Adobe Acrobat DC with Entrust Time Stamp Server: nShield HSM Integration Guide

We have successfully tested the integration between TSS and Adobe Acrobat in the following configurations:

Other product configurations might work, but not all possible combinations, but have not been tested by Entrust.

Before setting up the time-stamping functionality, ensure that:

• nshield software and hardware are installed and operational - the server URL of TSS will be needed during the integration process.

• Security World has been created and usable.

• The nshield Time Stamp Option Pack ^TM (TSOP) has been installed and the Default TSA is usable.

• Required certificates have been imported into the trusted Root CA on the local machine:

  • Signing root certificate.

  • If a third party is used to sign TSA certificates, subordinate certificate(s).

• Adobe Acrobat Pro DC has been installed.

• Appropriate Administrator rights are available to edit Adobe Acrobat settings options.

This document assumes that:

• You have read the documentation supplied with TSOP and have installed TSS.

• You are familiar with Adobe Acrobat DC documentation and have installed Adobe Acrobat DC.

1. Ensure that your TSA is healthy and operational: In the TSA Operational Status page, the TSA shows all green lights.

2. Ensure that the Security World is operational and healthy:

   1. On the left, click About .

   2. Select Application Version .

   3. Scroll down to show Module 1# .

      The Module mode should show as operational .

3. Continue to scroll down to nfkminfo output: World .

   The state should show as Initialised and Usable . There should be no exclamation marks ( ! ).

   If either properties are preceded by an ! , ensure that the Security World is available and operational.

4. Continue to scroll down to hardware status and ensure that it is reported as OK .

1. In the Windows Start menu, click Adobe Acrobat DC .

2. In the Edit menu of Adobe Acrobat, click Preferences .

3. From the list of categories, select Security.

4. In the Configure Server Settings pane, click More .

5. In the Server Settings dialog, from the list of options, select Time Stamp Servers .

6. In the top ribbon, click New .

7. In the New Time Stamp Server dialog, enter a name and the server URL of TSS, then click OK .

   You should now see the server that you just added.

8. Select the TSS, and in the top ribbon click Set Default .

9. When prompted Are you sure you want to make this your new default server? , click OK .

   If the default is successfully set, Set Default is replaced by Clear .

10. Close the Server Settings window.

1. Stay in the Preferences dialog of Adobe Acrobat DC, and from the list of categories, select Signatures .

2. In the Identities & trusted Certificates box select More .

3. In the Digital ID and Trusted Certificate Settings dialog, select Digital IDs > Windows Digital ID Files , then click Add ID .

4. Select Add a new self-signed digital ID , then click Next .

5. Fill in the information fields (name, organizational unit, etc.), use the drop-down lists to select the key algorithm and the digital ID usage, then click Finish .

6. Confirm that the new ID appears in the list.

1. Still in the Digital ID and Trusted Certificate Settings dialog, select Digital IDs > Trusted Certificates .

2. On the Trusted Certificates tab, select Import .

3. In the Choose Contacts to Import dialog, use Browse or Search to locate the Root Certificate and any Subordinate Certificates.

4. Double-click the certificates to select - You will see them appear in the Contacts window.

5. To add the certificates, click Import , then click OK to close the confirmation dialog about the import.

6. Confirm that the imported certificates appear in the list.

1. Still in the Digital ID and Trusted Certificate Settings dialog, select the imported Root CA, then in the ribbon at the top of the window click Edit Trust .

2. Select Use this certificate as a trusted root , then click OK .

3. In the ribbon at the top of the window click Certificate Details .

4. In the Certificate Viewer dialog, switch to the Trust tab.

5. Ensure that there is a green check mark next to Sign documents or data , then click OK .

6. Close the Digital ID and Trusted Certificates Settings dialog.

7. To exit the Adobe Preferences configuration settings, click OK .

1. In Adobe Acrobat DC, open the document to sign and time-stamp it digitally.

2. From the ribbon on the right-hand side, click Certificates .

   If the Certificates option is not visible:

   1. In the ribbon on the right-hand side, click More tools .

   2. Under Forms & Signatures , click Add for the Certificates tool.

3. In the Certificates toolbar, select Digitally Sign .

4. Follow the information in the dialog box to select an area for signature, then click OK .

5. Select the Digital ID with which to sign, and click Continue .

6. Confirm all details and click Sign .

7. Choose a location to save the newly signed document.

   To avoid overwriting the original file, use a different file name for the signed document.

8. To inspect the signature properties, right-click the signature on the PDF page and select Show Signature Properties .

1. Log in to TSS as Admin.

2. Under TSA Management , click Time Stamps Issued .

3. Check for the number of issued time-stamps under the current TAC since TSS was started up.