Problem renewing digital signature

[alpujarran]

I've been trying to renew my DS as it runs out in about 6 weeks.

Via https://www.cert.fnmt.es I get as far as the sign and send page, then a pop-up appears saying ...

The site 'apuc.cert.fnmt.es' has requested that you sign the
following text message:
DATOS IDENTIFICATIVOS: NOMBRE ............

To confirm you agree to sign this text message using your selected
certificate, please confirm by entering the master password.

Anyone knows what this "master password" is ?? It doesn't seem to be the password for the DS. I've even deleted the DS from Firefox and reloaded it - it asks for the DS password to do this so I'm sure that I know what the password is.

Tried it on both Windoze XP and MacOSX 10.5 with the same results.

[Enrique]

Hi,
Have you tried the Password you used when you set up the Digital Signature

[El Cid]

Hi,
Have you tried the Password you used when you set up the Digital Signature

I don't remember having to put in a password - it may have been optional.

Sid

[alpujarran]

The original DS was done for me at a local office [Ujigar] and the official wrote it onto a CD for me and told me the password he'd assigned. I used this CD because I think it's possible to backup one from Firefox and change it. The Cd is write only so I can't have changed it. Apart from that, the password he gave me still worked when I reloaded it into Firefox. So I'm fairly confident.

You can test it yourseld by going the the "Modify Data" section of https://www.cert.fnmt.es as it goes through a similar routine [not subject to the 2 month renewal limitation]. As long as you only make a slight mod to the address - and don't actually send it - you should be able to simulate this.

[alpujarran]

This is the Mac version - windoze is very similar,

[El Cid]

I just tried that and it didn't ask for a password.

I think I was correct when I said that it was optional. Obviously when you got someone to do it for you, they put in a password.

Looks like you might have to go through the process gain - this time don't use a password.

Sid

[Enrique]

Hi alpujarran ,
I get the same as you.....wants a master Password.................

[alpujarran]

Hi alpujarran ,
I get the same as you.....wants a master Password.................

It would appear that maybe not all digital signatures are created equally

[alpujarran]

. .Obviously when you got someone to do it for you, they put in a password.
Looks like you might have to go through the process gain - this time don't use a password.

If you've actually managed to sign your change of data then that looks like a possibility.

The story [as much as I can remember 3 years on]:

Guy goes into a Government office with the paperwork he's printed out from the FNMT. Idea being that all he has to do is verify his identity to the official and said official will then push some buttons and the guy can simply go home and download the digital signature.

But the official says there's no need to go through all that performance because he can download it there & then and put it onto the CD for the guy.

Maybe because it came from the official's computer it somehow has a different security level?? Certainly possible. If so, this info might be of use to other readers.

edit: Sid, having re-read this it. looks like I might be having a go a you which is not the case. You just provided the hook to hang the explanation on.

[alpujarran]

Hi alpujarran ,
I get the same as you.....wants a master Password.................

Enrique, have you tried with different signatures??

[El Cid]

edit: Sid, having re-read this it. looks like I might be having a go a you which is not the case. You just provided the hook to hang the explanation on.

No problem.

I'm pretty sure I'm right - don't put in a password if you do it yourself.

Each office will handle it differently and you can't avoid that - it happens all the time in Spain.

Sid

[Enrique]

Hi alpujarran,
Finally got there...............

Went back to my original system that I'd setup Digital Signature on.

XP SP3 IE8...........

Opened up all the Active-X options in IE8 and Modified my Data.......comfirmed it had changed too

I'll have a play on my Win7/ Firfox system but not tonight for sure......


Looks like I'll be keeping this XP system...........

[Enrique]

Good morning El Cid,

When you did the Test yesterday evening what was you system spec...........

OS and Browser

Its looking to me that its the way the Browser handles the Certificate.

Thanks.

[alpujarran]

I have a theory:

When an application is made for a DS, a file is tucked away in the OS of the machine involved. Let's imagine that this file contains a "master password". When the DS is downloaded it has to be done to the same OS/machine combination to work. The DS can be imported/exported/copied for use any other machine/OS combinations but the original can only be amended or renewed on the actual OS that created it.

[El Cid]

I have W7. It works in IE9 and Chrome with no password but Firefox won't let me do anything as it rejects the FNMT site certificate!

Sid

[alpujarran]

I've only been able to talk Firefox into allowing me into certain sites by manually putting exceptions for various domains, eg:
apuc.fnmt.es
cert.fnmt.es
whatever.dgt.es etc

[Enrique]

Ok Guys this is it............

Thanks for your input Sid..........

alpujarran:: No theories........keep it simple..............


Got it working on Win 7 and IE9..............enabled all the Active-X settings and some more

Browser comes up and says "you don't want to be Browsing with these setting " my translation..

Changed Data on site.....no Password needed.........

You will need your Certificates in the Personal section.........

I'll try and tidy up my proceduer thru the day .


alpujarran::
What version of IE are you using as getting to the settings varies ..........

[alpujarran]

alpujarran:
What version of IE are you using as getting to the settings varies ..........

I haven't tried IE yet, only Firefox. I'm on a Mac right now but I'll turn on the XP machine & let you know.

[alpujarran]

Version 6 ...

[Enrique]

VERSION 6.....................

That may well work in your favour..................about as good security as chocolate rejas.......

make sure your Certificates are in Personal.

I'll get back when my XP system is up..............with some settings to try.