Digital Certificate(s) showed on PDF documents

[JohnPlanetary]

It would be nice for Sumatra PDF to show digital certificate(s) that have been used to sign a PDF document.

These helps to verify the authenticity of some documents created by people, institutions, companies, governments, etc. that are securely signed.

It should display all the information about the certificate(s), (secure?) timestamp(s), reason for signing (if specified), and everything else that may apply.

It should work with all used algorithms, including but not limited to: RSA, DSA, ECC, SHA1, SHA256, SHA384, SHA512. If possible supporting: PAdES levels (B-B, B-T, B-LT, B-LTA, and PAdES-EPES).

Some use official certificates already in the certificate store of the operating system, but others use self-made certificates that need to be added to the trust list (schools, companies, governments, etc.), so it would be nice for the program to have the flexibility to have that in mind and allow them to be added.

It could also support signing and/ or timestamping, but I'm not sure how much more complexity it adds. So even if it only supports reading existing digital certificate signatures it would already be very nice.

If implementing these have a look at: https://www.pdf-insecurity.org and maybe other sources to be sure the verification is done in a way that isn't vulnerable to forgery, since many programs have had troubles in the past.

[GitHubRulesOK]

The core of SumatraPDF is MuPDF and that has some ability to attempt Adobe proprietary signing (see mutool sign) but really even Adobe does not always assure the system it proposed for PDF unless written by Adobe (and that too has been breached in the past).

Mutool require a system not NATIVE to Windows commands

openssl req -x509 -days 365 -newkey rsa:2048 -keyout cert.pem -out cert.pem
openssl' is not recognized as an internal or external command, operable program or batch file.

1. Install a native Windows build of OpenSSL
   Windows does not include OpenSSL. You must install it.
   The most common Windows builds are from Shining Light Productions (Win32/Win64 installers).
   This then needs more downloads and installers and we have not written anything yet

---

Setup
The Win64 OpenSSL Installation Project setup has detected that the following critical component is missing:
Microsoft Visual C++ 2022 Redistributables (64-bit)
Win64 OpenSSL will not function properly without this component.
Download the required redistributables now?
Yes No Cancel
This Downloads an Application from microsoft that microsoft does not trust as it came from the Web like PDFS often do and Microsoft app has a certificate that expired last year

CN = Microsoft Code Signing PCA 2011
Valid from ‎Thursday, ‎September ‎12, ‎2024 9:11:14 PM
Valid to ‎Thursday, ‎September ‎11, ‎2025 9:11:14 PM

So who do you trust in that circle of trust

SumatraPDF does not use a few distinct parts of MuPDF utilities so for example it currently does not use OCR nor XFA or lesser Forms nor Recognise Bar Codes (which would be the simplest of all)
But recognising Adobe Security including in its interpretation of security is best done with Acrobat DC as Adobes mini editing application that has all those millstone flagships for reading its own signing methodology. ALSO there is then only one person responsible for its failings!

[JohnPlanetary]

I understand the explanation (needing to have OpenSSL, Visual C++ redistributable). I already have Visual C++ redistributable installed, and the OpenSSL Light version should be enough to make it work (moving the x64 files to the same folder of sumatrapdfreader).

But digital signatures aren't exclusive of Adobe, other programs can also read and show them. Is just that they are huge programs! that is why I suggested these feature.
I can install adobe, but it has something like 777 MB just the installer, and they want to run all sort of things on memory even when the program is not being used... it is really crazy.

I see many documents that are signed, and I myself sign some, with dedicated applications for that, but those don't show the full PDF document signed after it is signed, it is why I would like to have a simple small program to at least see them on the document and be sure things are applied properly, and be able to see from others.

[GitHubRulesOK]

I will expect this will be deemed of topic (but History Books dont Lie or do they?)
The One TRUE security model is the one Used for comonly named "Magna Carta" where the signed copies were placed in diverse repositories so even the King could not repudiate them !!
This is the Model used by one of the largest parts of Global population as it Works unless there is Corruption.
Consider the recent claims AI is so powerful it cannot be released into the Wild West Web but that would not stop other powers that be.

[GitHubRulesOK]

Well I followed the instructions made a cerrtificate and all that and we can see SSL is installed but mutool does not like it
It does KNOW it is unsigned and we can test if openssl is available after the event

mutool sign -v abracadabra2.pdf 5
Verifying signature 5:
        Signature is not signed.

set path C:\Program Files\OpenSSL-Win64;C:\Program Files\OpenSSL-Win64\bin;%path%
Environment variable path C:\Program Files\OpenSSL-Win64;C:\Program Files\OpenSSL-Win64\bin;C:\Program Files\OpenSSL-Win64;C:\Program Files\OpenSSL-Win64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\WDAGUtilityAccount\AppData\Local\Microsoft\WindowsApps not defined

C:\Users\WDAGUtilityAccount\Desktop\Apps\PDF\SumatraPDF\Plus\MuPDF>mutool sign -s certificate.pfx -P password123 -o signed.pdf abracadabra2.pdf 5
Signing signature 5.
error: No OpenSSL support.
error processing signatures: No OpenSSL support.

C:\Users\WDAGUtilityAccount\Desktop\Apps\PDF\SumatraPDF\Plus\MuPDF>openssl
help:
Standard commands
asn1parse         ca                ciphers           cmp
cms               configutl         crl               crl2pkcs7.......... etc etc

That self same template was easily signed inside Adobe web Signing so it is not the PDF that is the problem it is the method.

[JohnPlanetary]

In fact current digital certificate signatures help to ensure it is from a real human, or a real company, or a real government... or at least elevate the "bar" of difficulty to do forgeries.

The "who" is (?), I get, it can be faked, but is way more difficult than just manual signatures... good luck to know if they are true, I can't tell a real from a fake, and anyone, anywhere including some random young child can fake them, but faking digital certificate signatures is way more difficult to do it, specially qualified signatures... not impossible, but harder.

But there is an expected good functionality: secure time stamps from third parties (like: Quovadisglobal, Adacom, Sectigo, Baltstamp, ACCV, Netlock, Izenmpe, Digicert, Actalis, Entrust, SwissSign, and many others) they act like those diverse repositories that even the King could not repudiate them, since are in many different jurisdictions, but for the Time Stamp, and in many cases what one wants to proof is a date & time, and one can add as many timestamps as (s)he wants... and if it is a valid PAdES B-LTA with the CRL value of the Secure Time Stamp, the user can prove the date & time, and if (s)he uses several different sources in the same document it will be close to impossible to say it is a fake timestamp.

[JohnPlanetary]

Maybe MuPDF included in SumatraPDF doesn't include the signing part module? Or needs the OpenSSL in a specific location?

[GitHubRulesOK]

John that is part of the puzzle Mutool attempts to sign but seems not to like the common Windows OpenSSL and thus trying to find out WHY as MuPDF does not say what is necessary apart from a word "OpenSSL" not even suggest a variant or version.
That is the simplest example I know with a signature box and is seen by MuPDF it has in the past matched Adobe approval and currently I can sign it in PDF-Xchange with the certificate I wrote per MuPDF instructions here it is you can test it is from me in Edge

signed.pdf

Signer's identity could not be verified. Signer's certificate and it's parent certificates can't be found in the certificate trust store.
So apparently you need me to send you my proof of postage
Do not get me wrong I am not against security but this is not the best of Adobes ideas just it is advertised as if it were not fragile.

[JohnPlanetary]

Well, here in Europe Union all citizens already have in their national ID card provided by the government Qualified Digital Certificates that are legally valid (at least) in all EU countries, and maybe some countries outside EU. If someone signs their PDF document one can verify in Adobe, or any other application that includes the EU Certificates, if that is a valid certificate.

Your PDF is properly signed, but they are all self sign certificates.
But even Self Made certificates can be valid in some circumstances for some purposes.
The Time Stamp, in these case was one supposedly from www.signfiles.com, but if it was from Sectigo (ex.: https://timestamp.sectigo.com ) one could be sure of the Time Stamp time and date on it.

Of course in countries like Australia, UK, USA, is more difficult because those citizens don't have a national ID card (in the US there are State ID cards, but a citizen can have 50 different State IDs), so people don't have a qualified signing certificate with them all the time, like people in EU, and maybe in some other countries... but they can have it, they just need a Passport or Driver License to request to some certificate company to make one to them, but they have to pay a lot of money for them, and renew ever 1, 2 or 3 year's... in EU these National ID usually last 10 to 15 years, and the signing certificates are valid to be used during that time.

[GitHubRulesOK]

Thanks for the info I understand the desire to please Brugge but I still have not found a way for mutool to "work" so that is probably why it is not included in SumatraPDF.

Edge already has the Acrobat internal ability to handle signing well enough.
The box for signing is simply plain text (like it was in the 90s)
it was number 5 in the source but gets moved to 7 in the edits

7 0 obj
<< /AP << /N 10 0 R >> /DA (0 g /Helv 0 Tf) /F 4 /FT /Sig /Lock 11 0 R /P 8 0 R /Rect [220 680 370 730] /Subtype /Widget /T (Signature1) /Type /Annot /V 12 0 R >> endobj

HOWEVER the maths for encryption using SSL for COMMS was in the past only well known to Adobe and they have many such proprietary parts of PDF under control even if they allow open license of their tech.

[JohnPlanetary]

The signing part is the easiest, there are lots of tools for that (JSignPDF, XolidoSign, PDF Signer, etc.)

Seeing the certificate signature applied in the PDF file is the hard part (meaning: being able to see the details of the signature), at least in a application that isn't huge on resources consumed.

By the way, I don't have Edge installed, since I didn't wanted it, I use Brave and Mozilla Firefox, that I like more. In EU countries we can remove it, in other countries I think is possible but implies a lot more work to make it happen.

mutool not properly supporting digital certificate signatures is really a disillusionment.
So, I'm guessing unless some programmer does whatever needs to be done for it to work, in won't happen in SumatraPDF.

[GitHubRulesOK]

@JohnPlanetary unsure if it is due to your conversation but SumatraPDF is now using windows working signing method rather than the broken mutool one as basically you would need to be using Linux methodology like msys GnuWin on windows for mutool to work and I was still having problems there too on windows

routines:UI_process:processing error:../openssl-3.6.2/crypto/ui/ui_lib.c:
553:while reading strings
102D0000:error:0480006D:PEM routines:PEM_def_callback:problems getting password:../openssl-3.6.2/cry
pto/pem/pem_lib.c:64:
102D0000:error:07880109:common libcrypto routines:do_ui_passphrase:interrupted or cancelled:../opens
sl-3.6.2/crypto/passphrase.c:178:
102D0000:error:1C80009F:Provider routines:p8info_to_encp8:unable to get passphrase:providers/impleme
ntations/encode_decode/encode_key2any.c:125:
K@HP-Z240 MINGW64 ~
$

SimatraPDF will now show the data so for the MuPDF typical example earlier this year SumatraPDF 3.7.1401 shows

and using msys we have a personalised PDF

including images if desired

[JohnPlanetary]

The author did reply bellow clearly showing these discussion promoted the change to support digital signatures.
At the author request I open a new Issue at: #5581 to continue to provide feedback to promote a better support for them, if technically possible.

[kjk]

In latest pre-release 18403 or later:

• in pdf document properties (Ctrl + D) SumatraPDF will show information about signatures
• you can use cmd-line SumatraPDF.exe sign ... to verify signature / sign

I don't know much about signatures so let me know if it works / what else can be done (by opening an issue https://github.com/sumatrapdfreader/sumatrapdf/issues)

[JohnPlanetary]

Ok, I initiated a Issue at: #5581 to talk about possible improvements that would improve the displayed information usefulness to the final user like me.