Error when signing PDF document with Azure Key Vault + Azure Function Apps + CA Certificate

0
votes

I have built an Azure function app that is signing PDF document with iTextSharp. This function app uses a certificate that is stored in Azure Key Vault.

When using a self signed certificate, for example one that was generated inside that vault or on my local machine, everything works great and I can see the signature details in the PDF file, but when I try use a certificate from CA, for example , a .PFX file from COMODO or digiCert that I import into the vault, the PDF signature comes out with an error.

Meaning, that when I open the signed PDF file in and click on the signature details, I get the error :

Error during signature verification.

Error encountered while validating:

Internal cryptographic library error.

Error Code: 0x2726

I tried to compare the working certificates with the CA certificates, and the only difference I have found, is that the keys of the working ones have the "Encrypt" key flagged and the CA ones, doesn't. This flag is not editable, or I just can't find a way to control this flag.

Please advice.

Edited : Please find below links to sample files.

Working Azure key vault Certificate generated PDF

Invalid CA Certificate generated PDF

The files have to be download and opened in Acrobat in order to see the signatures.

1
azureitextdigital-signatureazure-functionsazure-keyvault
Please share a sample signed PDF with that issue. - mkl
I have added 2 samples, one working and one with the issue. Thanks. - Igor Po

1 Answers

2
votes

Your PDF is indeed signed by a CA certificate, i.e. a certificate that may be used for issuing other certificates. (When I read your question I though your signer certificate merely was issued by a proper CA certificate, not that it was a CA certificate.)

In particular it has a key usage extension with values:

  • digitalSignature,
  • keyCertSign, and
  • cRLSign.

Adobe, on the other hand, only accepts signer certificates with one or more of the following:

  • nonRepudiation
  • digitalSignature

if the key usage extension is present at all, confer e.g. Adobe's Digital Signatures Guide for IT - Appendix A: Changes Across Releases. Thus, the fact that your certificate also has key usage values keyCertSign and cRLSign makes it unsuitable for signing PDFs (or more exactly for PDFs signed with it to be validated by Adobe software).

As your certificate can serve as a certificate issuer, though, you can use it to issue a dedicated signer certificate which satisfies Adobe requirements for acceptable signer certificates. Don't forget to provide and advertise a CRL, though, to allow revocation checks!