The "electronic signature" 's box tools also called "eSignBox" is able to:

• electronicaly sign information (web form (XML),  .doc, .pdf, .txt, .jpg, .odt, .xls files) with personal certificate. The certificate can be in the Belgium elctronic ID (eID), a PKCS11 driver implemented chip card or in a secureded PFX file, through the PKCS12 protocol. Certificate could for example be obtained thanks to online digital certifiacte provider like GlobalSign (http://www.globalsign.com/)
• check signatures of signed file called "signed archive" (.tar format)
• check the certificate to sign with accreditation

The Electronic signature is legaly considered as handsigning

Your eID card is so scrictly personal, you must pay attention to not lost or loan it. Your PIN code is highly confidential.
You can find more information on eID card throught to the Federal Belgium Govermenent web site (www.eid.belgium.be), and especially with a video clip here: http://www.belgium.be/zip/movieEID_fr/START.html

eSignBox run on the following operating systems: 

• Windows 98, ME, 2000, XP et Vista
• Linux
• Mac OS X (Intel)

At first computer use, it is strongly recommanded to ckeck eSignBox compatibilty.

Please read the following FAQ: 

• What are the eSignBox requirements for using: 

• Windows systems, see FAQ 5: What are the eSignBox requirements for using on Windows systems ?
• Linux systems, see FAQ 6: What are the eSignBox requirements for using on Linux systems ?
• Mac OS X (Intel) systems, see FAQ 7: What are the eSignBox requirements for using on MacOS X (Intel) systems ?

• What are the Web browser eSignBox compatible  ?, see FAQ 8: What are the supported web browsers ?
• Java test , see FAQ 14 : How can I check for my computer configuration compatibility to run eSignBox & eID card ?
• eID test, if You use it for signing, see FAQ 13:  How to check my eID's card reader and middleware status ?

eSignBox requires: 

• A Java JRE 1.6 (or later) supported web browser.
• A X509 certificate to sign :
  • either with eID, that requires :
    • a valid eID card
    • an installed card reader
    • an installed eID card reader's software called "middleware eID"
  • or thanks to PKCS12 file certificate (can, for example, be purchased here http://www.globalsign.com)
  • or throught chips card or USB token, other than eID, ant that requires: 
  • a chips card/token USB with X509 certificate and private key,
  • an installed card reader,
    
  • an installed card software reader implementing PKCS11 library.
• An Internet access for using the signature portal. This item allows the certificate validation feature during the signing process.

eSignBox requires:

• A Java JRE 1.6 (or later) supported web browser.
• A signature environment which is able to deal with eID card is required.

• A X509 certificate to sign :
  • either with eID, that requires :
    • a valid eID card
    • an installed card reader
    • an installed eID card reader's software called "middleware eID"
  • or thanks to PKCS12 file certificate (can, for example, be purchased here http://www.globalsign.com)
  • or throught chips card or USB token, other than eID, ant that requires: 
  • a chips card/token USB with X509 certificate and private key,
  • an installed card reader,
    
  • an installed card software reader implementing PKCS11 library.
• An Internet access for using the signature portal. This item allows the certificate validation feature during the signing process.

eSignBox requires:

• A Java JRE 1.6 (or above). The last version supported by your browser is recommanded
• A signature environment which is able to deal with eID card is required.
• A X509 certificate to sign :
  • either with eID, that requires :
    • a valid eID card
    • an installed card reader
    • an installed eID card reader's software called "middleware eID"
  • or thanks to PKCS12 file certificate (can, for example, be purchased here http://www.globalsign.com)
  • or throught chips card or USB token, other than eID, ant that requires: 
  • a chips card/token USB with X509 certificate and private key,
  • an installed card reader,
    
  • an installed card software reader implementing PKCS11 library.
• An Internet access for using the signature portal. This item allows the certificate validation feature during the signing process.

The supported web browsers are: 

• Internet Explorer 8 and above
• Mozilla Firefox 3.x and above
• Chrome 9.0 and above
• Safari

electronic signing remains on digital certificates, trusted by an Certificate Authority.

On first use, the Wallon Certificate Autorithy is not knowed as a selftrusted for the browser, he so ask You whether thise Certificate Autorithy could be considered as trusted for its issuing certificates.

You must read and reply "Yes" or "Oui" or "OK" or "Executer" or "Execute" to accept the Certificate Autoroty issuing the cerrtificate as trusted.

To avoid a next session windows acknolegnement, You should check the "Alway trust the content from this editor" box.


With Linux systems, on first visit, You must be logged in as administrator (root) to allow the correct "jpsc" configuration applet donwload at right place and with correct rights.
If You are logged in as "user", You have to maunally copy the configuration applet (jpsc.rar extracted files) in the $JAVA_HOME/jre/lib/ext as root user (use the sudo command).

The  linux-jpcsc.jar and libjpcsc.so files can be found here http://signature.wallonie.be/eSign/applet/linux.
For subsequent use, You can be logged as simple user.

With MacOS X systems, on first visit, You must be logged in as administrator (root) to allow the correct "jpsc" configuration applet donwload at right place and with correct rights.

If You are logged in without write rights permissions adquates. Si vous tes connect sans les droits d’criture, You have to maunally copy the configuration applet (jpsc.rar extracted files) in the Library/Java/extensions folder.

The  linux-jpcsc.jar and libjpcsc.so files can be found here http://signature.wallonie.be/eSign/applet/mac.

Figure 1 : Initialisation eSignBox - Avertissement sur la scurit - certificats.

The www.lecteursdecarte.be web site point out where you can get a reader, how choose and configure it. Card readers could also be found on specialized computers store, and even in some hypermarkets.

Notice that on Windows and Linux system, the eID Middleware installation (developed by federal government) is requires.

On Mac OS X (Intel), You must NOT install eID middlewareto sign with eID and eSignBox. eID Middleware installation breaks the eID usage under eSignBox ! It is remains however possible to sign with PKCS12 certificate or token.

Useful information is available on the dedicated to electronic ID (eID) Fedict's website : http://eid.belgium.be

eID Middleware software and its related documentation are downloadable here: http://www.belgium.be/zip/eid_datacapture_fr.html

Software can runs on Windows, Linux and MAC systemms, but please notice: the middlware must NOT be installed. on Mac OS X (Intel).

Since the Mac OS X 10.4.6 release, some applications (like Safari and Microsoft Entourage) can use eID without this middleware. More information, can be found here http://eid.belgium.be/fr/navigation/documents/39808.html

You so must NOT install it on Mac OS eID usage can otherwise be blocked with eSignBox ! It will only ramains possible to use certificate on smart card or pkcs file

You could go to the followed link (RRN files): https://www.mondossier.rrn.fgov.be

If you can see something as below (figure 2); it means that your card reader and middleware are working as required.

Figure 2 : Insert your eID card.

Otherwise, something goes wrong with your card reader or your middleware. To fix this, please check the the Belgium government website dedicated to eID at http://eid.belgium.be

Click on the followed link: http://www.java.com/fr/download/installed.jsp to check if Java JRE 1.6 (or later version) is installed and then click on Check installation button.

If you get the following message (figure 3), it means Java JRE 1.6 (or later) is installed and there's no Java conflict to use eSignBox.

CONGRATULATION, you have now the lastest version of Java !
Figure 3: Java JRE version.

When Java is not installed or has a not the JRE version 1.6, You will have to download and install Java Runtime Environment Version 5.0 (or later) from http://www.java.com/fr/download/manual.jsp

When your url is begining with https and whe when you see the cadena symbol, it means that communication is secured (SSL).

Warning box may appears because if the page contains insecurred elements, ther is a risk of misundestanding on their security level to the web user. It is not a bug.

You can either click on "Yes" or "No", the security is ensured and you can go-on on next step.

Note : By clicking yes the warning box will not appears anymore.

Figure 4: Security warning

If you get a message as below (figure 5), you will have to install the required Java version. Go back to FAQ 14:How check for the requested Java JRE version ?

Figure 5: A different Java version is needed.

To electronicaly sign with the ID (eID), you have to enter your secret Personal Identification Number (figure 4).

This PIN code has been sent to you in a locked letter, from federal government (SPF) and probably changed it at local administration when getting your eID card.

Attention, only a maximum of 3 tries is authorized for PIN code, a wrong fourth code will block the card.

To unblock it, You lust go to your local administration with You PUK code. The PUK code can be founde on the same latter where is Your first PIN code (from SPF).

You PIN code is your secret and must not be communicated to anyone else in any case (like a Visa card).

Figure 6: PIN code of electronic ID.

Or order to sign with a PKCS11 certificate or a token,  You must provide: 

• The path (i.g fig. 7) from where you stored the certificate on your computer,
• The certificate password or PIN code (to access to the chips card or token)

Figure 7 : Password or PIN code of PKCS11 certificate.

It mleans that the Java applet could not be loaded correctly. You can find an issue at the bottom left of your browser such as "Failed to load Java applet ".

Figure 8: Error on Java applet loading

eSignBox couldn't be load more than one time simultanously.

Close all you web browser windows. Then, re-open a new one and eSignBox.

The applet will correctly be loaded and the button as well.

In case of same wrong results, please have a look on the other FAQ to check wether your environnement is supported (certificate validation, right permission) and other requirements (Java appplet, eID middleware).

First, check that Java works fine (FAQ 14: How check for the requested Java JRE version ? )

The signature could take a while if you're signing a huge file (some many Mo or more). A notification bar should print the status in percentage.

If you're in idle time and the window seems freeze for a while, it means something went wrong. Close all web browser and retry.

When clicking on "Sign", You are asked to insert your electronic ID and check that both: 

• Id is correctly inserted into the reader. (You can eventually remove and insert it once more. (on windows, your picture should appears about ~2 secondes)).
• Card reader is correctly plugged in.(You eventually can plug it out and plug it in back to check.)

Figure 9 : Insert your eID card.

When clicking "Sign" again, a window appears asking You to type your PIN code.

If doesn't, please check back step FAQ 13: How to check my eID's card reader and middleware status ?

Signatures process imply about 5 steps. The last one is signed file backup process (on the same folder as file source to sign, name is identical but extention ".zip" or "signed.pdf").

Name and path are provided at the last step, for exemple :

• file to sign : C:\Datas_2007\Lettre_de_Marie.doc
• signed, named and stored under C:\Datas_2007\Lettre_de_Marie.doc.zip
• file to sign : C:\Datas_2007\Contrat.pdf
• signed, named and stored in PDF format C:\Datas_2007\Contrat.pdf.signed.pdf

Figure 10 : Last step signing file process

From eSignBox v2, a signed file is: 

• either in .zip format.
• or in PDF .signed.pdf format.

By default: 

• PDF file is signed in PDF "signed.pdf "format (embedded signature). archive "zip." format is also possible and  madatory when signing write-protected files

• Other file are signed in archive ".zip" format (original file + signature + other information)

To force the .zip format, You should uncheck the "Prefere signing format belonged to the file" at the "File Siging / File select" step.

Figure 11 : Prefere the use of signature format related to the file

A signed file from .zip format is at least composed of 6 files:

• readme.txt (explain the content of the .zip tarball).
• signature.xml
• header.content
• header.xades
• original file name with original extension
• lisez-moi.txt (French version of readme.txt)

Figure 12 : Signed file.

You can visually check other XML tags belonged to signature, but it is impossible to check the signature validity without a dedicated software, like eSignBox for exemple.

This feature is possible trhough the "Verify a file signature (XML or ZIP format)" function.

Pour vrifier la signature d'un fichier pdf (.signed.pdf) il faut employer Acrobat Reader ou un logiciel spcifique autre que eSignBox.

To check .signed.pdf pdf files you have to use Acrobat Reader (external from eSignBox).

The "Check a xml or .zip signed file"  function allow to know the identity related to the signed file certificate's.

Signer certificate's status indicates subject and sender. Le "Download"' link allows to read certificates's information.

eSignBox could not check the validity of an signed .pdf file .signed.pdf. The verification could valide with an PDF reader such as Acrobat reader.
Acrobat Reader documentation help on how to validate a numeric signature in pdf format. (http://help.adobe.com/fr_FR/Reader/8.0/index.html - http://www.adobe.com/support/documentation/fr/reader/)

Figure 13 : Verify a file signature for a document in .zip or .xml format.

This electronic signature's website is an Wallonne Global Country service shared for other civil services or organizations.

The website You were certainly uses the Wallonne Country signing module. Please, follow the four steps signing process and You will be reirected back to ther origin web site You came from.

You could have a problem with either your reader or middleware eID. Middleware is mandatory  in order to sign with the eID card (exept with Mac OS X system).

Figure 14: "Wait" Button

Already exmplained in the  What do I need to use eSignBox for signing ? FAQ , You must either have: 

• eID card with its reader and configured middleware,
• or a USB token embedded X509 certificate,
• or a PKCS12/PFX certificate file,
  

Choose any other signing meen other than eID or look for the following FAQ: 

• How to get and configure a card reader ? , FAQ 10: How to get and install a card reader ?
• How install an configure the eID middleware ? (pay attention : you MUST NOT install it on Mac !), FAQ 11: How to install the eID Middleware ?
• How can I check eID card reader and middleware operational status ? , FAQ 13: How to check my eID's card reader and middleware status ?

Be carreful ! On Mac OS X (Intel) the Fedict eID Middleware MUST NOT be installed. This item is clearly explained in the following FAQ: 

• What do I need to sign with eSignBox on Mac OS X (Intel) ? , FAQ 7 : What are the eSignBox requirements for using on MacOS X (Intel) systems ?
• Why eID Middleware installaion is forbiden on Mac OS X ? , FAQ 12 :  Why You should not instal the eID Middleware on MAC OS X (Intel) systems ?

A signature environment is required in order to communicate with the eID card.

• If you are logged on as super-user root, applet is automatically downloaded at first eSignBox connexion
• If you not logged as super-user root, You have to manualy copy the  linux-jpcsc.jar , libjpcsc.so
  files in the $JAVA_HOME/jre/lib/ext folder. (The  linux-jpcsc.jar file can be downloaded at http://signature.wallonie.be/eSign/applet/linux)

The digital signature is based on Greenwich Mean Time +0 (because it is measured from the Greenwich Meridian Line at the Royal Observatory in Greenwich.  Greenwich (England) is the place from where all time zones are measured.)

The time zone of Belgium is GMT+1 in winter, and GMT+2 in summer, the signing time will so be one hour less than local time in winter, and two in summer.

Figure 15 : Signature date and time

No, the processe does not allow to reward on any previous step once the signature process is running. If you try to go back with the "back" web browser's button, related to your prefered one: 

• with Internet Explorer you will get a forbidden message (figure n15).
• with Firefox, the buttons sign and browse will be disabled (figure n16).

Figure 16 : IE warning if you go back

Figure 17 : Disabled button on Firefox

Electronic signature's portal deals through http from port TCP 80 or https from port TCP 443. Please contact your network administrator to check that you have enough right access on signatures websites. (http://signature.test.wallonie.be ou https://signature.test.wallonie.be)

The first approach is, your name could contains an forbidden special character such as : & / # \ You should re-name it as well, then re-run the procedure of signature

Error is due to the use of forbiden special caracter (‘ / # \ … ) 

You must rename the file without these carracters then restart the signing process.

Figure 18 : unsupported file name

Please, contact the origin webmaster  that has redirect You here.

You also could report the problem to Easi-Wal commissary (portail-signature@wallonie.be). More link details are available at "Contact".

This message appears when specific carracters are used into the document.

For exemple, the five XML predifined entities must be used for the following type :

• Apostrophe

  ‘

  (')

• Double quote

  "

  (")

• Ampersand

  &

  (&)

• More than

  >

  (>)

• Less than

  <

  (&lt;)

The administrator will solve the problem by respecting the XML prdefine entities: 

- ISO-8859-1 (for West Europe) 

- UTF-8 or base64.

The calling site administrator can find more technical information in the "Calling_Site_Guide" technical document.

Figure 19 : XML which has been sent mismatch the recommanded XML language syntaxes

No, Some protected PDF couldn't be signed to PDF format .signed.pdf. It need to be sign in a .zip archive as explain in FAQ 23: How can I check wether a file is signed or not ?

No. To verify the signature of an pdf file (.signed.pdf) you have to use an pdf reader (i.e Acrobat Reader) outside of eSignBox.
(http://help.adobe.com/fr_FR/Reader/8.0/index.html - http://www.adobe.com/support/documentation/fr/reader/)

Special attention is to be taken when using Microsoft Office files. They can content macros (tiny programs) that save the file with same name, and thus breaks its signature. As the default rule, when openong such files, a warning message notify a macro potential execution and ask the user to allow it or not.

You MUST refuse their execution.

A signed but "save as" file remains readable, but has a broken and invalid signature.

When opening the signed file, You should take care to NOT save it as the same name into the signed archive .zip, unless the original file signature became invalid.

Note that is possible to backup the signed file before opening it, signature remains valid.

No, but signing process could take a while when huge file is submitted.

A progress bar will show You the the signature process state.

Signed PDF file (.signed.pdf extension) is however limited to 10MB. Over this limit, a warning message will appear (such as below).

Figure 21 : Max length exceded for a PDF

Yes You can,  signed PDF file (with .signed.pdf extension) could be over-signed. 

You however must know that previous signature will be overwritten. EsignBox only support a single signature on PDF file.

When the submitted PDF file is already signed, user will be warned about it, and should choose wether oversign it or go ahead the process with the old signature.

Figure 22 : Warning when an already signed PDF is submitted to be signed.

En cliquant sur le bouton « Test de compatibilité eID » la boite de dialogue ci-dessous s’affiche, indiquant l’état de votre configuration eID :

Figure 23 : Test de votre configuration eID

Le test de compatibilité s’arrête à la première détection de point rouge.
En cliquant sur le point rouge vous êtes redirigé vers la page FAQ dans laquelle vous trouverez les actions à faire pour que votre configuration soit compatible avec l’eID.
Pour qu’une configuration soit compatible il faut que le résultat de tous les tests soient verts et que le message « votre configuration est correcte,... » apparaisse vous invitant à continuer d’utiliser eSignBox.

Pour qu’une configuration soit compatible EsignBox , elle doit passer tous les tests de compatibilité, décrits ci-après.

Ce test permet de valider si le navigateur Web utilisé est supporté.
Pour le moment eSignBox supporte quatre navigateurs web, à savoir Internet Explorer, mozilla Firefox, Opera et Google Chrome.

eSignBox supporte la version 1.6 ou supérieur
Si la configuration java est antérieure à la 1.6 le test ne passera pas et un lien vers la faq sera affiché.

Trois types de système d’exploitation sont supportés : Windows (XP ou 7), Linux et Mac Os.

À cette étape et après avoir passé tous les autres contrôles de compatibilité, on vérifie l’existence du logiciel eID. Il s’agit du logiciel (middleware) fourni par fedict sous forme de paquet d’installation.

Pour que ce dernier test soit vert, une carte d’identité doit être inséré dans le lecteur de carte. Dans le cas où la configuration dispose de plusieurs lecteurs de carte, on vérifie si un des lecteurs contient une carte d’identité. Si oui, la configuration est considéré complètement compatible.