pyhanko_certvalidator.errors.InvalidCertificateError

[deaw0003]

Hi @MatthiasValvekens. I try to use validation function following https://pyhanko.readthedocs.io/en/latest/lib-guide/validation.html but I found error and I don't know to deal with it. These are code and pdf file. I use self sign certificate to sign a document and also need to use in validation function.
signed_sample.pdf

Error
pyhanko_certvalidator.errors.InvalidCertificateError: The active key usage policy requires at least one of the key usage extensions non repudiation to be present.

Code

from pyhanko.keys import load_cert_from_pemder
from pyhanko_certvalidator import ValidationContext
from pyhanko.pdf_utils.reader import PdfFileReader
from pyhanko.sign.validation import validate_pdf_signature

root_cert = load_cert_from_pemder("tmp/nancy-cert.crt")
vc = ValidationContext(trust_roots=[root_cert])

with open("tmp/signed_sample.pdf", "rb") as doc:
    r = PdfFileReader(doc)
    sig = r.embedded_signatures[0]
    status = validate_pdf_signature(sig, vc)
    print(status.pretty_print_details())

[deaw0003]

Please help me to answer.

[MatthiasValvekens]

Hi,

Sorry, this dropped off my radar.

Anyway, this is a very common issue (should add it to the FAQ). You get this error if the signer cert does not have the non-repudiation bit set. Here's how to address that:

https://pyhanko.readthedocs.io/en/latest/cli-guide/config.html#key-usage-conf (CLI)

https://pyhanko.readthedocs.io/en/latest/api-docs/pyhanko.sign.validation.html#pyhanko.sign.validation.pdf_embedded.async_validate_pdf_signature (API, see in particular key_usage_settings)

[deaw0003]

Thank you very much. I will try these.