Bug 106854 - Unable to digitally sign exported PDF with particular certificate - enable CNG by default
Summary: Unable to digitally sign exported PDF with particular certificate - enable CN...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Printing and PDF export (show other bugs)
Version:
(earliest affected)
5.3.1.2 release
Hardware: All Windows (All)
: medium normal
Assignee: Miklos Vajna
URL:
Whiteboard: target:6.2.0
Keywords:
Depends on:
Blocks:
 
Reported: 2017-03-29 14:41 UTC by Gabor Kelemen (allotropia)
Modified: 2018-07-04 07:13 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments
Error screen on export to PDF. (202.36 KB, image/png)
2017-03-29 14:41 UTC, Gabor Kelemen (allotropia)
Details
Test odt file signed with the same certificate that fails to sign the exported PDF (21.75 KB, application/vnd.oasis.opendocument.text)
2017-03-29 14:41 UTC, Gabor Kelemen (allotropia)
Details
The same odt exported to PDF and signed with the same certificate (75.27 KB, application/pdf)
2017-03-29 14:43 UTC, Gabor Kelemen (allotropia)
Details
LO 5.4 after opening a simple pdf for signing (107.02 KB, image/png)
2017-05-26 06:52 UTC, Gabor Kelemen (allotropia)
Details
selecting a CAcert certificate (24.96 KB, image/png)
2018-02-11 09:52 UTC, plebihan
Details
tab digital signature (22.87 KB, image/png)
2018-02-11 09:54 UTC, plebihan
Details
export failure (16.21 KB, image/png)
2018-02-11 09:55 UTC, plebihan
Details
error message (20.59 KB, image/png)
2018-02-11 09:56 UTC, plebihan
Details
Trying to sign with 6.2master and GOVCA example certificate (314.56 KB, image/png)
2018-06-27 15:53 UTC, Gabor Kelemen (allotropia)
Details
Example signed pdf from 6.2master made on Win7 (65.54 KB, application/pdf)
2018-06-28 08:52 UTC, Gabor Kelemen (allotropia)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Gabor Kelemen (allotropia) 2017-03-29 14:41:05 UTC
Created attachment 132254 [details]
Error screen on export to PDF.

I'm unable to digitally sign a PDF file on export in LO 5.3.1 Win7, while I can do it in LO 5.2.3 on Windows 8.1 and in 5.3.1 on Ubuntu 14.04.

- I try to use File - Export to PDF on a very simple odt file containing only text (which I can sign), 
- select Digital signatures tab, 
- press the Select button to select my certificate
- press the Export button and get the attached screenshot plus a "Generic I/O error" window.
Comment 1 Gabor Kelemen (allotropia) 2017-03-29 14:41:50 UTC
Created attachment 132255 [details]
Test odt file signed with the same certificate that fails to sign the exported PDF
Comment 2 Gabor Kelemen (allotropia) 2017-03-29 14:43:56 UTC
Created attachment 132256 [details]
The same odt exported to PDF and signed with the same certificate

This was made with LO 5.2.3 - I'm unable to reproduce this result with 5.3.1.
Comment 3 Gabor Kelemen (allotropia) 2017-05-26 06:52:32 UTC
Created attachment 133595 [details]
LO 5.4 after opening a simple pdf for signing

I tested it with LO 5.4 beta1 on Windows 7 and now the usual yellow infobar does not appear in Draw, only the PDF opens.
Comment 4 Miklos Vajna 2017-05-26 15:15:57 UTC
I'm afraid you need to be more specific. Here is what I tried:

1) created a test key by running xmlsecurity/qa/create-certs/create-certs.sh and importing the Alice user on Windows 7
2) created a new writer document, exported it to PDF, and on the digital signatures tab I selected the Alice key
3) The export finished without any errors
4) Opening the file in Draw I get the infobar about the signature being valid.

So at least this scenario works fine.
Comment 5 Miklos Vajna 2017-05-26 15:18:20 UTC
Oh, and I tested with 70fe321f3cadfb4c71bd2948d3b0651ab50ff009 (master as of yesterday morning).
Comment 6 Timur 2017-05-26 17:19:37 UTC
(In reply to Gabor Kelemen from comment #0)

> I'm unable to digitally sign a PDF file on export in LO 5.3.1 Win7, while I
> can do it .... in 5.3.1 on Ubuntu 14.04.
Please try with another Win comp. I can sign with Win 7 both 5.3. and master.
Comment 7 Cor Nouws 2017-08-11 13:46:59 UTC
Does work for me in 5.0.4.3 on Windows 10-64 (6.19)
Comment 8 Xisco Faulí 2017-11-22 16:30:28 UTC Comment hidden (obsolete)
Comment 9 Xisco Faulí 2018-01-22 14:59:30 UTC
(In reply to Xisco Faulí from comment #8)
> Hi Gabor,
> Do you still reproduce this issue?

I have set the bug's status to 'NEEDINFO'. Please change it back to 'UNCONFIRMED' if the bug is still present in the master build
Comment 10 plebihan 2018-02-11 09:52:06 UTC Comment hidden (obsolete)
Comment 11 plebihan 2018-02-11 09:53:07 UTC Comment hidden (obsolete)
Comment 12 plebihan 2018-02-11 09:54:20 UTC Comment hidden (obsolete)
Comment 13 plebihan 2018-02-11 09:55:12 UTC Comment hidden (obsolete)
Comment 14 plebihan 2018-02-11 09:56:09 UTC Comment hidden (obsolete)
Comment 15 plebihan 2018-02-11 10:11:49 UTC
The comment on CAcert certificate is a duplicate of bug 113560.
Comment 16 Gabor Kelemen (allotropia) 2018-06-27 15:53:49 UTC
Created attachment 143169 [details]
Trying to sign with 6.2master and GOVCA example certificate

Still happens, but my hunch is that this particular cert I was given contains something funny.

While testing bug #109180 I was able to digitally sign a PDF with the HW key of my eID card, from the very same provider.
Comment 17 Timur 2018-06-28 06:48:15 UTC Comment hidden (obsolete)
Comment 18 Miklos Vajna 2018-06-28 07:42:40 UTC
Please set the platform, Linux/macOS and Windows crypto is set differently. It would be also interesting to know if the Windows case improves if you start soffice as

SVL_CRYPTO_CNG=1 instdir/program/soffice.exe

which opts in for CNG usage. I plan to make that the default in the next few weeks. PDF signing with ECDSA key works for me in that mode.
Comment 19 Gabor Kelemen (allotropia) 2018-06-28 08:52:52 UTC
Created attachment 143181 [details]
Example signed pdf from 6.2master made on Win7

Good news, doing 'set SVL_CRYPTO_CNG=1' in cmd and starting swriter resulted in a successful signing of the attached file during export.

Running swriter from Explorer resulted in the same error message, so the solution seems to be using the CNG backend.
Comment 20 Miklos Vajna 2018-06-28 08:54:41 UTC
OK, let's misuse this bug to enable CNG by default. I'll close this when I flip the default.
Comment 21 Commit Notification 2018-07-04 07:07:39 UTC
Miklos Vajna committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=3c01b8cc4f15df16b4373855b8797d5dcff59327

tdf#106854 svl windows: enable CNG by default

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.