Where to get Certificate for digitally signing PDFs?

Question

I'm working on a Java application that uses iText to digitally sign PDFs that will be made available online. I have been able to sign the documents with a test cert I obtained from GlobalSign and it works great. The test cert is part of GlobalSign's "DocumentSign for Adobe PDF". The reason I had to use this cert is so that my cert chains back to the Adobe Root CA, which to my knowledge (and I could be wrong) is the only CA that is trusted by Adobe Reader out of the box. I tried regular SSL certs from VeriSign and Entrust but they didn't work as they were not trusted.

Now I need to get a permanent cert but GlobalSign (as well as VeriSign and others) want to sell me a service that requires extra hardware for the 2 factor authentication which I do not want. There doesn't seem to be a way to get the cert only. My question is, has anyone else gone through this? Is there another way to get a cert that Adobe Reader will trust (other than having the end user manually enter the cert into the list of trusted certs)? Have I missed something?

Thanks for any help you can provide.

Answer 1

Verisign offers MyCredential for Adobe Acrobat for personally signing PDFs and True Credentials for Adobe, but it also seems to require a USB token. You may be stuck with that.

Answer 2

Try GeoTrust also offers PDF Signing Certificates but I think it is similar to GlobalSign and VeriSign's offerings.

Answer 3

You can also use Ascertia's issued free digital certificate. You can get this from: https://www.ascertia.com/OnlineCA/Default.aspx

Answer 4

There are three ways you can approach this. None of which are ideal.

1. Adobe CDS: This works in Acrobat 6+ but as far as I can tell requires two factor authentication and heavy licensing costs.
2. AATL: Instead of linking back to Adobe's root CA they trust a certain list of providers. As far as I can tell they still require a hardware device. Also, this only works in Acrobat 9+
3. Windows Certificate: Acrobat includes a preference to integrate with the windows certificate store. This means that any root CA trusted in your windows store will be trusted by Adobe. They really should have just enabled this by default.