FAQ By Certificate Lifecycle (Use)
You create the certificate in a browser on your computer when you retrieved it. It can only be used on that computer (in that browser) unless you export it to another computer (or browser). If you have retrieved your certificate on one computer and would like to use it on another computer (or browser) as well, you will need to export the certificate and then import it to the other computer or browser.
Visit our How Do I library to learn more about how to import and export your certificate.
Your digital signature can be imported to Office 365 easily, following these instructions:
For Office 365 subscriber, and on build 16.19.18110915 and higher,
If you don't see the Sign / Encrypt Message button, you might not have a digital ID configured to digitally sign messages and you need to do the following to install a digital signature.
- On the File menu, click Options > Trust Center.
- Under Microsoft Outlook Trust Center, click Trust Center Settings > Email Security
- Click Import/Export to import a digital ID from a file on your computer,
- If you have both a signing and an encryption certificate you will import both.
A digital signature on an e-mail message helps the recipient verify that you are the authentic sender and not an impostor. To use digital signatures, both the sender and recipient must have a mail application that supports the S/MIME standard. Outlook supports the S/MIME standard.
If you are an Office 365 subscriber, and on build 16.19.18110402 and higher,
In an email message, choose Options, select both the Sign and Encrypt buttons. Pick the encryption option that has the restrictions you'd like to enforce, such as Do Not Forward or Encrypt-Only.
Note: Office 365 Message Encryption is part of the O365 E3 license. Additionally, the Encrypt-Only feature (the option under the Encrypt button) is only enabled for subscribers (Office ProPlus users) that also use Exchange Online.
If your certificate is stored on a Smart Card or Token, install the software you received with your hardware on the new computer, reboot your machine, and insert the Smart Card or Token. Your certificate is now ready for use on the new machine.
If your certificate is stored in your browser, then depending on the browser that you use, the process of importing and exporting your certificate may vary. Please see our How Do I section to view the instructions that apply to your situation.
If you no longer have access to your digital certificate, please visit our Certificate Management Center, where you can request a replacement for your certificate. If you need further instructions for replacement, see our How Do I library, where you can find additional information.
IdenTrust as a Certificate Authority issues Digital Certificates to digitally sign electronic documents. eNotary individuals can customize the appearance of the Digital Signature with their own Electronic Seal and /or facsimile of a wet signature, while keeping data integrity and non-repudiation of the signed document.
Please use our helpful “How do I” pages to learn more:
Customize the appearance of a Digital Signature in Adobe®
Use Digital Certificate to Sign & Seal Documents
IdenTrust does not assist with the creation of the Electronic Seal but there are multiple companies online who provide this type service of service; here are some samples:
https://www.adobe.com/devnet-docs/acrobatetk/tools/DigSigDC/appearances.html
https://www.designfreelogoonline.com/logoshop/free-logo-maker-notary-logo-templates/
If you have an IGC or TrustID certificate that you cannot use, you may need to replace the certificate. Visit our How Do I library for instructions to replace your certificate.
If you cannot access your account with us because you have forgotten your IdenTrust Account passphrase, you can reset your password thru the Certificate Management Center. You do not need to replace the certificate in this case.
If you have a DOD ECA s-Certificate or t-Certificate, a key recovery will need to be done. These certificates cannot be replaced. Visit our How Do I library for instructions to request a Key Recovery.
If no longer in possession of the USB token or Smart card housing your digital certificate, the certificate is deemed 'compromised' and must be revoked. To Revoke a Certificate/Account where the digital certificate is no longer accessible, a request must be submitted officially via one of two ways:
- Signed email from an Organization Officer/Representative.
- An organization’s representative (i.e., personnel office representative) can request revocation directly via a signed e-mail and a call to the Support, or mail to Registration on company letterhead containing a notarized signature.
- The communication should include the information about the Subscriber’s certificate to be revoked, including Subscriber name, email, and if possible the account number and/or application ID number, both available in email previously sent to the Subscriber.
- If the revocation is being requested for reason of key compromise or suspected fraudulent use of the private key, or if the smart card or USB token could not be collected and zeroed out, then the revocation request must indicate key compromise.
- Company Letterhead
- Signed and notarized on the company letterhead, please provide the following:
- Account number of certificate holder to Revoke (if available)
- Certificate holder name
- Certificate holder Email Address
- Reason for Revocation
- Sign the request and have this request signed/notarized by any licensed Notary Public.
- Mail completed letter to:
- ECA Registration IdenTrust Services
- 5225 Wiley Post Way, Suite 450
- Salt Lake City, Utah 84116
- Signed and notarized on the company letterhead, please provide the following:
For reasons of security and non-repudiation, no person or equipment has access to your unencrypted account password, so there is no mechanism for IdenTrust to look up your account password if you forget it. However, you do have the option to reset you account password through our Certificate Management Center. You will need to have your IdenTrust account number in order to complete these instructions. Your account number was provided to you when you were approved for your certificate.
1. Access the Certificate Management Center (CMC).
2. Click LOGIN to launch the CMC session.
3. When presented with the Choose a digital certificate dialog screen, click Cancel. This will allow you proceed by using your account information.
4. On the Certificate Management Center Login screen, enter your account number, and then choose the I forgot my password link.
5. You will receive a confirmation screen, indicating that the password assistance instructions have been sent to you email address.
6. Follow the instructions provided in the email to allow you to reset your account password. Please note that if you cannot remember the answers to your secret questions, you will need to apply for a new certificate.
IdenTrust never has access to your CryptoAPI Private Key (certificate) password, so we are unable to help you retrieve it if it is lost or forgotten. If you forget this password, you will not be able to use your current certificate and will need to replace it. This process will take approximately 3-5 business days, and will be done without charge to you.
For more information about replacing a certificate, please see our How Do I library for instructions to replace your certificate.
The Master Password or certificate password is the password that protects your certificate. IdenTrust never has access to your master/certificate password, so we are unable to help you retrieve this password if it is lost or forgotten. If you forget this password, you will not be able to use your current certificate (if it is password protected) and will need to replace your certificate. This process will take approximately 3-5 business days, and will be done without charge to you.
For more information about replacing a certificate, please see our How Do I library.
If you forget the password to access your USB token, you will not be able to use your certificate until you re-initialize the token and do a key recovery. If your organization has a Certificate Coordinator, Trusted Internal Agent, or Local Registration Agent registered with IdenTrust, you can contact that person to initiate a key recovery. Otherwise, please contact the IdenTrust Support team at 1 (888) 248-4447 for assistance.
Your request will then be processed by our Registration team. Once the request has been approved, you will be sent a letter (via US mail) with new retrieval information. You may then retrieve the new certificate by following the same process you used when initially retrieving it. You can check the status of your key recovery application by visiting our Certificate Management Center.
If you have a Smart card or USB token for an ECA certificate, you will need to initiate an ECA Program Key recovery.
This is the certificate password that you create during the retrieval process to protect your certificate, and will be used each time you use or export your certificate. The CryptoAPI Private Key password is stored in the browser within your computer and IdenTrust never has access to it. It allows you to encrypt and decrypt data and to authenticate transactions using your digital certificate.
We recommend that your certificate password be at least 6 characters in length and it may be as long as 30 characters. It can consist of letters, numbers, and special characters. The certificate password is case-sensitive (UPPER CASE and lower case letters are not the same thing). To protect your certificate, we recommend that you do not check the Remember password box.
There are multiple passwords associated with your account and hardware. Please note IdenTrust does not have access to view, confirm or reset your passwords.
Account Password
This password is created during the online application. You do have the ability to update your password if you can correctly answer the three security questions you chose when you applied for your certificate. Every account has an account password, but your account can be associated with multiple certificates.
USB Token and Smart Card Password
This password is created when you initially setup your token. Before the retrieval of your certificate, you are prompted by the token software to create password that will protect your token. This password can only be changed if you know the current passcode. Both the USB and the OTP tokens have a token passcode.
You may review the IdenTrust Commercial Root CA 1 and IdenTrust Public Sector Root CA 1 test certificates, including 'Valid', 'Revoked', and Expired' examples here:
This message showing as warning upon opening digitally signed PDF documents usually means that the policy asserted in at least one of the digital certificates present in the PDF, is not in Adobe’s Approved Trusted List, referred as AATL Enabled certificate.
This message DOES NOT mean that the certificate is invalid, unless it is truly expired, suspended or revoked. The real status of the certificate is confirmed by double-clicking on each digital signature present in the opened PDF document.
A temporary way to resolve this issue is to ‘trust’ the certificate in the device used to open the PDF document. See “Trust Manager” in the ‘Preferences“ section of Adobe Acrobat or Adobe Reader. This temporary solution has to be repeated once on each device where a signed PDF is opened.
A permanent way to avoid that warning message is purchasing an IdenTrust AATL Enabled Digital Certificate
AATL Enabled certificates are issued directly on Smart Cards or USB tokens compliant with FIPS 140-2 L2+ standard like HID Global USB tokens or HID Global Smart Cards. This requirement facilitates two-factor authentication (2FA) and also provides additional security, as the certificate private key cannot be exported from the hardware device, thereby eliminating the potential of key compromise by bad actors.
If the certificate used to sign the PDF document is AATL enabled and the “invalid signature” message is present, the AATL list in that device has to be updated: Adobe Reader/Adobe Acrobat: Preferences, Trust Manager, click on [Update Now] in the “Automatic Adobe Approved Trusted List (AATL) section.“