Page Comparison

These instructions are intended for Adobe Acrobat Pro/Adobe Acrobat DC licensed(paid) software versions for people who have a need to Create or Edit PDF forms.
For people who simply need to sign documents, Acrobat digital signatures has been superceded by UT Docusign

Basic Instructions

If you don't already have a digital certificate:

1. go to https://certificates.security.utexas.edu/ to request one

...

1. Use your EID and EID password to log in.
2. Authenticate with Duo. 
3. Click Request a new certificate and use your @austin.utexas.edu address. Only Office365 supports digital signatures at this time. In rare instances, people request shorter email addresses and use @utexas.edu, or email addresses for their vanity domains such as @starkcenter.org or @meadowscenter.org. You may request a new certificate for those instead if the option is available.
4. Once your certificate is created it will direct you over to stache https://stache.utexas.edu/

...

1.  where you will also have to authenticate wit your EID, EID password and Duo.
2. The entry with your digital certificate will be named encryption and mail signing cert

...

1. in stache. Click on the newest dated entry
2. Download your mail encryption certificate .P12.
3. The entry with your digital certicate has a password. you will need that password from the Encrypted file password field to import

...

1. the certificate into your

...

Double click the downloaded key file named something like YourEmailAddress.P12

for MAC:

It should automatically try to import into  your keychain and will ask for the password for that file which was the password on the page where you downloaded the encryption key in the box that says "Encrypted File Password". enter that password. It may also need your EID password just to allow the importation into the keychain when it asks for your "login" password. 

if you imported it successfully, there will be a Keychain list on the left, and also a Category list. click My Certificates in the Category pane and locate your certificate. Click the triangle beside your certificate so it shows your private key beside your email address. Double Click the Key icon with your email address.

if you get this far, click the Access Control tab. in the box underneath where it says "Always allow access by these applications:" click the + sign underneath and navigate your way to your Applications folder and add Adobe Acrobat Pro.app, or whichever version of Adobe Acrobat you're using. I usually add Mail.app so I don't have to go back at a later date to set them up for email signing and encryption. Don't bother with Mail.app if you use Outlook for email.

Save Changes. it should ask for your "login" (EID password) password again.

FOR Windows:

...

1. Acrobat Digital IDs. Select the whole password with your mouse and hit Command-C or go to the Edit menu and choose Copy.

Then

For MAC:

1. Open Acrobat by clicking on it if it's in your dock, or by going to your Applications folder and double clicking Acrobat Pro/Acrobat Pro DC/Acrobat Reader DC
2. Go to the Acrobat Menu and slide down to Preferences
3. Scroll down to Signatures and click on it
4. in the Identities & Trusted Certificates section, click More
5. Click Add ID (ID card icon with plus symbol)
6. Leave the default selection of My existing digital ID from: A file and click Next
7. Browse to your Downloads folder, click on the .P12 file, and click Open
8. Enter the password from the Stache field labeled Encrypted file password or paste the previously copied password (Command-V or choose Paste from up top in the Edit menu)
9. Click Next
10. Click Finish
11. Click Close
12. Open the application Keychain Access found in the Utilities folder in Applications in Finder
13. If prompted, use your login password to unlock Keychain Access.
14. In the left-hand column, select login
15. In the row at the top of the window, select My Certificates
16. Drag and drop the .P12 file into My Certificates
17. Paste (Command-V or choose Paste from up top in the Edit menu) the Encrypted file password you copied from Stache into the Password prompt.
18. Click on the > symbol beside the new certificate.
19. Double-click your email address that just dropped down.
20. Click Access Control
21. Click the + button
22. Navigate to Application to Adobe Acrobat 2020 and select Adobe Acrobat
23. Click Add
24. Click Save Changes
25. Enter your login password
26. Close Keychain Access
27. Go to the Acrobat Menu and slide down to Preferences
28. Scroll down to Trust Manager and click on it.  The reason for these next steps is listed towards the bottom of the wiki under Update the Adobe Trusted Root Certificates To Allow For Successful Validation of UT Employee Signed Documents
29. Tick the box Load Trusted Root Certificates From An Adobe AATL Server. This option allows Acrobat or Reader to automatically download trust settings from an Adobe server. These trust settings ensure that the user or organization associated with the certificate has met the assurance levels of the Adobe Approved Trust List (AATL) program.
30. Tick the box Ask Before Updating.
31. Click Update Now.
32. You may repeat these steps for the Automatic European Union Trusted Lists (EUTL) updates.
33. Click OK
34. Restart Adobe Acrobat/Reader to put the change into effect.
35. Reopen Acrobat
36. Go to the Acrobat Menu and slide down to Preferences
37. Scroll down to Signatures and click on it
38. in the Identities & Trusted Certificates section, click More
39. Click the ID that has your FIrstName LastName <emailaddress>. There are two.  Select the one that has Mac Keychain Store under the Storage Mechanism column
40. At the top, click Certificate Details.  The following steps will resolve all the certificate path errors.
41. At the left column, select The University of Texas at Austin RSA CA
42. Click the Trust tab
43. Click Add to Trusted Certificates... and OK on the Adobe prompt
44. On the pop-up window, make sure to tick all four boxes including the one that says Use this certificate as a trusted root.
45. Click Trust
46. Click OK
47. Click OK again.  The certificate path should be valid now.
48. up in the Usage Options heading (pencil icon), slide down and click Use for signing. Do this again for Use for Certifying and Use for Encryption. Note: Acrobat Reader DC will only have the Use for signing option.
49. Click Close
50. Click OK
51. To test it out, you can open a PDF document and sign a document.  If prompted by Keychain Access, enter your login password and click Always Allow.  If you press enter, it will only allow it once.

For Windows:

1. Double clicking the downloaded .p12 file will open Certificate Import Wizard.
   Go through the wizard. You shouldn't have to tick off anything. Do not check the box to force strong protection or it will make you enter your password every time you want to use the

...

Finish the wizard.

in Acrobat:

Then open Acrobat Pro/Acrobat Reader and go to the Acrobat menu (Edit menu on Windows) and choose Preferences. scroll down to Signatures. 

on the right is Identities & Trusted Certificates. Click More.

under Digital IDs, the certificate with your name should show in the right panel. click on your certificate once, and under Usage Options do for each item one time: Use for Signing. Use for Encryption. Use for Certifying. 

click Close

...

1. certificate for signing. You will need the password from the stache entry in your encryption and mail signing cert.
2. Finish the wizard.

This wiki page demonstrates how to place a signature in Acrobat. The On a mac, the first time you sign a document, it will ask for your Login password. It will be your EID password. Make sure you click Always Allow or it will make you do this for every document you try to sign. 

Update the Adobe Trusted Root Certificates To Allow For Successful Validation of UT Employee Signed Documents

When someone uses their UT assigned digital certificate to sign a document, by default new installations of Adobe Acrobat/Reader will not trust the signature, which will result in a warning being displayed when people open up the signed document and verify the authenticity of the certificate used to sign the document. This happens because the certificate company that UT uses for their certificates is not currently built into and trusted by Adobe Acrobat/Reader. So you have to manually update Acrobat to download the latest global trusted Certificate Authorities. This manual trust has to be done on a per-user account basis so if you have multiple users on a computer, each user account will need to go through the process of downloading Trusted Cerficate Authorities. 

1. Ensure Adobe Acrobat/Reader is installed on the target computer.
2. Choose Edit > Preferences (Windows) or Acrobat / Acrobat Reader Menu bar > Preferences (macOS).
3. From the Categories on the left, select Trust Manager.
4. Select the option Load Trusted Root Certificates From An Adobe Server. This option allows Acrobat or Reader to automatically download trust settings from an Adobe server. These trust settings ensure that the user or organization associated with the certificate has met the assurance levels of the Adobe Approved Trust List program.Do the following: (AATL) program.
5. Tick the box to be prompted when new root certificates are available from Adobe.
6. Select Ask Before Updating.
7. Download the latest version of the Trust List from Adobe.
8. Click Update Now.Click Update Now.
9. You may repeat these steps for the European Trust List.
10. Click OK
11. Restart Adobe Acrobat/Reader to put the change into effect.

•Now when you verify the UT employee digital certificate used to sign a document, it should show up as valid. This should happen automatically. Adobe will be able to validate signatures from any institution that uses these same Trusts.

Adding a digital certificate to sign an Adobe PDF