4

I live in Peru and we have a small problem in the organization where I work. Dozens of documents are physically signed daily but this is a waste of time since there are documents that must be signed by more than one person and these people are in different geographical locations.

I am thinking of using digital certificates to sign PDFs but this causes me another problem. Certificates are issued in the name of the Organization, not of the employee who signs. Buying (and processing) the generation of a certificate with legal validity for each employee will take time and money so my question is the following:

Is it possible to generate new certificates for each employee (with legal validity) using our institutional certificate as root certificate?

Improve this question
4

No, you can't use your purchased signing certificate to sign other certificates. It is not allowed. Although, you can try, but signature will be untrusted. The ability to sign other certificates is governed by Basic Constratins and Key Usage certificate extensions and values of these extensions in your certificate don't meet criteria. For more details about Basic Constraints in action you can check my blog post: Basic Constraints certificate extension.

Improve this answer
2
  • What should I do? Generate self-signed certificates and assign them with a kind of document/charge to the employee to have legal validity? – Jean Paul CP Mar 6 '20 at 23:34
  • 1
    As an option. If you don't want to buy certificates you also may consider to implement private PKI using CA software. Such as Microsoft ADCS or EJBCA. – Crypt32 Mar 6 '20 at 23:39
2

Regarding using of certificate to sign other certificates: The answer of @Crypt32 is correct regarding the structure / contents of a certificate.

Regarding "with legal validity": If you use private PKI, this will not be recognizable by the others outside of your organization. Means, it will not have legal validity for the others. When somebody outside your organization clicks on your signature in PDF he will get a message that certificate is not trusted (because very probably they have not added the root certificate of your organization as trusted).

I'd suggest that you consider purchasing signing certificates for your employees. Buying a certificate takes a few minutes. I don't know what you mean by processing. In many companies it looks as follows: Your administrator orders / pays a certificate for an employee and specifies the data of your employee including his/her email. In a few minutes (sometimes in a couple of hours, depending on CA) the employee receives an Email from the CA with a link where he/she can complete generation of certificate within a few minutes. And that's all. You employee has a certificate issues by a recognized CA which is trusted in the most systems and browsers by default.

If you have hundreds or thousands of employees, yes, it will take some time. But it will be done only once a year. Where as setting up the infrastructure can take much time. Besides, you will need some permanent efforts for maintaining it: backups, security patches, regularly auditing permissions, etc.

Regarding money: Each organization has its own meaning of what is expensive. But there are many CAs that provide a 1 year certificate (for document signing) that costs about 10 USD. I don't advertise them here, but you can find them easily by googling.

Improve this answer
7
  • Buying a certificate takes a few minutes.. But the way to this point can be quite long. This is because you may need to go through many levels in order to get approval (bureauracy). – Crypt32 Mar 7 '20 at 9:58
  • @Crypt32: I don't understand what "way" and what "approval" you mean. Approval of costs? A certificate is cheaper than a very cheap computer mouse. That's why normally any manager or any admin with the least approval rights can purchase it. Furthermore, users can purchase such certificates directly without any approval, if their organization reimburses them later the costs. – mentallurg Mar 7 '20 at 11:14
  • @Crypt32: Users don't need any approval to open a CA web site and to order a certificate there. – mentallurg Mar 7 '20 at 11:20
  • 1
    Did you work in large companies? The problem is not in costs themselves. Sometimes it takes weeks to get approval for $5 purchase. I worked in a company with ~10k empoyees and things that weren't allocated in a budget required a long road of paper work in order to get required approvals, signatures and pass final resolution to responsible team. – Crypt32 Mar 7 '20 at 11:20
  • Users don't need any approval to open a CA web site and to order a certificate there. in very small companies -- maybe. Once you get a dedicated IT management team, you (as a standard employee) may not have access to CA web page with company account. I don't know the size of OP's organization and OP role there. But things can be complicated and not that rare. – Crypt32 Mar 7 '20 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.