Foxhound PKI — proof of concept

TEST SERVICE. Certificates here chain to a simulated national root, not the Communications Authority of Kenya. They carry no legal effect. Do not trust them on production machines.

Verify a signed PDF

  1. Download the test root rca-sim.crt and the issuing CA foxhound-test-issuing.crt. Make sure this page shows a padlock (https://): the root is the one certificate nothing else vouches for, so get it only over a secure connection.
  2. Before trusting it, compare the root's SHA-256 fingerprint with the published value. Windows: double-click the file → Details → Thumbprint shows SHA-1, so use certutil -hashfile rca-sim.crt SHA256 instead.
  3. Windows / Word: install the root for the whole computer (certlm.msc → Trusted Root Certification Authorities → Import, as administrator). A root in the per-user store may be ignored.
  4. In Adobe Acrobat: Preferences → Signatures → Identities & Trusted Certificates → Trusted Certificates → Import, select the root, tick Use this certificate as a trusted root.
  5. Open the PDF. Acrobat checks revocation online and reads the embedded timestamp.

Service endpoints

These addresses are written into every certificate and are served over plain http:// on purpose: their content is signed, and Windows and Acrobat expect HTTP for revocation checks.