What the Adobe Approved Trust List is
The AATL is a program Adobe runs for its own software. As Adobe describes it, Acrobat and Reader periodically download a list of trusted root certificates from an Adobe website, and any digital signature whose certificate chains back to a certificate on that list is trusted. Adobe signs the list with a corporate digital ID linked to the Adobe Root certificate built into its products, and posts it on a website it hosts.
Adobe does not sell certificates. It runs the program, and the certificate authorities on the list sell certificates to organizations and people. Adobe publishes the current members on its help site.
Who gets on the AATL
Certificate authorities apply, and so do governments and companies that issue certificates to their citizens or employees. They submit their root or another qualifying certificate, and Adobe checks their services against the AATL Technical Requirements. Version 2.0, published in 2017, is the latest version Adobe publishes. Its main conditions:
- an audit within the past 24 months, repeated at least every two years, under a recognized scheme: ETSI EN 319 411-1 or 319 411-2, WebTrust for CAs, or ISO 21188;
- signers' private keys on a certified hardware device (FIPS 140-2 Level 2, Common Criteria, or an EU qualified signature creation device), held by the signer, or by a provider on the signer's behalf with at least two-factor activation;
- the signer's identity verified before the certificate is issued;
- a way to revoke certificates, through OCSP or a certificate revocation list.
A provider can also meet the audit condition through cross-certification with the US Federal Bridge or similar bridges, or by holding qualified status on an EU trusted list with keys on a qualified device. Adobe can refuse an applicant or remove a member, for example one that failed to report a security breach.
What the EU trusted lists are
The EU trusted lists come from the eIDAS Regulation. Article 22 requires each Member State to establish, maintain and publish a trusted list of the qualified trust service providers it supervises and the qualified services they provide. Each list is signed or sealed and published in a machine-readable format based on the ETSI TS 119 612 specification.
The European Commission publishes the List of Trusted Lists (LOTL), a signed, machine-readable file built from what each Member State notifies about its list, and a Trusted List Browser for looking up providers. The lists have a constitutive effect: a provider and its service are qualified only if they appear on a list. A Member State may also list non-qualified services, but must mark them as not qualified.
Who gets on an EU trusted list
A trust service provider that wants to offer a qualified service notifies its national supervisory body and attaches a conformity assessment report from a conformity assessment body. The supervisory body checks the provider against eIDAS, grants qualified status and has the trusted list updated. From then on, the provider is audited at least every 24 months.
Qualified status matters beyond Adobe. A qualified electronic signature (QES) needs a qualified certificate from such a provider and a qualified signature creation device. The SES, AES and QES guide explains the levels.
AATL and EU trusted lists compared
| AATL | EU trusted lists | |
|---|---|---|
| Who runs it | Adobe | Each EU Member State. The European Commission publishes the list of lists. |
| Basis | Adobe's own program and technical requirements | Article 22 of the eIDAS Regulation |
| Who is on it | CAs, governments and companies that meet Adobe's requirements | Qualified trust service providers and their qualified services, plus any national entries marked as not qualified |
| How a provider gets on | Applies to Adobe with its certificates, an audit report and a self-assessment | Conformity assessment, then qualified status from the national supervisory body |
| Re-checked | Audit at least every two years | Audit at least every 24 months |
How Acrobat and Reader use the lists
Adobe says Acrobat and Reader ask three things about every signature: whether the signing certificate is still valid, not expired or revoked; whether the document changed since signing, and if so whether the changes were allowed; and whether the certificate chains up to a trusted certificate. The lists feed only the third check. Whether the file changed is answered from the file itself, as the guide on checking a signed PDF for changes shows.
Both lists are managed under Trust Manager in Preferences, which has one section for Adobe's list and one for EU certificates. Each section has a setting to load trusted certificates from an Adobe server periodically and a setting to ask before installing them. When an update is ready, Acrobat may ask: “A new security settings update is available from Adobe Systems. Would you like to install it now?”
To fetch the latest AATL by hand:
- Open Preferences: Edit → Preferences on Windows (Menu → Preferences in newer versions), Acrobat → Preferences on a Mac.
- Choose Trust Manager in the list of categories.
- Click Update Now in the section for automatic Adobe Approved Trust List (AATL) updates.
Labels differ between Acrobat versions. Organizations can turn the downloads off or install updates silently through Acrobat's enterprise settings. On Windows, Acrobat can also trust every root certificate in the Windows Certificate Store for validating signatures. Adobe warns that this option may affect document security.
Why a valid signature from a private CA shows as unknown
A private certificate authority is one that is on neither list: a company's internal CA, a test setup, or a service that issues its own certificates. Acrobat checks its signatures the same way. It can confirm that the signed bytes are intact. It finds no trusted certificate at the top of the chain, so it reports the signer's identity, and with it the signature's validity, as unknown.
That status is not a forgery warning. It means Acrobat has no basis to vouch for the name or email address in the certificate. It changes in one of two ways: the issuer gets its root onto a list, or the reader decides to trust that root. Adobe's Edit Trust dialog has the option “Use this certificate as a trusted root”, which makes Acrobat trust every certificate issued under it. Turn it on only after checking the root's fingerprint with the issuer. The guide to “Signature validity is unknown” walks through it.
What this means for SignClearly
SignClearly runs its own certificate authority, SignClearly Root CA. It is not on the AATL or on any EU trusted list, and SignClearly is not a qualified trust service provider. Every signed PDF from SignClearly carries a platform seal, a digital signature over the final file with a certificate from this CA. Adobe checks the seal and shows whether the file changed, but shows the identity behind it as unknown until you trust the SignClearly root.
The signer's own signature comes from the same CA. Their browser creates a one-time key, and SignClearly's CA issues a certificate for it, valid for 24 hours and for this one signature. The AATL rules expect signing keys on certified hardware, held by the signer or managed by a provider. Signing through a provider already on the list would have meant keeping the signer's key on that provider's servers instead of creating it in the browser. Why we run our own CA explains the trade-off.
All SignClearly certificates lead to one root, so one import per computer covers every SignClearly PDF. Download r1.crt from the verification page, check that its SHA-256 fingerprint matches the published one below, then import it as a trusted root. The verification page has the steps for Acrobat and Reader.
43c834d551231a81d8cfd940eda1fafb6cb59a0738ca96a016c323840e281859Trusting the root changes what Adobe shows on your computer. It does not make the signature qualified, and SignClearly does not provide a QES. Whether a signature is accepted depends on the country and the type of document.