Installation GlobalSign PDF signature

This manual applies to Windows XP (SP2) or higher.

The PDF certificate is delivered in two parts:

The certificate can be downloaded through an email you will receive from GlobalSign. This requires a pick-up password which you will receive from Xolphin.
You will receive postal mail from GlobalSign containing the iKey 400 on which you will save the certificate. For use of this USB token, GlobalSign will include the needed software and drivers.

The installation consists of the following steps:

Adjust your browser settings
Install drivers for the USB token
Initializing the token
Save the certificate on the USB token

Before you Start: System requirements

Software:

Windows XP Professional (SP 2) or higher.
Microsoft Internet Explorer v5.5 SP2 or higher (We advise to use Internet Explorer because it uses the Windows Certificate Store and ActiveX, unlike other browsers).

Hardware requirements for the SafeNet iKey USB Token:

One available USB port for the USB iKey token
a minimum of 128MB RAM

The products of Adobe are often used to sign PDF documents. Listed below are the requirements for Acrobat and Acrobat Reader:

http://www.adobe.com/products/acrobatpro/productinfo/systemreqs/

It is also possible to use other software to sign PDF documents. For software requirements, please refer to the website of the supplier of that software.

Adjusting your Browser Settings

Because of the security settings used by Microsoft in Internet Explorer, you have to ensure all steps are completed before installing your certificate. If you skip a step, an error may occur during the completion of the installation, which means you will have to start the entire process over again. The reason for having to make these adjustments is that ActiveX Object is used for the installation. Using the standard settings, Internet Explorer does not allow Active Object to connect with the GlobalSign websites.

Open Internet Explorer.
Go to Tools → Internet Options → Security Tab.
Click on Trusted Sites and then on the Sites button.
When the Trusted Sites window opens, add:
- https://system.globalsign.com
- https://systemeu.globalsign.com
Adjust the Security Level to Low. Click on Apply to confirm.

Installing Drivers for the USB Token

To use the iKey, you have to install the SafeNet Authentication Client.
Download the software.
Note: During the installation (in the fourth window), select Bsec-compatible to install all necessary drivers.
As soon as the installation is completed, the SafeNet logo will be shown on your taskbar:

Initialize Token

Note: This step must be performed for all iKey tokens before installing the GlobalSign PDF Signing Certificate.

Insert the SafeNet USB token in an available USB port.
Go to the Start menu → Programs → SafeNet → SafeNet Authentication Client. The following window will appear.
Click on the Advanced View gear icon.
Click on the token with your right mouse button, and select Initialize Token...
Select Configure all initialization settings and policies..
The following window appears. Fill in a name for the token. The token name is a friendly name that is used for authentication purposes, it has no influence on the signature. Also set a password for the token. This password will be used to install the certificate, and each time a document is signed. De-select the option for Token password must be changed on first logon. Click on Finish when you're ready.
A notification now says the initialization process will erase the contents of the token. Click on the OK button.
The initialization of the token will now start. This process might take a few moments.
After the completion of the initialization, a message will appear, stating that the token was initialized successfully. Click on the OK button.
Note: If you have installed the PDF Signature, you have to ensure the root and intermediate certificates have been installed on the token as well, as shown here below CA Certificates.

Save Certificate on a USB Token

Go to the Certificate Download Ready email from no_reply@globalsign.com containing the instruction Pickup & Install Your Certificate. Click on the link in the e-mail, or copy/paste it in your internet browser in its entirety.
Enter your Pickup Password. You will have received this by email from Xolphin, directly after finishing your application. Click on Next.
If an Active X control window opens, click on Yes or Allow to continue the installation process. The Cryptographic Service Provider (this takes care of the encryption and certificate management in Windows) will be added as a SafeNet RSA CSP or eToken Base Cryptographic Service Provider. Click on Next.
Click to check the box indicating you accept the GlobalSign Subscriber Agreement. Click on Next.
Accept the Web Access Confirmation.
Log onto the USB token with the passphrase you set during the initialization process of the token (step 6 in the section Initializing Token of this manual). After clicking on Next it might take a while to log in, please do not close your browser.
Click on Install my Certificate.
If an Active X window appears, please click on Yes or Allow.
Click onYes at the Web Access Confirmation Prompt.
Click on Yes to import the Certificate Chain.
Upon completing the process you will be shown the following confirmation: Installation Success, click on OK.
Note: If you have installed the PDF Signature, you will have to make sure the root and intermediate certificates have been installed on the token as well.

All necessary steps to install your web server certificate have now been completed. Keep the USB token at a same location, it is unfortunately not possible to get a free reissue of this certificate. Please remember the passphrase of the token well.

Please do not hesitate to contact us if you encounter problems or error messages, we are happy to help!