<html> <head> <base href="https://bugs.freedesktop.org/"> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW - Certificate chain from PDF digital signature back to trusted root certificate not verified?" href="https://bugs.freedesktop.org/show_bug.cgi?id=99365#c5">Comment # 5</a> on <a class="bz_bug_link bz_status_NEW " title="NEW - Certificate chain from PDF digital signature back to trusted root certificate not verified?" href="https://bugs.freedesktop.org/show_bug.cgi?id=99365">bug 99365</a> from <a class="email" href="mailto:luizluca@gmail.com" title="Luiz Angelo Daros de Luca <luizluca@gmail.com>"> Luiz Angelo Daros de Luca</a> <pre>Hello, I also got this problem with pdfsig v0.52.0. It seems that pdfsig simply passes to NSS the signer certificate and ask "is it valid?" The problem is that, normally, NSS cannot verify all the chain from the (imported) root CA to the signer certificate because it misses all the intermediate CA. If I manually import all intermediate CA into firefox, pdfsig can verify the certificate correctly. However, it is not expected that the user must import intermediate CA before checking a certificate. A PDF file must contain all the certificate chain from the signer certificate (first) until the last CA before root CA. It seems that pdfsig is not passing these intermediate certificates to NSS. I never used NSS but it must import all intermediate CA into NSS session as an non-root CA.</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the assignee for the bug.</li> </ul> </body> </html>