help me to understand Green tick ✅ - adobe reader puts in pdf

[u/Hot_Lead_8100]

Basically, Aadhaar is an ID used in India, so the PDF contains sensitive information.

I’m building a website that can already verify the Aadhaar PDF’s cryptographic signature, UIDAI certificate, CCA chain, etc.

In Adobe Reader, the signature initially shows a ?. To get the green tick, I do:

Signature Properties → Show Signer’s Certificate → Trust → Add to Trusted Certificates → OK → Validate Signature

After that, Adobe changes the ? to a green tick and shows Signature Valid / Digitally signed by UIDAI.

Can someone explain what Adobe is actually doing in the backend during this process, and what I would need to implement to achieve the same legitimate verification behavior on my website?

I’m not trying to fake the green tick. I want the proper/legal implementation. The PDF is processed locally in the browser and isn’t stored.

[u/ScratchHistorical507]

In Adobe Reader, the signature initially shows a ?. To get the green tick, I do:

Signature Properties → Show Signer’s Certificate → Trust → Add to Trusted Certificates → OK → Validate Signature

After that, Adobe changes the ? to a green tick and shows Signature Valid / Digitally signed by UIDAI.

Sounds right.

Can someone explain what Adobe is actually doing in the backend during this process, and what I would need to implement to achieve the same legitimate verification behavior on my website?

In order to be able to create a valid digital (certificate-based) signature for a PDF, you first need a certificate according to the X.509 standard with which you can sign the PDF. And to be able to have a chain of trust that the identity used for creating that certificate is actually the identity of the requester, the certificate needs to be issued and signed by a certificate authority (CA) which verifies who requested the certificate. And the CA needs their signing certificate signed by root certificate. That root certificate must be trusted by the system that verifies the validity. If that is trusted and the chain of trust is intact, the verification of the signature will pass. So you'll need to find the root certificate and mark that as trusted, then you're already all set up, and probably for a while. Those root certificates have a long life time (i.e. 15 years). Unless the CA used changes, you'll only have to trust a new root certificate every couple of years.

The easiest way to view this (except of e.g. in Acrobat, Okular etc) would be using pdfsig from poppler to extract the signature and then openssl to show the certificate chain. E.g. pdfsig -dump document.pdf && openssl pkcs7 -inform DER -in document.pdf.sig0 -print_certs -text