User instructions for signing MS-Office documents using our UPC token (Summer release) through the AATL certificate.

Status: May 05, 2023

1 Basics

1.1 Goals of this document

A step-by-step guide to signing MS Office documents. By signing an MS-Office document, other users can no longer edit the final document. Otherwise the document is considered invalid.

2 Short version

Procurement of suitable certificate

The following product type of our UPC tokens allow MS-Office documents to be signed.
✓ UPC Bundle (Summer Release)

The following product types support the signing of MS-Office documents.
✓ COMPANY
✓ SIGNATURE
✓ AUTHENTICATION

✓ An overview of all products can be found here

Note: Your MS-Office document must have a compatible file format. If the current file format of your MS Office file is not compatible, you will be prompted to save the document in a different format. Please follow this prompt. Otherwise you will not be able to sign the document.

Protect document

✓ Select “File” → “Information” → “Protect document” → “Add digital signature”.
✓ In the new window that appears, select the type of commitment under “Type of commitment”, specify the purpose of the signature and select the certificate under “Change…”.
✓ Under “Details” you can add further information about the signer. To add the signature click on “Sign”.

3 Documentation in detail

3.1 Sign MS-Office document

Note: For this process you have to attach your UPC token to your PC.

Click on “File”

Legend:

1. On the top left corner click on “File”

Add digital signature

Legend:

1. Click on “Info” on the left Sidebar → “Protect Document” → Click on “Add a Digital Signature”

Type informations of the signature in

Legend:

1. Choose a “Commitment type”
2. Type the “Purpose for signing this document” in.
3. If you click on the “Details” button you can add more Informations about the signer
4. Choose your certificate after clicking on “Change…”

Password query of the upc token

Legend:

1. Type in your password of the UPC-Token

Signature confirmation

Legend:

1. Click on “Ok” to complete

After a digital signature, the document is protected from any processing or manipulation. If the file is edited after a signature, the document becomes invalid! You can find more information about digital signatures in MS Office documents here.

You might be interested in that

User guide for signing and encrypting emails with the GLOBALTRUST CLIENT certificate on your Apple iPhone
As of May 10, 2023

1 Basic

1.1 Goals of this document

A step-by-step guide on how to add the certificate to your iPhone to then sign and/or encrypt emails. This guide was created for an Apple iPhone (iOS version: 16.2).

1.2 Purchase of suitable certificate

The following product type of our certificates supports the signing and encryption of e-mails on an Apple iPhone
✓ CLIENT

✓ You can find an overview of all products here
✓ You can find general information on signing and encrypting e-mails here

2 Short version

Installation of the certificate

✓ Open our Globaltrust Mail→ Click on the download link → Enter your data → “Send” → Install .p12 file → Allow configuration profile
✓ “Settings” → “Profile loaded” → “Install” → enter the screen password → “Install” → enter the password for the certificate

Add certificate to email account

✓ Search for “Mail” in the settings and click → select the email that belongs to the certificate
✓ Click on “Account” → “Advanced settings” → “Sign” and/or “Encrypt by default”.

Send signed email

✓ Create new email draft → Enter recipient, subject and message → Send

✓ Search for “Mail” in the settings and click → select the email that belongs to the certificate
✓ Click “Account” → “Advanced Settings” → “Sign” and “Encrypt”.
✓ Install the recipient’s certificate.
✓ Create new email draft → Enter recipient, subject and message → Send

Note: With S/MIME encryption, both communication partners require a suitable certificate.

3 Detailed documentation

3.1 Step I – Installation of the certificate

Legend:

1. Open “Mail”

Legend:

1. Open our Globaltrust email.
2. Open the link to download the certificate.

Legend:

1. 1.  Enter the 18-digit reference number (is included in the e-mail)
   2. Enter activation pin
   3. Enter new certificate password

Legend:

1. Install pfx format

Legend:

1. Click “Allow”.

Legend:

1. Click on “Close”

Legend:

1. Open “Settings”

Legend:

1. Click on “Profile loaded”

Legend:

1. Click on “Install”

Legend:

1. Enter “Screen Code” to confirm the installation

Legend:

1. Click “Install”.

Legend:

1. Click “Install”.

Legend:

1. Enter the password of the certificate

Note: This is the password that you entered as the new password when installing the certificate.

Legend:

1. Here we now see the configuration profile which we have set up for a signature or encryption.

3.2 Step II – Add certificate to email account

Now that we’ve installed our certificate and set up our configuration profile, we’re ready to sign emails.

Legend:

1. In Settings, search for “Mail” in the search bar

Legend:

1. Click on “Accounts”.

Legend:

1. Select the e-mail account that is also assigned to the certificate. In this case it is an Outlook mail.

Legend:

1. Click on “Account”.

Legend:

1. Click on “Advanced Settings”

Legend:

1. Under the following sub-items you can activate the signature or the standard encrbyption

Note: With S/MIME encryption, both communication partners require a suitable certificate.

Legend:

1. Click on the controller → Controller turns green and a tick appears next to the certificate.

3.3 STEP III – Send signed email

In order to carry out this section, you have to click on the tab in the sub-item Signing in the last step.

Legend:

1. Open settings.
2. If the “Mail” app has not been closed beforehand, it must be closed once so that the certificate can be used.
3. Open “Mail” app

Legend:

1. Create a new email draft

Legend:

1. Enter the recipient, subject if necessary, and a message.
2. Click on the arrow to send your message

3.3 Schritt IV – Send signed and encrypted e-mail

To carry out this section, you have to click on the tab in the last step, in the sub-item “Sign” and “Encrypt by default”. In addition, with S/MIME encryption, both communication partners must have a suitable certificate.

Before you can send an encrypted message, you must also install the recipient’s certificate

Legend:

1. Click on the recipient whose certificate you want to install.

Legend:

1. Click View Certificate

Legend:

1. Click on “Install”

Legend:

1. After successful installation, click on “Done” at the top right.

Legend:

1. After successful installation, a tick appears next to the recipient’s certificate.

If you have activated the “Standard encryption” then you cannot send an encrypted e-mail to people whose certificate you have not installed. If you try anyway. you will see a crossed-out lock in the recipient bar on the right, as also indicated below.

If you have activated the “Standard encryption” and want to send an e-mail to a person whose certificate you have already installed, then after entering the recipient you will notice that the lock is no longer crossed out and at the top there is an inscription “Encrypted” shows up.

Legend:

1. Click on the arrow to send your encrypted and signed email.

User guide for signing and encrypting emails using the GLOBALTRUST UPC token V2.0 (issued from May 15, 2023) in Microsoft Outlook.
As of May 9, 2023

1 Basics

1.1 Goals of this document

A step-by-step guide on how to add the certificate in Microsoft Outlook to sign and/or encrypt emails.
These instructions were created for Microsoft Outlook 2016 

1.2 Procurement of suitable certificate

The following product type of our UPC token supports the signing and encryption of emails
✓ UPC-Bundle (V2.0 issued from May 15, 2023)
✓ UPC-Token (V2.0 issued from May 15, 2023)

Folgender Produkttyp unserer UPC-Token unterstützt das Signieren von E-Mails
✓ UPC-Bundle (V1.0 issued before May 15, 2023)
✓ UPC-Token (V1.0 issued before May 15, 2023)

Note: A subsequent upgrade is not possible.

The following additional product types also support the signing and encryption of e-mails:
✓ COMPANY
✓ SIGNATURE
✓ AUTHENTICATION

✓ An overview of all products can be found here here
✓ General information about the GLOBALTRUST UPC Bundle/Token can be found here
✓ General information on signing and encrypting e-mails can be found here

2 Short version

Adding the certificate in Outlook

✓ Click under “File” → “Options” → “Trust Center” → “Trust Center Settings”.
✓ In the newly appeared window under “E-Mail Security” → “Settings” click to set up a new security settings profile
✓ Enter any name for the security setting, then click on the required certificate via “Signing certificate” and “Encryption certificate” under “Choose…”. (If the certificate is not displayed immediately, click on “More options”)

Signing emails

✓ Click “New E-Mail” at the top left. Under “Options” click on “Sign”.
✓ Enter recipient, subject and message if necessary. Send.

Encrypting emails

✓ Add the recipient to the address book. (If already done skip this point)
✓ Click “New E-Mail” at the top left. Under “Options” click on “Encrypt”.
✓ Enter recipient, subject and message if necessary. Send.

Note: With S/MIME encryption, both communication partners require a suitable certificate.

Sign and encrypt emails

✓ Add the recipient to the address book. (If already done skip this point)
✓ Click “New E-Mail” at the top left. Under “Options” click on “Encrypt” and “Sign”.
✓ Enter recipient, subject and message if necessary. Send.

Note: With S/MIME encryption, both communication partners require a suitable certificate.

3 Detailed documentation

3.1 Step I – Adding the certificate in Outlook

3.1.1 Open settings

Click on “File”

Legend:

1. Choose “File”  

Click on “Options”

Legend:

1. Click on the left side bar at the bottom on “Options”

3.1.3 Enter the Trust Center

Trust center

Legend:

1. Click on “Trust Center”.
2. Open “Trust Center Settings”.

3.1.4 Open Security Profiles

Open email security settings

Legend:

1. Click on “Email security”
2. Under “Encrypted email messages” click on “Settings”.

3.1.5 Choose certificate

Requirement: UPC token must be plugged in!

Change security settings

Legend:

1. Set “Security Settings Name”.
2. Select “Default Security Setting for this cryptographic message format”.
3. Select “Signing Certificate” by pressing “Choose…”
4. Select “Encryption Certificate” by pressing “Choose…”
5. “Send these certificates with signed messages” → “OK”

3.1.6 Enter password of the UPC-Token

Legend:

1. 1. Type password in →  Click on “Login”.

3.2 Step II – Signing Emails

3.2.1 Create a new email draft

Requirement: UPC token must be plugged in!

Write new E-Mail

Legend:

1. Click on “New Email”

3.2.2 Sign and send the email

Sign and send the email

Legend:

1. “Options” → Click on “Sign”.
2. Type in the receiver, subject and the message
3. Send your mail.

3.2.3 Enter password of the UPC-Token

Legend:

1. 1. Type password in →  Click on “Login”.

3.3 Step II – Encrypting Emails

3.3.1 Add a new contact to the address book

Note: If you want to send an encrypted message to the contact, they must be in your address book.

Open “People” and create a new contact

Legend:

1. 1. “People” → “New Contact”

Enter contact details and save

Legend:

1. 1. Type in Name 
   2. Type in E-Mail address 
   3. Click on “Save & Close”

3.3.2 Create a new email draft

Requirement: UPC token must be plugged in!

Write new E-Mail

Legend:

1. 1. Click on “New Email”

3.3.3 Encrypt and send email

Legend:

1. “Options” → “Encrypt”
2. Type in the receiver, subject and the message
3. Send your mail.

3.3.4 Enter password of the UPC-Token

Legend:

1. 1. Type password in →  Click on “Login”.

3.4 Step II – Signing and encrypting emails

Note: If you have not yet added the contact you want to send the encrypted message to in your address book, go to 3.3.1 Add new contact to address book

3.4.1 Create a new email draft

Requirement: UPC token must be plugged in!

Write new E-Mail

Legend:

1. Click on “New Email”.

3.4.2 Send signed and encrypted email

Legend:

1. “Options” → Click on “Sign” and “Encrypt” 
2. Enter recipient, subject and message if necessary.
3. Send e-mail.

3.4.3 Enter password of the UPC-Token

Legend:

1. 1. Type password in →  Click on “Login”.

You might be interested in that

On letters, stamping and (e-)seals

Still stamping or already sealing? Fully automated and at the highest security level? If no, you should think about it: You can use the electronic seal as a digitization turbo and make it the central game changer of your organization. Did you know that there are administrative processes in which qualified electronic sealing is already required by law? With TRUST2GO®, our qualified cloud signature, we also offer you a digital stamp solution.

We’ll seal that for you

Digitization push anyone? Switch from company stamp to electronic seal. In 2016, the EU eIDAS regulation not only introduced the remote signature, but also the electronic remote seal. Since then, documents can be digitally signed or sealed quickly and conveniently in the name of the company. The electronic seal confirms the origin of the data, i.e. as proof of origin. In addition, an intact seal proves that the data has not been intercepted and manipulated en route, i.e. integrity.

What now: digital signature or digital seal?

There is no technical difference between electronic seals and signatures, they are just used differently: only natural persons can sign electronically to express a declaration of intent. Electronic seals are used by legal entities – i.e. companies, associations and authorities. While a qualified electronic signature is legally equivalent to a handwritten signature, a qualified electronic seal confirms the correctness of origin and the integrity of the data with which it is connected – just as legally effective:

“A qualified electronic seal shall enjoy the presumption of integrity of the data and of correctness of the origin of that data to which the qualified electronic seal is linked.”

As with electronic signatures, a distinction is made between simple, advanced and qualified electronic seals.

Postmarked? Yes, of couse!

The big advantage of the digital seal: No 2-factor authentication is required. The sealing can be fully automatic, without you having to enter a TAN, PIN or fingerprint for each document.

The areas of application are diverse and the electronic seal is suitable as an automated process even for very high document volumes. This simplifies the workflow and prevents counterfeiting and fraud.

• For example, when invoices and fee notes are sealed: The recipients have the security that the fee notes come from the seal creator and were not intercepted and changed by fraudsters en route. Again and again, fake invoices that look deceptively real are circulating because e-mail addresses of incoming invoices are hijacked and invoices are intercepted. The invoices are then copied and the IBAN changed on them. Customers’ money disappears into the pockets of criminals.
• Or when it comes to the digitization and archiving of personnel files. Here, too, the digital seal is an efficient alternative to the electronic signature – at the same highest level of security.
• Other scenarios are everyday business correspondence such as offers, delivery notes and correspondence.

Legally ordered (remote) seals

What has to, has to: Sometimes qualified sealing is even required by (EU) law.

• EPREL
  The European Energy Labeling Product Database (EPREL) provides consumers with information about energy labeled products and the most energy efficient electrical appliances. Since 2019, suppliers have had to register their products with an energy label in EPREL – to do this, each product has to be sealed.
• PSD2
  The Payment Services Directive (“PSD2”) is an EU directive that obliges payment service providers to use a seal when accessing bank interfaces or bank customer accounts: an issue since 2019, when banks had to open their IT infrastructure to third-party providers. This requires additional security measures. Anyone acting as a third-party service provider must identify themselves with one or more certificates when accessing the PSD2 interface automatically. Either Qualified Website Certificates (QWAC) or Qualified Electronic Seal Certificates are required.

Electronic Seal, Qualified eSeal Certificate, Remote Seal

It doesn’t matter what you call it – it doesn’t matter whether you come to us as an office or company, need an EPREL-compliant company seal or are subject to special security standards as a FinTech, we will be happy to provide you with more information on how you can use our TRUST2GO® product to get the electronic seal completely can be used easily and legally securely throughout the EU.

Order your qualified company seal now!

You might be interested…

Cyber attacks on companies and public authorities usually begin unspectacularly – with an e-mail. Malware is used to introduce computer viruses into the IT system with the aim of extorting a ransom or committing industrial espionage or data theft. Employees are often not to blame, as phishing attacks are becoming increasingly sophisticated. Anyone who wants to get a grip on the security of their digital business communications therefore has no choice but to implement measures such as e-mail encryption and e-mail signatures. Exactly our topic – we have a special offer for companies and law firms that are preparing for their activities at the Unified Patent Court of the EU and rely on the services of GLOBALTRUST.

The total damage caused to companies each year by opening infected attachments or clicking on links runs into hundreds of billions across Europe. Not to mention the loss of image and trust. And computer crime is still on the rise. As an experienced signature provider and provider of qualified trust services, GLOBALTRUST can help ensure the protection of your e-mail communication.

Free additional function for newly issued GLOBALTRUST UPC products

Just in time for the launch of the EU’s Unified Patent Court (UPC), we have a top offer for IP attorneys and all parties who need reliable authentication in court to manage innovations and intellectual property: When you place a new order for a GLOBALTRUST UPC product, we will activate the functions “e-mail signature” and “e-mail encryption” for you free of charge.

E-mail communication: Are you really safe?

The virus scanner works, spam protection and firewall are activated, your company feels safe? You think your systems are protected against external attacks? And anyway: Who cares about your data?
Sorry to say, but most likely you are misjudging your situation. Phishing attacks, identity theft and malware – cybercrime is becoming more and more sophisticated and it is becoming more and more difficult for your employees to distinguish fake e-mails from real e-mails or to identify false senders.
You can only protect your own business and your partners with additional measures, like signature and encryption.

Go for prevention with email signatures!

An electronic signature appended to an e-mail ensures its authenticity, i.e. it serves as proof of origin: it is a matter of verifying the identity of the sender. An unbroken signature further proves that the message has not been intercepted and tampered with on its way, thus ensuring its integrity. As a result, it is no longer possible to fake a sender or alienated content.
In this context you can also read about the fraud scam Fake-President-Fraud/CEO-Fraud and how you can take precautions with our product GLOBALTRUST COMPANY by creating forgery-proof, digital business cards for your employees.

Email encryption, professional secrecy and GDPR

We know that more than half of all companies and organizations don’t do it (yet), but we strongly recommend it: use email encryption to protect your electronic communications. It ensures confidentiality, preventing sensitive data, trade secrets and valuable information from being read. A digitally encrypted message can only be opened by recipients who have the appropriate key.
You can combine email encryption and email signature, but you can also use them independently.
If files are exchanged by e-mail, data protection and professional secrecy are sometimes at stake. Encryption of data is a suitable means according to the GDPR and can help to avoid corresponding liability traps due to data leaks.

Padlock: S/MIME technology

At GLOBALTRUST, we rely on S/MIME (Secure/Multipurpose Internet Mail Extensions), a standard procedure that can be used for e-mail encryption and e-mail signatures.
S/MIME is based on an asymmetric encryption method. This means that, in contrast to symmetric encryption, users do not share a common secret key (private key); instead, each user uses his or her own key pair, which consists of the private key and a public key.
S/MIME is a technically mature process in which a clear text piece of information (plaintext) is converted into an unreadable counterpart (cipher text). The cipher text can only be made readable again with the aid of a suitable key. In the case of GLOBALTRUST UPC products, the matching key is located on a secure smart card integrated in a USB token. In addition to protection by means of a password, the key is also non-exportable and can be physically locked away.

Low barriers for introducing S/MIME

Due to the low costs, the simplicity and the widespread availability of e-mail programs that support S/MIME by default, we believe investments in e-mail security are extremely attractive. We are happy to inform you about the appropriate GLOBALTRUST products.

The following product type of our UPC tokens supports the signing and encryption of e-mails
✓ UPC bundle (V2.0 issued as of 15.5.2023)
✓ UPC token (V2.0 issued as of 15.5.2023)

The following product type of our UPC tokens supports the signing of e-mails
✓ UPC bundle (V1.0 issued before 5/15/2023)
✓ UPC token (V1.0 issued before 15.5.2023)

Note: A subsequent upgrade is not possible.

The following additional product types also support signing and encryption of e-mails:
✓ COMPANY
✓ CLIENT

✓ An overview of all products can be found here
✓ General information about the GLOBALTRUST UPC Bundle/Token can be found here

Get your GLOBALTRUST UPC-Token now

More features, same price!

The LDAP service from GLOBALTRUST

The LDAP service can be used to call up additional information about people via their certificates and the certificate itself. All you need is an LDAP-enabled client or a number of programs support LDAP directly (including Microsoft Outlook and Mozilla Thunderbird)

The LDAP directory at GLOBALTRUST has the following basic structure: Root entry: c=AT,
Organization designation o=GLOBALTRUST or o=A-CERT,
Sub-designation ou=<product name> such as “A-CERT ADVANCED” or “GLOBALTRUST QUALIFIED”</product name>

A maximum of 50 hits are displayed for each search. If no search criterion is specified, the first 50 entries are displayed.

What is LDAP?

Lightweight Directory Access Protocol (LDAP) was created to facilitate the standardized exchange of personal information on the Internet.
It can be very helpful for exchanging certificates, especially for encrypted data transmission, which requires the message recipient’s certificate.

GLOBALTRUST uses the latest LDAP version, LDAPv3, which has been defined in a number of RFCs (including RFC3377, RFC3671, RFC3672, RFC3673, …).

What information does the GLOBALTRUST LDAP service provide?

In addition to the certificate itself (UserCertificate;binary), the following certificate information: serial number (serialNumber), e-mail address (mail) and certificate usage (cn) from the certificate.

Furthermore, additional information from the certificate is issued (if included):

– first name (givenName),
– surname (sn),
– Organization details (acertOrganization),
– location (acertLocation),
– Information about the test certificate (acertTestCertificate), X.509 Extension: If the field is present and “true”, the certificate in this node was created for test purposes,
– Management code according to § 19 E-Gov-G (acert management code), X.509 extension: contained in GLOBALTRUST/A-CERT GOVERNMENT certificates,
– Signature creation unit issued by GLOBALTRUST/A-CERT (acertIssuerInfo), X.509 extension: Information on the hardware signature creation unit used,
– Signature creation unit used by the signer (acertSigneeInfo), X.509 Extension: Information according to the signer on the hardware signature creation unit used,
– Identification number of the signature creation device (acertHWID),
– Revocation indicator (acertRevoked): Field “true” if certificate was revoked,
– Revocation date (acertRevokeDate): time of revocation,
– Provisional revocation date (acertTempHold): Time at which a certificate was provisionally revoked (but not yet finally revoked).

In the LDAP service, only those fields that contain applicable information are displayed, empty fields are not displayed. The LDAP service is updated daily.

Online LDAP search

A web interface for the LDAP search, with which you can easily search our database of public certificates, is in the works.

Open source LDAP client

http://www.ldapbrowser.com/ offers a free LDAP client. However, GLOBALTRUST does not guarantee functionality.

You might be interested in that

Step 1: Download Root Certificate

In order to be able to use the GLOBALTRUST signature services, the GLOBALTRUST root certificates must be installed.

Download addresses for important root CA certificates:

• GLOBALTRUST https://www.globaltrust.eu/static/globaltrust2006.crt
• GLOBALTRUST 2015 https://www.globaltrust.eu/static/globaltrust-2015.crt
• GLOBALTRUST 2020 https://www.globaltrust.eu/static/globaltrust-2020.crt
• GLOBALTRUST RKS-CARD 2015 https://www.globaltrust.eu/static/globaltrust-rks-card-2015.crt

Overview of all CA certificates from GLOBALTRUST:

https://www.globaltrust.eu/certificate-policy.html

Step 2: Install Certificates

Depending on the operating version of the iOS, the installation may differ. GLOBALTRUST does not offer direct support for this, but there are numerous installation instructions on the Internet.

Recommended Google search: “iOS Root Certificate install”

Examples of installation instructions:

• https://www.ibm.com/support/knowledgecenter/SSHS8R_7.0.0/com.ibm.worklight.instal…
• https://www.thesslstore.com/blog/trust-manually-installed-root-certificates-in-ios
• https://blogs.technet.microsoft.com/uclobby/2014/01/09/installing-private-ca-root…

You might be interested in that

You might be interested in that

Outlook 2016

This guide is optimized for installing and using certificates with Microsoft Outlook 2016 to sign and encrypt emails. You can find this guide at https://www.globaltrust.eu/static/outlook-anleitung.pdf

In order for signers to be able to create valid signatures when sending emails, the necessary private keys and certificates must be installed in the Microsoft certificate management. The installation process is required once for the Signator.
If the mail recipient has a current Microsoft operating system (including the updates recommended by Microsoft), no activities are required on his part. Signed emails are recognized automatically. Troubleshooting certificate usage in Outlook.
The documentation also contains instructions on how to use the GLOBALTRUST LDAP server and help on setting up an Outlook account for the first time.
The documentation also includes previous guidance for Outlook 2013 and Outlook 2007/2010.

Quick installation for experienced users

Install certificate

• Download the PKCS#12 file from GLOBALTRUST and install it in the Windows certificate manager with a double-click
• In the Outlook options select the settings for the trust center
• Under E-mail security select “Settings…” for Encrypted e-mail messages
• Select signature and encryption certificate, switch hash algorithm to “SHA256”.

Sign/Encrypt

Compose a new message
Show options ribbon
Press the Sign or Encrypt button → Send
To encrypt a message, a certificate from the recipient is required (see documentation)
GLOBALTRUST creates private key and certificate

If GLOBALTRUST creates the private key and issues the certificate, the signer receives a single file in PKCS#12 format (.P12 extension) that contains the private key, their own certificate and all information on the certification path.
After successful installation (see below) you will receive a certification path that looks like this:

“GLOBALTRUST” → “GLOBALTRUST CLIENT 1” → “your end user certificate” or
“GLOBALTRUST 2015 ” → “GLOBALTRUST 2015 CLIENT 1” → “your end user certificate” or
“GLOBALTRUST 2020 ” → “GLOBALTRUST 2020 CLIENT 1” → “your end user certificate”

Note: due to specific requirements, other certificate chains are also possible, but they all start with GLOBALTRUST.

Certificate usage in Outlook with multiple email addresses

Outlook only accepts certificates for signing e-mails that contain exactly the same e-mail address as the active user account. If someone wants to sign at different email addresses, then he needs several certificates. You can find out how to display the certificates here.

You might be interested in that

GLOBALTRUST QUALIFIED TIMESTAMP assigns a time stamp to any document and thereby guarantees the existence of this document at this point in time. The document itself is not transferred, data protection is preserved – internationally recognized standard RFC 3161 and EU-wide legal basis guarantee interoperability. GLOBALTRUST archives issued time stamps at no additional cost.

Why GLOBALTRUST QUALIFIED TIMESTAMP?

In many cases it is important to know when a document was created, when it was submitted or when it was published – or more abstractly: when an electronic process took place. Just think of the financial market, which would no longer function at all without unfalsifiable and millisecond-precise time information.

On the one hand, the local computer time is far too imprecise, and on the other hand, it can also be manipulated at will. The Internet does not know reliable time information, so special services are required. A time confirmation from a trustworthy third party therefore has high probative and confirmatory power.

The qualified timestamp links an electronic document to the “official time”. This guarantees the existence of the document at this point in time. In addition, it is proven that the document has not been changed since this point in time (integrity).

Electronic time stamp services are gaining in importance. They serve to preserve evidence that also withstands long-term regulatory requirements: be it for audit-proof archiving, proof of the priority of intellectual property, prevention of fraud, documentation of submission and receipt dates or in electronic procurement procedures. Our customers use them for numerous other functions as part of automated document management.

A reliable indication of the time is of the utmost importance, particularly in connection with the publication of information, the existence of a specific website, UWG issues, copyright infringement, e-tendering issues or issues relating to the use of names and terms. Other common application scenarios are time stamps embedded in electronic signatures on contracts, protocols in the e-health sector, and non-disclosure agreements (NDAs).

As a trust service provider according to eIDAS and SVG, the timestamp service GLOBALTRUST QUALIFIED TIMESTAMP is provided under the supervision of the Telekom-Control-Commission/RTR GmbH. In 2018, GLOBALTRUST was the first provider in Austria to play a key role in shaping the development.

What can’t a timestamp do?

As a “time signature”, a timestamp proves the exact point in time at which a document was available. An intact time signature is also proof that the document has not been changed after it was attached (integrity).

However, it makes no statement as to where or by whom a document originates (authenticity) and also does not express approval of the document content (“content commitment”). These functions can only be covered using (qualified) electronic signatures and seals. Here we have created a short overview.

Internationally recognized standard

GLOBALTRUST uses the internationally recognized and widely used standard RFC 3161 (Internet X.509 Public Key Infrastructure Timestamp Protocol, TSP). This ensures global interoperability, regardless of the file format or document management system used.

How does the qualified timestamp work?

A unique, non-forgeable hash code is automatically generated from a document. This hash code is uniquely associated with a specific document. However, the content of the document cannot be inferred from the hash code. Any (electronic) data can be used as a hashable and therefore time-stampable “document”. XML, PDF and JSON documents are popular.

This hash code is transmitted to the GLOBALTRUST TIMESTAMP server in encrypted form (TIMESTAMP request), where it is provided with the exact time and electronically signed by the TIMESTAMP server.

GLOBALTRUST QUALIFIED TIMESTAMP obtains the exact time directly from the Frankfurt atomic clock and guarantees an accuracy of one second (internal analyses yielded an accuracy of better than 10 milliseconds). The time stamp is either transmitted as a separate file to the requester, who keeps this file together with the original document. However, numerous systems also have integrated time stamp functions and embed, e.g. B. insert the timestamp in a signed or unsigned PDF. In addition, the time stamp is kept by GLOBALTRUST for 35 years for later questions on the preservation of evidence.

This procedure guarantees 100% confidentiality of your valuable documents. The content of the confidential documents is never transmitted to GLOBALTRUST. Since the hash code is also transmitted in encrypted form, it is not possible for attackers to identify who is actually making requests.

GLOBALTRUST archives issued time stamps

In addition, each time stamp (not the document!) is archived for evidence purposes and can be made available at a later date. Even if the customer loses their timestamp, presenting the hash value of a document is sufficient to check the validity at a specific point in time. GLOBALTRUST archives all assigned time stamps for up to 35 years.

Conditions

Time stamps can be requested in different annual quotas. The minimum amount is 100 time stamps, which must be used within one year. A change to the next higher quota size is possible at any time and must be announced by the user.

• 100 time stamps/year: 20 euros
• 1,000 time stamps/year: 185.00

Conditions for special contingents, higher scales or for resellers on request. Users of a GLOBALTRUST certificate receive a basic quota free of charge.

Users receive a reminder email about current consumption and order information when their quota is running out. This ensures that the service is always available.

Accuracy of GLOBALTRUST QUALIFIED TIMESTAMP

GLOBALTRUST QUALIFIED TIMESTAMP guarantees a time accuracy of +/- one second. The time refers to UTC (Universal Time Zone). If the time guarantee can no longer be guaranteed, the timestamp service will be temporarily deactivated and the applicant will receive a corresponding warning.

Internal tests have shown that the accuracy is 100 times higher and the deviations are typically less than 10 milliseconds.

“As a collecting society for the copyrights of more than 27,000 members, we have to deal with tens of thousands of administration contracts every year. We only sign them electronically – advanced, fully automated, completely legally secure and including a qualified time stamp.”

DI Roman Oslansky, Head of IT Division, AKM

Who can use GLOBALTRUST QUALIFIED TIMESTAMP?

An order from GLOBALTRUST is required for use. Holders of certain valid GLOBALTRUST Certificates are entitled to up to 100 free timestamps.

What do you need to use it?

Adobe Acrobat also allows a time stamp to be included when signing a PDF document, which is retrieved automatically. No additional software is required. Installation see https://www.globaltrust.eu/static/support-adobe-acrobat-dc-wi….

Numerous providers of ECM, DMS and ERP systems have already integrated GLOBALTRUST QUALIFIED TIMESTMAP into their products.

Automated timestamp services and bulk timestamps

Of course, the automated assignment of time stamps or the provision of large quantities of documents with time stamps is also possible. This requires special archive programs. On request, GLOBALTRUST provides interested developers with the necessary specifications for integrating the time stamp functions into their products.

Which hash algorithms are supported?

GLOBALTRUST QUALIFIED TIMESTAMP supports the algorithms SHA-256, SHA-512 and RIPEMD-160, which are considered to be secure.

“We have been offering tailor-made e-tendering solutions for private companies and public clients for two decades. Especially for public companies that are subject to the Federal Procurement Act, a legally secure handling of procurement procedures is the essential criterion. In order to be able to guarantee this legal certainty, we use a qualified time stamp from GLOBALTRUST. The integration into our systems was done quickly and easily. We – and therefore also our customers – will continue to rely on this service for the next twenty years!”

Ing. Christian Stecker, General manager, vemap Einkaufsmanagement GmbH 

Which usage variants are supported?

Issue TIMESTAMP using TCP/IP port: timestamp.globaltrust.eu port 10318

• Timestamp assignment according to Timestamp Protocol (TSP) according to RFC 3161(+ Update RFC 5816)
• Usage: TLS client authentication with certificate required (certificate must be issued by GLOBALTRUST)
• Timestamp contains complete certificate chain with timestamp certificate, intermediate certificate and root certificate
• TLS encryption

Issue TIMESTAMP using HTTPS (Port 443 + 11080)

• Suitable for Adobe Acrobat from version 10 and Reader DC
• https://timestamp.globaltrust.eu
• https://timestamp.globaltrust.eu:11080
• Use: two alternative variants (A, B) possible
• Variant A: Authentication with username/password (assigned by GLOBALTRUST)
• Variant B: TLS client authentication with certificate (certificate must be issued by GLOBALTRUST)
• Timestamp contains only Timestamp certificate

The step-by-step instructions for using GLOBALTRUST QUALIFIED TIMESTAMP for Adobe Acrobat DC can be found at https://www.globaltrust.eu/static/support-adobe-acrobat-dc-wi….

Issue TIMESTAMP using HTTPS (Port 10080)

• Not suitable for Adobe Acrobat
• https://timestamp.globaltrust.eu:10080
• Use: two alternative variants (A, B) possible
• Variant A: Authentication with username/password (assigned by GLOBALTRUST)
• Variant B: TLS client authentication with certificate (certificate must be issued by GLOBALTRUST)
• Timestamp contains complete certificate chain with timestamp certificate, intermediate certificate and root certificate

Issue TIMESTAMP using HTTPS (port 13080)

For Adobe Acrobat from version 10 and Reader DC: https://timestamp.globaltrust.eu:13080

• Usage: Authentication with username/password required (assigned by GLOBALTRUST)
• Timestamp contains complete certificate chain with timestamp certificate, intermediate certificate and root certificate
• Product: e.g. Adobe Acrobat Version 10, Adobe Acrobat Reader DC

Developer information

TCP/IP access to GLOBALTRUST QUALIFIED TIMESTAMP Server

Creation of a timestamp request in Java

Written in Java using the BouncyCastle libraries, the following program creates a timestamp request in the request.tsq file for the doc.txt file:

You might be interested in that