PDF signing for 100+ users
TLDR; How do you guys manage digital certificate signatures and PDF signing? I have about 100 users that need to be able to securely sign PDFs and verify those signatures. Most of them are on shared workstations. I know I could have them all make pfx files…
TLDR; How do you guys manage digital certificate signatures and PDF signing? I have about 100 users that need to be able to securely sign PDFs and verify those signatures. Most of them are on shared workstations. I know I could have them all make pfx files and store those in a network share, but I feel like that's not an optimal solution (but idk, maybe that is good enough?). I'd prefer something on-prem and not subscription based, but I know that's "old school". We do government work occasionally so there's always extra headache whenever the cloud is involved. Any recommendations?
Collected discussion
Are they needing to put a digital signature on a document on their drive or are they needing to sign a document sent to them? Do they need to request signatures from others?
Also would be a good idea to know if the signatures need to be able to be validated outside of the organization/by third parties . Doing that with certificates is a small nightmare.
As far as I know the signatures to do not need to be validated outside the org.
If you work in domain joined windows environment I believe all can be done in Microsoft management console without much hassle if you don't got some strict internal processes in your org. You need to assign a machine as local certification authority, distribute it's cert via GPO to other machines as trusted authority. Later you issue the certs on the local CAand they should be distributable to user accounts again with user GPs.. Google something like issuing and distributing signing certificates on local CA These are just for internal validation, not outside of organisation.
Yeah I get that. But honestly that part is QA's problem, not mine. I'm just trying to give them something that's technically secure and reliable. If they want to muck it up with bad policy and personnel management that's on them.
The PKI or other way to prove who signed it is the important part. Which program they use to click "sign" isn't as important
I've had maximum 3 lmao
So the workflow is something like: Employee A gets a PDF form from a network share, fills it out, and signs it at their workstation. Employee A uploads the signed PDF to a network share. Employee B (at a different workstation) looks at the file on the network share and verifies its validity. Employee B might need to request a signature from Employee A, but everyone is in the same building so they could just go ask them to make changes and sign it again.
these going to have an actual chain of trust behind them? otherwise it’s pointless and the certificate doesn’t mean shit. my users don’t understand this
These are the juicy details we need!
It depends what you need the certs for - there is a big difference if it is just inside your organisation or if users communicate for example with goverment offices .. I write from EU from pretty regulated bussines, where is need for compliance and what we do now is a cloud solution basically from national post office, where they also issue the certs. For compliance you should have a MFA and HSM so there are virtual usb tokens installed on every machine, that simply put import, validate and protectwith PIN the certs that are located on cloud independent of machine where user sits, so there is no need for exporting and distributing the certificates (which is even rightfully not even possible in this setup). There is also a dashboard where admins revoke certs and confirm requests for issuing new certs. There is a even a possibility to have the authentication inside organisation, but that is too much hassle, users have to go to post office to show IDs when issuing new certs in our org. In theory users can request issuing or prolong own certificates, in praxis BFU is not able to do so, I would like to see organisation and solution, where it works.. Look at you national issuer or commercial services if you live in US - everyone will have some similar solution. To be honest I think cloud solution is better - you don't want and will not be able to get things working fast when something changes in for example in legislation or fucks up and nobody in whole organisation can't sign anything. Also your hands are clean when something fucks up big time securitywise - you can sue someone else. We did it manually before and with few hundred users it's manageable but it is really a manual work, esp. if users move around machines. Main problem is it is not compliant with our regulations.. The signing alone is easy part - Adobe Acrobat Reader can do if you got the cert installed, there can be catch with with maintaining the trusted chain of issuers, but that is really not such a big problem.
Okay, 100+ sounds tough - tbh never dealt with anything like that, we've had maximum of 9-10 and (as I remember) used Agrello for signs managin. In principle, they're probably suitable for 100+ as well, but you need to check it
Look at docuseal.
Documenso can be self-hosted, at that point you just need a document signing cert from a CA for around $200-300
My work picked Sign Now. I don’t really use it, but I hear people like it.
We setup a smart contract environment and do that for everything.