Ensured comprehensive manual

Congratulations on purchasing your Ensured PDF signature, which allows you to easily provide PDF documents with a trusted digital signature. This is the comprehensive manual, a compact installation guide is also available.

The token is provided by us with the temporary password that was entered during the order, it is important that you know this password before starting the next steps below. The token is a secure cryptographic device that locks itself after entering the password incorrectly several times. Please remember to save your token password!

The token currently only contains the so-called private key, on which the certificate is based at the time of issue. Using the "Initialize" function will block the token for good, so please don't use this function!

The token will soon be the carrier of the certificate, so if multiple people use the same token, only one installation will be needed, and the configured password will have to be shared. It is necessary to install the driver software of the token on every workstation on which the token will be used.

By following the steps below you will soon be able to provide the first PDF with an Ensured digital signature:

1. Driver software installation
2. Change temporary password
3. Download certificate files
4. Installation certificate files on token
5. Configuration Adobe Acrobat
6. Place your first digital signature

Download an easy to print PDF version of this manual including screenshots here.

Driver software installation

To use the Ensured PDF signature, it will have to be installed on the supplied token after it has been issued. For this you will first have to install the necessary driver software. You can download the drivers from the Ensured support page.

Depending on the type of token that is supplied, one of the following applies. Which model has been delivered is stated in the delivery letter.

• Feitian ePass2003 Client software
• Safenet Authentication Client software

If this type of token has aready been used in your organization, it is advisable to check the current software version and update to the latest version if necessary.

Change temporary password

As soon as the installation of the software is completed, you can start the software in order to change the temporary password to your own password. Please note that this password must be remembered, as the token will lock itself if you enter the password incorrectly several times. A password manager is recommended for this.

Change password with SafeNet tokens

Follow the steps below to change the temporary password of a SafeNet token;

1. Launch the SafeNet Authentication Client Tools software.
2. Connect the token to the computer.
3. In the SafeNet Authentication Client Tools application, click the gear (settings) icon at the top
4. Right-click on the 1st item under "tokens", presumably "Ensure e-Sign USB" and select "Change Password ..."
5. Now enter the temporary password at "Current Token Password" and the desired new password in the two lower fields.
6. Click "OK" to set the new password.

Change password with Feitian tokens - Windows

Follow the steps below to change the temporary password of a Feitian token;

1. Start the Feitian Manager application.
2. Connect the USB token to your Windows machine.
3. After a few seconds, press Control + Alt + Delete.
4. Select Change Password from the list of options shown.
5. Click Login Options just above the Cancel button.
6. Click the Smartcard icon next to the key icon.
7. You will now see the token type and fields for old and new pin code.
8. Enter the old (temporary) password in the first field.
9. Enter the new password in the 2nd field and repeat this password in field No. 3.
10. Click the right arrow in the third field to save the new password.

Change password with Feitian tokens - MacOS

Follow the steps below to change the temporary password of a Feitian token;

1. Insert the token into one of your Mac's USB ports
2. Open the 'EnterSafeCastleAdminMgr.app' application from the Applications folder.
3. Click the Change User PIN button at the bottom of the window.
4. Enter the set, temporary password in field 1.
5. Enter the new password in fields 2 and 3.
6. Click OK to save the new password.

Download certificate files

The ordered certificate will only be issued when the sent verification code is sent via the Ensured collection form. For this purpose, a separate email message from ensured.com has been sent to the email address specified during the order. This message contains a unique URL, along with a verification code. As soon as the Verification Code has been entered and the "Get" button is pressed, the certificate will be created and after ten seconds the download will follow in the form of a "certificate.cer" file.

Together with your own certificate, the so-called CA certificates will also have to be installed on the token, you can download these separately here.

Installation certificate files on token

After downloading the new certificate, open the Feitian or Safenet management software, depending on the type of token you received with your order. Follow the steps at 4a for the SafeNet token, or 4b if you have received a Feitian token.

Certificate installation on safenet tokens

1. Open the Safenet Authentication Client Tools application.
2. Select the advanced view by clicking the gear icon.
3. Select your token on the left.
4. Click the import icon.
5. Enter the password to unlock the token.
6. Click the Browse button and select the .cer file downloaded from the Ensured collection form; your pdf certificate.
7. Click import again.
8. Click the Browse button and select the 'EnsuredRootCA.cer' file downloaded from the Ensured website.
9. Click OK to import the certificate.
10. Click import again.
11. Click the Browse button and select the 'EnsuredDocumentSigningCA.cer' file downloaded from the Ensured website.
12. Click OK to import the certificate.

Certificate installation on Feitian tokens

1. Open the ePass Manager application.
2. Enter the password to unlock the token.
3. Click import.
4. Click the Browse button and select the .cer file downloaded from the Ensured collection form; your pdf certificate.
5. Select the * Signature * option at the bottom of this window and click OK to import the certificate. This step is important because otherwise the certificate will not be visible in Acrobat.
6. Click import again.
7. Click the Browse button and select the 'EnsuredRootCA.cer' file downloaded from the Ensured website.
8. Click OK to import the certificate.
9. Click import again.
10. Click the Browse button and select the 'EnsuredDocumentSigningCA.cer' file downloaded from the Ensured website.
11. Click OK to import the certificate.

Now your token is ready to be configured with your PDF application. Please note: The certificate and private key are installed on the token and cannot be exported. It is possible to use the token on multiple machines, but only one at a time. When this step is completed, you can use your certificate!

Adobe Acrobat configuration

The Ensured PDF signature is trusted by default in Adobe Reader by inclusion in the Adobe AATL list. In addition, you can also use Adobe for signing and / or time stamping PDF documents. This guide applies to Adobe Acrobat Pro DC (version 2019.012.20034) and Adobe Acrobat Reader DC (version 2019.012.20034) and later versions. Prior to this configuration, the correct drivers must be installed as described in step 1 of this manual. Leave the token in the machine during the processes below.

Configuration of a PDF signing certificate in Adobe Acrobat

1. Start Adobe Acrobat.
2. Open the Preferences window (Windows: CTRL + K or Mac: ⌘ +,).
3. Select the Signatures category.
4. Click More ... under the Identities & Trusted Certificates category.
5. Click Digital IDs> PKCS # 11 Modules and Tokens.
6. Click Link Module.
7. Enter the path to PKCS # 11 library, this is (if recommended drivers are installed).
8. For Feitian tokens;
   • On the Mac, the path is; /usr/local/lib/libcastle.1.0.0.dylib
   • For Windows, the path is; C: \ Windows \ system32 \ eps2003csp11.dll
9. For Safenet tokens;
   • On the Mac, the path is; /usr/local/lib/libeTPkcs11.dylib
   • For Windows, the path is; C: \ Windows \ system32 \ eToken.dll
10. After entering the path to the driver, click 'Ok' to activate the token.
11. Click the appropriate token under PKCS # 11 Modules and Tokens on the right, click Login, enter the token password and click OK. Note: Sometimes the login field is gray and you can't click on it. Then follow these steps, then you can register:
    1. Open Adobe Acrobat or Adobe Reader.
    2. Click Edit.
    3. Select Preferences.
    4. Make sure you are in the general tab.
    5. Select Security (Enhanced).
    6. Uncheck Enable Protected Mode at startup.
    7. Click OK.
    8. Close the Adobe program.
    9. Open Adobe Acrobat or Adobe Reader again.
12. Now click on Digital IDs.
13. Now select the certificate with the Storage mechanism: PKCS #11 Cryptographic Token.
14. Now click on Usage Options (pencil).
15. Now select Use for signing (or in Acrobat Pro Use for Certifying).
16. A pen or rosette will now appear in front of the name of the selected certificate.
17. Click Close and OK in the underlying dialog.
18. Adobe Acrobat is now configured to generate signatures with the certificate installed on the token.

Configuring a Timestamp Server in Adobe Acrobat

By adding a timestamp to a PDF document in addition to a digital signature, your signature remains verifiable even if your PDF certificate is no longer valid.

1. Start Adobe Acrobat.
2. Open the Preferences window (⌘ +,).
3. Select the Signatures category.
4. Click More ... under the Document Timestamp category.
5. Click New.
6. Enter a name (e.g. Timestamp server) and the server URL (for Ensured: http://timestamping.ensuredca.com)
7. Click OK.
8. Select the added Timestamp Server and click Set Default.
9. Click Close and OK in the underlying dialog.

Adobe Acrobat is now configured to also generate a timestamp during signature.

Placing your first digital signature

Using a PDF signing certificate in Adobe Acrobat

1. Launch Adobe Acrobat and open a PDF document.
2. From the menu, click Edit and then Manage Tools.
3. Click Certificates.
4. An extra bar will now appear at the top, click here on Digital signing (or in Acrobat Pro on Certify).
5. Draw the requested Signature box anywhere in the document.
6. Select the certificate with the correct name and with the name (PKCS # 11 device) after the name and click Continue.
7. Now adjust the appearance of the signature if necessary, enter the token password and click Sign. Note: It is also possible to save multiple templates for signature appearances.
8. Save the PDF document.

The PDF document is now signed. If a Timestamp Server is configured as 'Default', this Timestamp Server will automatically be used to generate a timestamp for the PDF document. This timestamp is included in the signature.

Using a Timestamp Server in Adobe Acrobat

1. Setting a seperate timestamp is only necessary when the Timestamp server is not set as default (see point 5b)
2. Launch Adobe Acrobat and open a PDF document.
3. From the menu, click Edit and then Manage Tools.
4. Click Certificates.
5. An extra bar will now appear at the top, click here on Timestamp (or if the Timestamp Server is set as 'Default', click on Digitally Sign).
6. Save the PDF document.