Digital signatures not available in 10.7

[rlg]

Hi all!

Today we upgraded our PDF-XChange Editor to version 10.7, but then we noticed, that some of our certificates weren't available in the Sign Document dialog anymore. After some testing we assume that the new version changed what Extended Key Usage must be set for a certificate to be available. Currently a lot of our certificates only have the EKU for Secure E-mail which was sufficient up until 10.7. Now it seems only to allow those certificates which have either Code Signing or Document Signing set.

Is this change intentional and do we have to adjust our certificates accordingly or will this be fixed to also allow Secure E-mail again?

Kind regards,
RLG

[Daniel - PDF-XChange]

Hello, rlg

We are investigating a few such cases, if you could help us by logging your process. In this case specifically, opening the "sign document" window, and clicking the "manage" button for a moment, to show the difference between the ID list there, and what certificates are available in the previous window, that would be perfect.

Also, if you are able to record a video of the process as you are using Debug view, that would help the Dev team to navigate the logs, as we can use the timestamps to quickly identify problem points. That video can be uploaded alongside the log file.
Here is a portable debug version of the Editor 10.7, with additional logging for certificates: [check your email please]

Short instructions:
1. Extract the archive to any folder.
2. Run `DbgView.exe` from that folder - it is Microsoft's utility for collecting debug outputs
3. Run the Editor from that folder.
4. Create a new document and try to sign it.
5. When done (successfully or not), save the log from Debug View (File -> Save As...) and upload it here:
[check your email please]

Kind regards,

[HGCBOL]

Hi Daniel,

we are experiencing the same issue after upgrading to version 10.7. On all workstations where we had updated via baramundi managed software, the problem with the certificates appeared immediately, so we downgraded back to 10.6 and everything is working fine again.

Our certificate includes the "Digital Signing" usage, it is present in the user’s Windows certificate store and valid. However, after the update, on some machines no certificate at all is offered in the signing dialog, and on others only the AD root certificate is shown. When trying to add the user certificate through PDF-XChange directly, it gets rejected with the note “not compatible.”

In version 10.6, the user certificate stored in Windows is recognized instantly and can be used without problems.

Kind regards,
Rudi

[rlg]

Hi Daniel,

sorry for the delayed response. I needed to get our system administrators approval first, before I could try out the debug version for which you've sent me a link. But when I tried today the link wasn't working anymore. My guess is, that it's related to the other topic regarding the problem with signatures, where you've stated that there's now a newer debug version and you probably disabled access to the previous version?

For now our admins did the same thing as HGCBOL mentioned and downgraded back to 10.6 for all our users.

Since you've mentioned, that you already have an idea what could be the core of the problem, I'd say we can just wait for the update 10.7.1. If you still need more feedback, feel free to send me a link to the new debug version and I hope I can get it approved a bit faster this time around.

Kind regards,
RLG

[Daniel - PDF-XChange]

Hello, rlg and HGCBOL,

For now, rolling back would be the correct solution. After we hear back from a few more of the tests that are already out, we plan to release a 10.7.1 next week (hopefully Monday).

We are terribly sorry for the trouble this has caused, the new signing tool was targeted to resolve numerous issues with advanced signing tools, like external smartcard devices, but required some hefty re-working of previous functionality to account for that. Sadly, it is an area with so much variance that we did not have enough options on hand to test every possibility locally.
The in house testing that was done, covered the most common scenarios, including various self signed, and signed by a CA certificates, as well as the few select smart cards we had on hand, but with any overhaul like this, some issues will sneak through the cracks just by nature of minor differences in each possibility.

Looking forward, keep an eye out next week for the 10.7.1 release, and if you can, test it first on one of the devices which had signing issues, before deploying the update company wide.
We are quite confident that most, if not all of the issues (both with signatures not appearing, and signature placement failing) should be fixed with the upcoming changes, as we have seen a good number of logs so far. Should anyone spot issues next week, we will definitely want to know about them quickly.

@rlg, As for the debug version, I should apologize. Yes, we put out a new debugging build yesterday while you were out and the old one was taken down, I tried to follow-up on everyone I had sent the first one to, but It seems I missed yours. You are correct that your case as described, sounds pretty well identical to issues from the other threads. Given the timeframe (we need these reports in before the end of today, so the team has time to review them), I wont rush you by sending a new link out, as you said, you can keep an eye out for 10.7.1 which will very likely be coming early next week.

Kind regards,

[HGCBOL]

Hi Daniel

Thank you for providing the update so quickly.
This morning we upgraded a few machines to version 10.7.1 for testing, and it seems that the certificate-related issues have been resolved for our use case.

Best regards,
Rudi

[rlg]

Hi Daniel,

I just got the update as well and I'm happy to report the same as HGCBOL. All the signatures that went missing are now available again
Thanks for the quick fix!

Kind regards,
RLG

[Dimitar - PDF-XChange]