<html> <head> <base href="https://bugs.freedesktop.org/"> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW - Certificate chain from PDF digital signature back to trusted root certificate not verified?" href="https://bugs.freedesktop.org/show_bug.cgi?id=99365#c3">Comment # 3</a> on <a class="bz_bug_link bz_status_NEW " title="NEW - Certificate chain from PDF digital signature back to trusted root certificate not verified?" href="https://bugs.freedesktop.org/show_bug.cgi?id=99365">bug 99365</a> from <a class="email" href="mailto:aguerreiro1985@gmail.com" title="Andre Guerreiro <aguerreiro1985@gmail.com>"> Andre Guerreiro</a> <pre>There are indeed 2 different validations happening here: 1- Verification of the cryptographic signature in a strict sense 2- Certificate verification: which includes validity checking and making sure that the certificate chain ends in a trusted root. Maybe we can change the output string of pdfsig for the 1st validation to something more specific if people find the wording to be misleading: "Signature Validation: the document was not modified since the document was signed" Additionally we could output a "global" validation result for each signature which would have 3 possible values: Valid, Invalid or has Issues (when the certificate is not valid or wasn't even verified). This seems to be the approach taken by Adobe Reader for the signature status icons (Green check, Red Cross, Question Mark)</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the assignee for the bug.</li> </ul> </body> </html>