1. Export the signing certificate of the document in question. For Adobe PDF documents follow these steps: o Open the affected document in a viewer, e.g. via the Adobe Acrobat Reader o Export the signing certificate: Click on the signature – a similar window will appear (below a screen from Acrobat Reader 8):
o
Click on “Signature Properties”:
o
Click on “Show certificate”:
o
Click on “Export”:
xyzmo Software GmbH Haiderstraße 23, 4052 Ansfelden, Austria Tel +43 (0) 7229 88060-0, Fax +43 (0) 7229 88060-720 office@xyzmo.com www.xyzmo.com
o o
Select the option “Certificate File” and click “Next” Store the exported “cert” file on a location accessible by the server administrator:
2.
Export the signing certificate of the document in question. For XML files signed with XMLDSIG follow these steps: o Open the signed XML file in a text editor (e.g. notepad) o Copy the content of the tag to a text file named “signing_cert.cer”. Example:
… SERIALNUMBER=DTRWS652678565490225, SN=Kofler, G=Christoph, CN=Christoph Kofler, O=xyzmo Software GmbH, C=AT MIIFJzCCBA+gAwIBAgIDB6BLMA0GCSqGSIb3 DQEBCwUAME0xCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0I EdtYkgxJzAlBgNVBAMMHkQtVFJVU1QgUXVhbGlmaWVkIENBIDMgMj AwNzpQTjAeFw0wODA2MTgyMDU5NTlaFw0wOTA0MzAyMDU5NTlaMIG KMQswCQYDVQQGEwJBVDEcMBoGA1UECgwTeHl6bW8gU29mdHdhcmUg R21iSDEZMBcGA1UEAwwQQ2hyaXN0b3BoIEtvZmxlcjESMBAGA1UEK gwJQ2hyaXN0b3BoMQ8wDQYDVQQEDAZLb2ZsZXIxHTAbBgNVBAUTFE RUUldTNjUyNjc4NTY1NDkwMjI1MIIBIjANBgkqhkiG9w0BAQEFAAO CAQ8AMIIBCgKCAQEAgVevuvNkvmbwBMcKyaq9MR1EWImL3QBlKFXn tmQTBqM2Bf/2bXNjw1DFF72Y7s7HszBBDUI5eFqfqfzYmpnkyAGno wNjyPWAuH5Vr9XCxMSqULXbGJGKI5QYiInFehs6mDOfIgEkf6L8Ya /bFL0Sj12Rl2QNK6LOVtZ4nElYvwIY9v7SI/5U/XI+deX5ypw1+eW XMXtVLp7AKp8wLNzOIMR5k8/WrDcOfWQB7ZIn5y2Ou2cwvoJkPd4/ Jzy0gvyiiVpKBFhod1qURv9T4HAU6fDVQw/UyIzhVz81MHcaGSnPm rE1p6K6uspQ1HV6XqybiP7R4gE/SDXVKjPN9YTytQIDAJrlo4IB0D CCAcwwHwYDVR0jBBgwFoAUsonMFbz2zNERf2JO4OhU8xwMsXIwJQY IKwYBBQUHAQMEGTAXMAgGBgQAjkYBATALBgYEAI5GAQMCAR4wOAYI KwYBBQUHAQEELDAqMCgGCCsGAQUFBzABhhxodHRwOi8vcXVhbC5vY 3NwLmQtdHJ1c3QubmV0MBcGA1UdIAQQMA4wDAYKKwYBBAGlNAIfAT CBygYDVR0fBIHCMIG/MIG8oIG5oIG2hnhsZGFwOi8vZGlyZWN0b3J 5LmQtdHJ1c3QubmV0L0NOPUQtVFJVU1QlMjBRdWFsaWZpZWQlMjBD QSUyMDMlMjAyMDA3JTNBUE4sTz1ELVRydXN0JTIwR21iSCxDPURFP 2NlcnRpZmljYXRlcmV2b2NhdGlvbmxpc3SGOmh0dHA6Ly93d3cuZC 10cnVzdC5uZXQvY3JsL2QtdHJ1c3RfcXVhbGlmaWVkX2NhXzNfMjA wNy5jcmwwMwYDVR0SBCwwKoEQaW5mb0BkLXRydXN0Lm5ldIYWaHR0 cDovL3d3dy5kLXRydXN0Lm5ldDAdBgNVHQ4EFgQU3ppLT/OQhcN+a I4zM4iGQu21pe0wDgYDVR0PAQH/BAQDAgZAMA0GCSqGSIb3DQEBCw UAA4IBAQBuaMst0oPHZrC1xQGtpXbraw1RFnTIn/bRyvHNW98Z/Fl Gfb4ClU5QEFzul9NB0ALzHiP1XJkwBGesE3E1NCWkvfNDNorD2q6I gtD9ZAAk4SCxI45I9cGCw0wPY8PmqtIAM4ZWgEPIixpBOKCgcgg9p 4eCCnbJV6rViL8dYiNeNkH5/KM9J7F7mne+0USCc4DxlTErgLvZiG Ln6kdfsERPKnL+hcg7OqHZMq6r1MiM8BSsXgwL7ktOefSiiTHZ/Vn 9ZFSF0t4cCGST5SsyOth3o/T5oLWO4x7BSIi5toCqzNfcr6SsUAgn ThBP52EPV3jgqFSbQz0bjdXyFE+VA/ds
xyzmo Software GmbH Haiderstraße 23, 4052 Ansfelden, Austria Tel +43 (0) 7229 88060-0, Fax +43 (0) 7229 88060-720 office@xyzmo.com www.xyzmo.com
…
Loading the .cer File into the SIGNificant Server
3. Adopt the Server configuration: o Open the Server Config Client, go to “Start Global My own trusted certificates” and click on “Add (CERT import)” o Select the exported “.cer” file – it will appear in the list with the Type “user” and Security Level “simple”:
o
Select the imported certificate entry and click on the “Edit” link below. The following screen opens:
o
o o
Change the parameter “certSecurityLevel” from “simple” to the correct security level of the certificate, e.g. “qualified” Confirm with a click on “Save” and “Apply Configuration”. Verify the original file again – the verification report will now show “OK” as result with the security level configured for this certificate. In detail: the verification report will tell you: