Re: [libreoffice-users] Digital signatures

Hi, I have been using signatures occasionally over the past couple of years
without any problem.  I initially used Firefox to load my signature together
with the root.  LO swriter then had no problem  finding the certificate and
signing with it.

Now, my old certificate has expired and I have the replacement certificate
installed in FireFox..

Your email prompted me to try and sign a document with my new certificate.  LO
cannot see my new certificate (only the old expired one).

As usual (see recent threads) the LO Help doesn't actually help very much.  It
talks about an ADD button in the Digital Signing dialog but I don't get an ADD
button.  I can sign with the old certificate even though it is expired and then
the document shows that the signature is broken.

I used FireFox to remove my expired certificate and even after rebooting LO only
sees the expired one and not the new one.  Still no ADD button so does LO limit
users to a single certificate ?  Where does LO store the certificates ?

I found the answer to this by looking in the LO writer
Tools/Options/LibreOffice/Security tab

There the bottom item was Certificate Path and it gave me two choices : FireFox
profile or Thunderbird profile


My LO was on Thunderbird's profile and I had forgotten to update that one with
my new certificate details.  So I switched to FireFox which was up to date.

After re-starting LO, my document could be signed by the new certificate.

I updated my Thunderbird profile with the new certificate and set LO to
Thunderbird.  After restarting LO, I tried to resign the document.  But from the
Thunderbird profile, LO only sees the outdated certificate.

So I conclude several points :

1. LO Writer can only see 1 certificate in either FireFox or Thunderbird
profiles and that is the oldest of however many certs are present.

2. If the oldest is out of date - tough

3. LO Help button on the digital signing dialog box lands the user on a webpage
which correctly announces that it has no information.

4.  searching on the LO Help website finds some help which talks of using the
ADD button to add a certificate.  But at least with LO 4.2.8.2 (Ubuntu 1404 LTS
with their latest updates), I cannot find any such button.

5. My solution was to delete the expired certificate from FireFox profile. And
LO correctly used the new one which had remained invisible up to that point.

I am not sure that time expired certs should be deleted.  They are probably
needed to verify old signatures or to decrypt old files.

Philip



On 12/10/15 04:14, Евгений wrote:
> No one here used signatures?
> No one can help or give some advices to resolve problem?
>
>
> 07.10.2015, 10:00, "Евгений" <nauevg@ya.ru>:
> > Hello.
> >
> > Can someone help me with digital signatures?
> >
> > I tried LO 5.0.2, 4.4.5.2 and even AOO 4.1.1 on windows server 2008 r2.
> >
> > I have imported root CA certificate. I have copied private and public keys to registry from 
> > token.
> > My certificate is valid.
> >
> > When i use "File - Digital signatures" and try to add one to document - nothing happens.
> > I can see my certificate details from LO dialog, but when i select it and press OK - none added 
> > to document.
> >
> > Document - ODT file.
> >
> > No errors or other messages appeared.
> >
> > --
> > To unsubscribe e-mail to: users+unsubscribe@global.libreoffice.org
> > Problems? http://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
> > Posting guidelines + more: http://wiki.documentfoundation.org/Netiquette
> > List archive: http://listarchives.libreoffice.org/global/users/
> > All messages sent to this list will be publicly archived and cannot be deleted


-- 
To unsubscribe e-mail to: users+unsubscribe@global.libreoffice.org
Problems? http://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
Posting guidelines + more: http://wiki.documentfoundation.org/Netiquette
List archive: http://listarchives.libreoffice.org/global/users/
All messages sent to this list will be publicly archived and cannot be deleted