AWS Plug-In Overview

E-Lock Technologies

Assured WebSigner (AWS) Plug-In Overview

The AWS Plug-In is the client side component that works with the browser on the user's Desktop and allows the user to sign the web page and handles archiving of signed web pages for the user. The Assured WebSigner Plug-In is browser independent. It also helps in verification of signed receipts sent by the Assured WebSigner (AWS )Server.


Signing a Web Form/Page

You can sign a web form or a page only if it has been sign enabled using the Assured WebSigner Server on the Web Site. The current version of Assured WebSigner allows you to sign HTML web pages/forms as well as PDF forms sign-enabled using the AWS server.


Digitally signing a HTML web page/form

E-Lock Technologies

Digitally signing a HTML Web Form/Page

To digitally sign a HTML form/page, follow the steps given below:

  • Open your browser window and type the URL to access the sign enabled form/page. If you are using the Plug-In for the first time to access a sign enabled form/page, you will be prompted to select a folder for archiving digitally signed pages/forms to your local machine. You can enter the name of the new folder if you want to create one and click Yes. AWS will create this folder for you.

    If you create a new folder, AWS will prompt a confirmation message of the same.

    Click No if you do not want to archive digitally signed web pages on your local machine.

    Refer to the ArchivingDigitally signed web forms/pages Information and receipts section for more information.

  • Fill in the details of the form and click the Submit button. If it is a web page you need to just click on the Sign button.

  • This will start the Signing/Encryption Wizard. Follow the wizard to complete the signing operation.

    Refer to the section on the Signing/Encryption Wizard for further details.

When sign enabling a web page, an organization can enforce certain parameters for the signing operation. This is termed as a client side Signing Policy. If a client side Signing Policy is present, Assured WebSigner Plug-In will first check the validity of the Policy Signer's Certificate before initiating the signing process.

  • On successful signing of the form, a receipt, signed by the server, is displayed. This receipt will confirm that the server received the signed data and verification of your signature was successful. It will also display the number of times the form has been signed. A Form Submission ID is displayed.

    This page provides the following options:

    • Verify Receipt
       Click this button to verify the certificate with which the receipt was signed. The verification result will be displayed.

      Refer to the section on Verification for further details.

    • Save
       Click this button to save the receipt along with the form data. This is the archived data, which is saved in the folder first time you access the sign enabled page using the AWS Plug-In. Once you save the receipt, the View Archived Receipt button will be displayed. If you do not save the receipt you can choose to retrieve the receipt from the Archived information.

    The display of the receipt will depend on the web application logic.


Digitally signing a PDF form

E-Lock Technologies

Signing a web based PDF Document

To sign a web based PDF document, follow the steps given below:

  • Open your browser window and type the URL to access the sign enabled document. If you are using the Plug-In for the first time to access a sign enabled document, you will be prompted to create a new folder for archiving signed pages/forms. You can enter the name of the new folder if you want to create one and click Yes. AWS will create this folder for you.

    If you create a new folder, AWS will prompt a confirmation message of the same.

    Click No if you do not want to archive digitally signed web pages on your local machine.

    Refer to the ArchivingDigitally signed web forms/pages Information and receipts section for more information.

  • Fill in the details of the form and click the E-Lock Sign icon on the toolbar.

  • This will start the Signing/Encryption Wizard. Follow the wizard to complete the signing operation.

    Refer to the section on the Signing/Encryption Wizard for further details.

When sign enabling a web page, an organization can enforce certain parameters for the signing operation. This is termed as a client side Signing Policy. If a client side Signing Policy is present, Assured WebSigner Plug-In will first check the validity of the Policy Signer's Certificate before initiating the signing process.

  • On successful signing of the form, a confirmation message will be displayed for the same.

  • Click the OK button on this message box to view the receipt, signed by the server.

The display of the receipt will depend on the web application logic.


Signing/Encryption Wizard

The Signing/Encryption wizard guides you through the signing operation.

During the signing operation Signing Certificate Selection dialog box is displayed, followed by the Signing Ceremony dialog box. You can enable the display of the Select Profile dialog box for selection of a signing Profile and the Signing Preferences dialog box for selection of signing settings by changing the settings in the Configuration Manager.


Selecting a Profile

A Profile is a named collection of settings for your signing/encryption preferences. Commonly used settings can be saved as Profiles. They are an ease-of-use feature for the end user to automate the signing/encryption operation.

By default, the Select Profile dialog box is not displayed. To display this dialog box, select the appropriate settings in the Configuration Manager.

Refer to the section on Configuration Manager for further details.

  • Select Profile
    This list box displays a list of all user Profiles valid for the signing operation.

  • Profile Description
    This box displays the Profile description of the selected Profile.

  • Create Profiles...
    Click this button to create a new Profile using the E-Lock Profile Manager.

    Refer to the Profiles for details on creating Profiles.

  • Don't Use Profiles
    Click this button to proceed with the signing operation without selecting a Profile.

  • Next
    Click this button to continue with the current operation after selecting a Profile.

  • Cancel
    Click this button to cancel the current operation.

  • Don't show me this dialog box again
    Select this check box if you do not want the Select Profile dialog box to be displayed for the subsequent operations.

You can re-enable the display of the Select Profile dialog box by selecting the appropriate setting in the Configuration Manager.


Signing Certificate Selection

You can choose the certificate that you want to use to sign the web form/page within the Signing Certificate Selection dialog box of the Signing/Encryption wizard. If only one certificate is present on your machine this dialog box will not be displayed and the certificate will be used by default. This dialog box displays the following options:

  • Select Digital ID you wish to use
    This list box will display a list of all available certificates (digital IDs). Select the certificate you want to sign with.

  • View Digital ID
    This will display the details of the certificate you choose.

  • Next
    Click this to move to the next dialog box of the Signing/Encryption Wizard.

  • Cancel
    This will cancel the current operation.

After selecting the digital certificate to use, if the certificate is password protected, you will be prompted to enter the certificate password. If you have installed Assured WebSigner Plug-in for Netscape, you will be prompted to enter the Communicator Database password. If you have installed Assured WebSigner Plug-in for Entrust this dialog box is not displayed.

In case of smart card certificates, you are prompted to enter the smart card certificate access code.


Signing Preferences

You can select your signing preferences in the Signing Preferences dialog box of the Signing/Encryption wizard.

By default the Signing Preferences dialog box is not displayed. To display it select the appropriate settings the Configuration Manager.

Refer to the section on Configuration Manager for further details

Following are the settings you can select:

  • Hash Algorithm
    Select the Hash Algorithm with which to sign the document.

  • Include Time Stamp
    Select this check box to attach the time stamp within the signature block.

  • Signature Image
    • Include
      Select this check box if you want to attach a signature image to the signature block.
      Selecting this option will enable the following options:

      • From File
        Select this option if you have a stored .esg file. Enter the path of the file in the text box provided or click the Browse... button to select the file.

      • Live Signature
        Select this option if you want to create a graphical image of your handwritten signature. Click the Create... button. This will start the e-Mark application, where you can create the image using either a mouse or a Wintab compliant digital tablet.

        Refer to the e-Mark application help for further details

If you have selected a Profile during the signing operation, the settings within the Profile are selected as default. These settings can be changed if required.

If a Signing Policy has been defined by the server, the settings defined within that Policy are selected as default and cannot be modified.

If a Signing Policy is attached to the document, its settings take precedence over settings within a selected Profile.


Signing Ceremony

The Signing Ceremony displays a declaration to the effect that the signer has read and understood the contents of the form he is about to sign. The generic text of the declaration states:

" I hereby declare that I have viewed and understood the contents of the form "form URL" with Form Submission ID ."

The generic declaration text can be replaced by attaching a Policy to the document.

The declaration may have legal significance. It is therefore advisable to read and understand the implications of this declaration text.

  • Signature Comment
    You can enter any additional comments about the signature in this text box. This will not form a part of the form but will be attached to the Signature Block.

  • Signature Block
    This is a part of the digital signature and is attached to the signed form.

  • Reason to Sign
    You can enter a short reason for signing in this text box. The drop down list will display the recently entered reasons to sign.
    If the User side Policy defined within the AWS Profile used to sign-enable the form has a predefined list of reasons for signing, this list box will display only the specified reasons.

  • Location
    You can enter the physical/geographical location from where you are signing.


Enable or disable Archive

The Assured WebSigner Plug-In allows you enable or disable the archive option for digitally signed web pages/forms. To change the status of the archive, select the Start->Programs->Assured WebSigner->Plug-In->Allow or Disallow Archive option.

Select the Allow or Disallow option to change the status of the archive option and click the Confirm button.

You can archive information only if you have the permissions to do so. The archived data will include only those transactions that were saved by clicking the Save Receipt button when the signed receipt was displayed in your browser on successful submission of signed data

If you choose to disallow client side archive, when you sign a particular web page you will not be able to save the receipt on the local machine.

If the web site that you are accessing has specifically disallowed any archiving at the user end, you will not be able to change the status of the archive.


Archiving Digitally Signed web forms/pages and receipts

The Assured WebSigner Plug-in allows you to maintain an archive of information that was signed and the server receipts returned on successful submission of signed data. This information is stored in the folder that you created the first time you used the Plug-in to sign a form/page.

You can archive information only if you have the permissions to do so. The archived data will include only those transactions that were saved by clicking the Save Receipt button when the signed receipt was displayed in your browser on successful submission of signed data

To view this archived information click the Start->Programs->Assured WebSigner->Plug-in->Archived Pages option. This will display a list of the URLs of all the archived pages.


Viewing Archived Information

E-Lock Technologies

Archived Information Details

When you click the URL to view detailed information of the archived pages, details segregated on the Form Submission IDs will be displayed.

The page displayed will show the following details:

  • Signature Number
    Assured WebSigner provides multiple signature support. This field will display the signature number and the details that follow will be specific to this signature. Click the link to view the form data that was signed and submitted.

  • Date and time of signing
    The details of the date and time of signing will be displayed in this field.

  • Receipt Status
    On successful submission of the signed form the server generates a signed receipt, which is returned to the user. At this time you have the option to verify the receipt. If this verification was successful, this field will give you the option to view the archived receipt. Follow the link to view the signed form data and the server receipt. If for some reason, verification of the receipt was not successful or unknown, this field will display a message accordingly.

Do not click the Submit button on the signed form data that is displayed. Doing so will initiate the Signing/Encryption Wizard for signing of data a second time.

When the archived receipt is displayed you can verify the signatures within the form by clicking the Verify Signature button displayed. Clicking this button will display the Verification Result dialog box. This dialog box will display verification details of the signer's certificate.

You can view the server receipt by clicking the image displayed. This will display the receipt. You can verify the receipt by clicking the Verify Receipt button. This will display the Verification Result dialog box. The dialog box will display verification details of the certificate used by the Server to sign the receipt.

Refer to the section on Verification for further details.

It is important to understand that clicking the Verify Signature button will display Verification Result of the form signer's certificate, while clicking the Verify Receipt button will display the Verification Result of the certificate used by the server to sign the receipt.


Verifying Signatures

You have the option to verify the server receipt when it is returned to the user after successful verification of the your signature. You can also verify the signatures on the form submitted and the receipt returned for that transaction when you choose to view the archived information.


Verifying User's Signatures

To verify the signatures on the sign-enable web form/page, click the Verify Signature button. This will display the Verification Result dialog box. This dialog box will display the Verification Result of the Signer's certificate.


Verifying Server Receipt

To verify the certificate used by the Server to sign the receipt, click the Verify Receipt button. In case of PDF receipts, click the E-Lock Verify icon to verify the server receipt. This will display the Verification Result dialog box. This dialog box will display the verification details of the certificate used by the Server to sign the receipt send to the user after successful submission of signed data.

Refer to the section on Verification for further details.


Verification

When you choose to verify either the signatures on the form/page or verify the server receipt, the verification result dialog box is displayed. This dialog box displays the following options:

  • Signature details
    This list box displays the list of the verified signatures. The columns in the list are:

    • Signer
      The name of the person to whom the signing certificate belongs. On successful verification, a green check mark is displayed against it. If verification fails, a red cross is displayed. A blue cross is displayed if the status of any of the verification parameters is unknown.

    • Reason
      The reason for signing the web form/page. This displays the Reason to sign as entered by the user during the Signing Ceremony.

    • Signing Time
      The time at which the web form/page was signed. This is displayed only if the signer selected the Include Time Stamp into signature check box in the Signing Preferences dialog box.

    • Location
      The location at which the web form/page was signed. This is displayed only if the signer entered this information in the Location option during the Signing Ceremony.

  • Signature Comment
    This displays any comments the signer has added in the Comments text box during the Signing Ceremony.

  • Signature Block
    This displays a complete block of the signing information, which includes the signers name, the time, and place of signing. It also displays a graphical image of the signer's handwritten signature if this option was selected in the Signing Preferences dialog box.

The details displayed in the Signing Comments and the Signature Block depends on the selected Signer in the Signature details list box.

  • Verification Details...
    Click this button to view the verification details for the signer certificate selected in the Signature details list box.

  • Validate Certificate...
    Click this button to validate the selected certificate.

  • Validate All Certificates...
    Click this button to validate all the listed certificates.

  • Close
    This will exit the Verification Results dialog box.


Individual Verification Details

The Individual Verification Details dialog box displays the verification details of the signer certificate that was selected from the list box in the Verification Result dialog box.

Verification details are displayed in two parts - Verification of the data and Verification of the certificate.

The Individual Verification Details dialog box displays the following details:

  • Signature Verification Result
    This section displays details of

    • Content Verification
      If the verification of the contents of the document/file is successful, then it shows a green check mark against this option. If verification fails, i.e. data was altered after the document/file was signed, then it will show a red cross against this option.

      • Hash Algorithm
        This displays the hash algorithm used while signing the data.

    • Signer Certificate Expiry
      If the signer certificate has not expired then a green check is shown. If the certificate has expired, a red cross is displayed.

    • Signer Certificate Trust
      The verification process involves establishing a trust of the certificate chain beginning from the signer certificate right till the root certificate. If the trust is established, a green check is displayed. If the trust cannot be established, a red cross is displayed. In case where trust cannot be established for an intermediate certificate in the chain, a blue question mark is displayed.

    • Certificate Validation Result
      This shows the validation results of signers' certificate. The AWS Server looks for the location of the CRL within the certificate, and caches it to the CRL from this location to your local machine. The certificate is validated against this CRL. For all subsequent validations, the certificate is validated against this cached CRL unless it has expired.

      In case the CRL has expired, the entire process of locating the CRL and retrieving a fresh CRL is repeated. If the location of the CRL is not found or an expired CRL cannot be updated, a blue question mark is displayed. Clicking the Validate Online... button will perform an online validation. A green check is displayed if certificate is valid and a red cross if the certificate is present in the CRL.

      If the signer certificate includes information for the validation authority in the Authority Information Access field, the AWS Server will try to connect to this validation authority using the OCSP mechanism and attempt and online validation of the certificate.

      If a Policy is present defining Validation Mechanism, the mechanism within the Policy will take precedence.

    • Certificate Validation Information
      The Certificate Validation Information displays textual information about the validation if certificate validation is performed. This includes the mechanism, which was used to perform the validation and the URL path of the server where the validation was performed. Clicking the Response Details button will display the validation response details.

    • Signer Certificate
      This gives you the following options:

      • View
        Click this button to view the details of the signer certificate.

      • Policy...
        Click this button to view the certificate Policy attached to the signer certificate.

      • Save to File...
        Click this button to save the certificate of the signer on the system. You can use this saved certificate to encrypt files for the sender in future.

    • Close
      Exits the Verification Details dialog box.


Online Response Details

The following details are displayed:

  • Validation Result
    This displays the common name of the authority that signs the response.

  • Responder ID
    This displays the common name of the authority that signs the response.

  • Response Signing Time
    This displays the time at which the response was signed. This is true only in case the validation mechanism used was OCSP. This field is blank if validation mechanism was CRL.

  • Valid From
    All responses have a validity period. This displays the period from when the validation response is valid.

  • Valid To
    This displays the period to when the validation response is valid.

  • Revocation Time
    If the certificate being validated has been revoked the time of revocation is displayed here.

  • Revocation Reason
    This displays the reason for revocation of the certificate.

  • Save to file
    Click this button to save the Validation response details. The file will be saved with a .OCSP or a .CRL extension depending on the validation mechanism used. If the file is saved with a OCSP it will contain the DER encoding of the OCSP ResponseBytes.


Profiles

A Profile is a named collection of settings for signing preferences. Commonly used setting can be saved as Profiles. Profiles are user defined and are just an ease-of-use feature for the end user.


E-Lock Profile Manager - Assured WebSigner Plug-in

E-Lock Technologies

E-Lock Profile Manager

To start the E-Lock Profile Manager, click the Start->Programs->E-Lock Assured WebSigner->Plug-in->E-Lock Profile Manager option. This will start the E-Lock Profile Manager.

The Profile Manager displays the list of the existing Signing Profiles on the system. If the user selects a particular signing profile, the textual description attached to it will be displayed in the Profile Description box.

  • New Profile
    You can create a new Signing Profile by clicking on this button.

  • Edit Profile
    If you need to change the settings of a particular Signing Profile, select it from the list and click this button.

  • Delete Profile
    If a particular Signing Profile is not required, you can remove it by selecting it from the list and clicking on this button.


Creating Profiles

New Profiles can be created for signing. Profiles that are created have to be signed by the person creating them. It is also possible to insert Policies into the Profiles.

The user can select the default settings to be used for a Signing operation.

The following settings can be specified:

  • Crypto provider
    Select this check box to choose a crypto provider from the drop down list box.

  • Hash algorithm
    Select this check box to select a hash algorithm from the drop down list.

  • Signature image
    Select this check box to enforce the signature image settings. You have the following options:

    • Don't Use
      Select this option to disallow the user from inserting a graphic image of their handwritten signature in the Signature Block while signing.

    • Use from file (*.esg)
      Select this option to allow users to select stored .esg file for inserting into the Signature Block during the signing operation. A .esg file is a graphical image of the handwritten signature created using the e-Mark application.

    • Use live
      Select this option to force users to create and insert live graphic image of their handwritten signatures in the Signature Block during the signing operation, using the e-Mark application.

  • Time Stamp
    Select to enforce the time stamp settings in the Signature Block during the signing operation. You have two options:

    • Include
      Select this option to include the time stamp while signing.

    • Don't Include
      Select this option to disallow the user from including the time stamp while signing.

  • Pre-Text
    Select this option to enter text to be displayed before the document information in the Declaration pane of the Signing Ceremony. This text can be a legal statement the organization wants to display before the user signs the document.

  • Post-Text
    Select this option to enter text to be displayed after the document information in the Declaration pane of the Signing Ceremony. This text can be a legal statement the organization wants to display before the user signs the document.

  • Reasons to sign
    Select this option to specify a reason for signing a particular form. There are predefined reasons in the drop down list. You can select any one of these or you can include one of your own. Selecting this option enables two options:

    • Add
      Click this button to add the reason in the box alongside. You can select multiple reasons using the Ctrl key.

    • Remove
      Click this button to remove a previously included added reason by selecting it from the box alongside. You can select multiple reasons to remove using the Ctrl key.

  • Enforce these settings for a user
    Select the certificate from Select User pane to be used to sign the form you are submitting. The Certificate Details pane will display a textual description of the certificates selected.

  • Clear
    This button allows you to clear all the selections made.

  • Insert Policy...
    This button allows you to select a Policy to insert into the Profile that you are creating.

    Once you insert a Policy within a Profile, the Change Policy... button will be displayed. Click this button to change the Policy attached to the Profile.

  • Create
    Click this button once you have selected the settings for the Profile. This will take you to the Create dialog box where you can name and add a description for the Profile that you are creating. Clicking OK will complete the process.

    All Profiles that are created have to be signed by the person who creates them.

  • Cancel
    Click this button to return to the first screen of the Profile Manager.


Naming the Server Signing Profile

Once you have created a Profile this dialog box is displayed. Here you can enter a name and description for the Profile being created. This dialog box will be shown when the user clicks on the Create button on the Policy/ Profile dialog screen.

The dialog box displayed has the following buttons:

  • Name
    Enter the name to be given to the Profile being created.

  • Description
    Enter a short description for the Profile being created. This will be shown whenever the user selects the Profile through a Profile Enumerator dialog box. The purpose of this is to enable the user to easily identify this Profile.

  • OK
    Click this button to display the Select Digital ID to Sign Profile dialog box.

  • Cancel
    Click this button to exit the Server Signing Profile creation process.


Signing a Profile

All Profiles that are created have to be signed by the person who creates them.

When you click the OK button in the Create dialog box, the Select Digital ID to sign Profile... dialog box will be displayed. From the Select digital ID list box, select the digital ID (certificate) with which you want to sign the Server Signing Profile. The Certificate details box will display the details of the Digital ID that you choose.

The certificate that you choose here is used to sign the Profile that is created. This should not be confused with the certificate that you chose in the settings within the Profiles to sign or encrypt a document.


Uninstalling the Assured WebSigner Plug-in

To uninstall the Assured WebSigner Plug-in click the Start->Programs->Assured WebSigner->Plug-in->Uninstall option. This will start the uninstallation process. The uninstall will ask you if you want to remove cached folder. Select Yes if you want to delete the folder you had created for storing non-repudiation information. You will then be asked if you want to remove a shared file. Click the Yes to All button. This will remove all shared components from your machine. This completes your uninstallation process.