think
16px
820px
← all files

Trusting Obscura signatures — self-serve (one file, one click)

Audience: staff (or external recipients) at an organization without centrally
managed devices — everyone installs on their own machine.

Outcome: signed documents from this organization show as trusted in Adobe
Acrobat/Reader on your computer.

Time: about 2 minutes, once. You never have to do it again.

Why you're being asked to do this

Documents from this organization are digitally signed. Your PDF reader can already prove
the document hasn't been altered — but it shows "not trusted" because it doesn't
yet know who issues these signatures.

Installing this organization's certificate once answers that question. It's the digital
equivalent of being shown the company's official stamp so you can recognize it later.

It does not give anyone access to your computer, and it does not let this
organization read your files. It only lets your computer recognize their signature.

Step 1 — Open the trust page

Go to: https://<your-obscura-host>/trust

You'll see the certificate details and a SHA-256 fingerprint — a long string like
C4:5B:24:B9:….

Check the fingerprint (30 seconds, important)

Compare the fingerprint on that page with the one your organization published elsewhere —
their official website, a printed letter, or an email from a person you know. If they
match, it's genuine.

If you cannot confirm the fingerprint, stop and ask your IT contact. Never install
a certificate whose fingerprint you can't verify — this is the one rule that matters.

Step 2 — Download and run the installer for your system

The trust page has three buttons. Pick yours.

The installer is a single self-contained file: the certificate is embedded inside it, it
re-checks the fingerprint before installing, and it installs only for your user
account — so it never asks for an administrator password.

🪟 Windows

  1. Click Download the Windows installer (.ps1).
  2. In your Downloads folder, right-click the file → Run with PowerShell.
    - If Windows blocks it, open PowerShell and run:
    powershell -ExecutionPolicy Bypass -File "$HOME\Downloads\<filename>.ps1"
  3. You should see “Done - the root is now trusted by Windows for your account.”

🍎 macOS

  1. Click Download the macOS installer (.command).
  2. Double-click it in Finder.
    - If macOS says it can't be opened because it's from an unidentified developer:
    right-click → Open → Open.
  3. You should see “Done - the root is now trusted in your login keychain.”

🐧 Linux

  1. Click Download the Linux installer (.sh).
  2. In a terminal:
    bash chmod +x ~/Downloads/<filename>.sh ~/Downloads/<filename>.sh # your user only ~/Downloads/<filename>.sh --system # optional: whole machine (asks for sudo)

If the installer says “FINGERPRINT MISMATCH” it stops without installing anything.
That means the file was corrupted or tampered with — download it again from the trust
page. Don't try to work around it.

Step 3 — Tell Adobe Acrobat to use it

Adobe keeps its own trust list separate from your operating system, so there's one
last switch. Do this once.

Windows (easiest route)

  1. Open Adobe Acrobat or Reader.
  2. Edit → Preferences → Signatures
  3. Under Verification, click More…
  4. Under Windows Integration, tick:
    - ☑ Validating Signatures
    - ☑ Validating Certified Documents (optional, recommended)
  5. OK, then OK.

macOS / Linux (and Windows, if you prefer not to trust the whole OS store)

  1. On the trust page, also download Certificate (.cer / DER).
  2. In Acrobat/Reader: Preferences → Signatures → Identities & Trusted Certificates →
    More…
  3. Select Trusted Certificates in the left panel → Import.
  4. Browse to the .cer file → select it → Import.
  5. Select the newly added certificate → Edit Trust → tick
    ☑ Use this certificate as a trusted root → OK.

Step 4 — Check it worked

  1. Open any signed PDF from this organization (reopen it if it was already open).
  2. Click the signature, or open the Signature Panel (left sidebar).
  3. You should now see “Signature is valid” instead of a warning triangle.

🎉 Done — every future document from this organization will validate automatically.

Troubleshooting

What you see What to do
Still "not trusted" after installing You probably skipped Step 3 — Adobe needs its own switch, the OS install alone isn't enough
"Signature validity is unknown" Same as above; also try closing and reopening Acrobat completely
Windows: script won't run Use the -ExecutionPolicy Bypass command in Step 2
macOS: "cannot be opened" Right-click the file → Open → Open (bypasses Gatekeeper for this file)
"FINGERPRINT MISMATCH" Re-download from the trust page. If it repeats, contact IT — do not install
It worked before, now untrusted again The organization may have regenerated its signing identity. Revisit /trust, check the new fingerprint, and reinstall

Frequently asked

Is this safe? Yes, provided you verified the fingerprint. You're telling your
computer to recognize one specific organization's signatures. It grants no access to
your machine and no ability to read your data.

Do I need admin rights? No. The installers target your user account only.

How do I remove it later?
- Windows: certmgr.msc → Trusted Root Certification Authorities → Certificates →
find the organization → Delete.
- macOS: Keychain Access → login → find the certificate → Delete.
- Linux: certutil -d sql:$HOME/.pki/nssdb -D -n "<name>", or remove the .crt from
/usr/local/share/ca-certificates and run sudo update-ca-certificates.

Does this make the signature legally binding? It makes it technically verifiable
on your machine. Legal weight is separate: in Indonesia, a legally certified signature
must come from a licensed PSrE (such as Peruri), which this organization may use as a
separate signing tier.