1

Our users all have Office 2016 (365 subscription version). We have our own internal MS certificate authority with signing certificates issued to each user.

I have a document in Word with 2 signature fields. One person signs it with their certificate, sends it to another user, and then that user signs it.

For the first user everything goes fine.

But when opening the document for the second signature, or when opening the final document signed by both, the signatures don't appear. I can open the signatures tab, and it sits there saying "Verifying signatures..." for 2-5 minutes. The signatures all show as being valid, and if I click the signature boxes after that the signatures appear.

Google searches reveal some people having these problems for really old versions of word but nothing about 2016.

As far as I can tell, all the certificates are fine. The root and sub CA certificates are installed on the machines and trusted. CRLs and OSCP are accessible and working.

Anyone encountered this before or can think of anything I can try? Or is Office just realy bad at handling digital signatures?

  • 1
    Does a network trace reveal anything? – Jim B Apr 27 '18 at 1:15
  • Actually yes, once I dug in far enough. Seems OSCP wasn't quite working properly. – Grant Apr 27 '18 at 15:38
0

Seems it was certificate revocation checking.

My OCSP responder was working for the root CA, but had an expired OCSP signing certificate for one of the subordinate CAs. It appears this was making it take a long time before giving up on OCSP and just relying on CRLs (which were also working).

It still requires me to actually click on the signature box for the signature to appear, but verifying signatures takes significantly less time now - about 10-30 seconds.

EDIT: I figured out the signatures not displaying as well!

It's a poorly documented issue for older versions of word, but having images that aren't formatted as "in line with text" causes display issues with some pictures. I had formatted them to stay at the bottom of the page. Changing that to in line makes the signatures appear immediately.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.