Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I have a question about creating digital signatures for pdf files. I want to have a certificate for my company and have children certificates as many as the number of company's employees who can validate their signatures in pdf files.

If I have a company certificate signed by, e.g., Verisign, can I use that certificate to generate chain certificates (i.e., ones for employees) by myself?

In this case, how does Verisign charge for the signing service? Just one license for the company certificate or as many licenses as the number of our employees?

share|improve this question

2 Answers

up vote 1 down vote accepted

When you get your certificate signed one of the "Features" that can be enabled or disabled is if your certificate can sign other certificates. Public CA's never sign certificates with that bit set. If it was set you could just sign a cert for mail.google.com and it would appear to be perfectly valid for everyone on the internet.

Your only two options is to have your root CA that your corporation runs be trusted by the party you are sending the PDF's to, or have the PDFs signed by a certificate that is assigned to your corporation and signed by a trusted 3rd party CA.

share|improve this answer
Many thanks for your answer. If I wish to have pdfs personally identifiable in the company, I have to get certificates (signed by Verisign) as many as employee number, right? – ToyHunter Oct 8 '12 at 15:08
It does not need to be Verisign, there are cheaper providers out there that may be available. – Scott Chamberlain Oct 8 '12 at 15:49
I just want to make sure about the number of certificates I need before making any decision. Ok, I will survey cheaper vendors. Thank you! – ToyHunter Oct 8 '12 at 16:08
there are vendors that will sign your own CA certificate, Globalsign is one of them, but it costs a lot more than regular certificates. – Hubert Kario Oct 9 '12 at 8:22
up vote 1 down vote

If you are on a Windows Active Directory domain, you can set up your own CA and make all computers on the domain recognise it as valid. This way you will be able to create as many internal certificates as you need. Start here - http://msdn.microsoft.com/en-us/library/windows/desktop/aa376539%28v=vs.85%29.aspx

share|improve this answer
This does not answer the author's question. – Ramhound Oct 9 '12 at 13:04
Just trying to be helpful and answering the real question behind the one asked. The answer to his question has been given - you cannot get an intermediate cert from a commercial CA, it is like asking for a bank for a license to print money. – agelastic Oct 10 '12 at 7:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.