Acrobat 9 Family of Products
Controlling Signing with Seed Values
Security Feature User Guide
Specifying Signing Certificates Origin 82
5.10.1 Specifying Signing Certificates Origin
Authors can limit potential signers to individuals or groups as follows:
subject
limits potential signers to only those specified individuals. Signers could be limited to one or
more people.
issuer
limits signers to those with certificates that chain up to a common, shared issuer. For example,
all of a company’s employees may use the company’s certificate as an intermediate certificate and that
certificate could be used as the issuer.
subjectDN
limits signers to those with certificates that match all the attributes of one of the listed
DNs. For example:
{cn:”Alice”, ou:”Engineering”, o:”Acme Inc”}
. For details about the friendly names
of DN attributes (cn, o, ou, and so on), refer to the RDN Object in the
JavaScript for Acrobat API
Reference
.
{cn:”Joe Smith”, ou:”Engineering”, 2.5.4.43:”JS”}
, where OID 2.5.4.43 is used to
carry out matching for the “Initials” attribute.
The following is sample code to define the above DN:
var subjectDN = {cn:”Joe Smith”, ou:”Engineering”};
subjectDN[“2.4.5.43”] = “JS”;
Attributes whose value is of type
DirectoryString
or
IA5String
can be specified as shown in the
example above, whereas all other value types, e.g. dateOfBirth whose value is of type GeneralizedTime,
the value needs to be specified as a hex encoded binary string.
To specify a certificate:
subject
array of
certificate
objects
One or more subjects that are acceptable for signing. The subject property identifies
specific individuals (as certificate owners) that can sign. Access to the physical,
DER-encoded certificate is required. It is identified by a path to a discrete file in the
format of [
"/c/test/root.cer"
].
subjectDN
array of
certificate
objects
(Acrobat 8.0) Each object specifies a subject distinguished name (DN) acceptable for
signing. More than one DN may be specified, but a signing certificate must satisfy at
least one of the DNs by containing all the attributes specified in the matching DN.
DN attribute restrictions are specified by adding them as properties. The properties’
key names can either be the corresponding attributes’ friendly names or OIDs (as
defined in RFC 3280). The properties’ value must be of type string.
For more information about the various attributes and their types, refer to RFC 3280.
url
string
A URL that can be used to enroll for a new certificate if a matching one is not found,
such as
https://aardvark.corp.example.com/
. Works in conjunction with
urlType
(if present).
A degenerate use of this property is when the URL points to a Web service that is a
digital ID store such as a roaming ID server. In that case, the URL indicates that as long
as the signer has a digital ID from that Web service, it is acceptable for signing.
urlType
string
(Acrobat 8.0) The
url
type. If this attribute isn’t present, it’s assumed that the
url
points to a HTML site. There are two supported types:
HTML
: An HTML website. Acrobat uses the Web browser to display its contents.
ASSP
: A URL to a web service using the ASSP protocol for roaming ID servers.
Table 11 Seed values: certSpec properties
Property
Type
Description