Show All

About digital signatures

When designing a form, you can enable digital signatures so that users filling out your form can digitally sign it. This signature confirms that the form originated from the signer and has not been altered. In addition, the signature can contain a comment from the signer. After being signed, the values in the form cannot be modified without invalidating the signature.

When adding a digital signature, the user must use a digital certificate. Digital certificates, which you can obtain through commercial certification authorities or from your internal security administrator, establish the authenticity of the signature.

In addition to enabling digital signatures so that users can sign your form, you can digitally sign your form template, which authenticates you as the author of the form template in the same way that a digital signature on a form authenticates the user who filled out the form. By doing so, you can enable scenarios that require greater trust for the form. For example, form templates that have been distributed to users in an e-mail message can be updated more efficiently if they have been digitally signed.

Note  Digital signatures in Microsoft Office InfoPath 2003 make use of XML Signatures.

Digital signature options

When designing a form, you can enable digital signatures for the entire form or for specific parts of the form. If you enable digital signatures for part of the form, you must determine which data in the form should be signed. You can additionally associate that data with a section in the form. When users sign the form, the digital signature locks the data so that it cannot be changed, and stores the view with the digital signature.

In addition, you can specify whether to allow multiple digital signatures for a form, and whether those signatures should be co-signed (in which case each signature is independent of the other signatures) or counter-signed (in which case each signature signs the form, as well as the signatures that precede it).

Note  You cannot enable digital signatures for a form that was designed based on an XML Schema that does not have a digital signature namespace.

Digital certificates

When you digitally sign a form, InfoPath uses only those certificates that have a private key and a Digital Signature or Both value for the Key Usage attribute. In addition, the purpose of the certificate must be set as Client Authentication or Code Signing. (If you are using a certificate to digitally sign a form template, the certificate must be set as Code Signing.) These restrictions apply because InfoPath uses XML Signatures to digitally sign forms.

Note  Because a digital certificate you create is not issued by a formal certification authority, forms signed using a certificate you created are referred to as self-signed forms. These certificates are considered unauthenticated and will generate a security warning if the form's security level is set to High or Medium. InfoPath trusts self-signed certificates only on computers that have access to the private key for that certificate. In most cases, this means that InfoPath trusts self-signed certificates only on the computer that created the certificate, unless the private key is shared with other computers.

There are two types of certification authorities, commercial certification authorities and internal certification authorities.

Commercial certification authorities

Internal certification authorities

Note  The information in this topic may not apply if you are working with a form designed using Microsoft Office InfoPath 2003 without the service pack installed. Learn more