iO Electronic signature

1. Configuration of the electronic certificate

Before you can use the electronic signature module, you must have a device seal, in collaboration with the Ministère de la Justice du Québec (MJQ). This device seal certifies the reliability and veracity of the electronic signature. To do so, you must follow several steps :

1.1 Getting the electronic certificate

1. Contact the Department of Justice Certification Service via email to request the seal system for Constellio;
2. The certification service of the Ministry of Justice will answer you by detailing the steps to follow to obtain the device seal (forms to fill in, levels of trust and different types of certificates, cost of the certificate etc.); 
   Test certificate

   It is possible to obtain a 3-month trial certificate.
3. Appoint a manager to be the guarantor of the electronic certificate. This person will be invited by an identity verification officer to perform an identity verification;
4. After completing all the necessary steps, you will receive the seal (CGPI certificate).

1.2 Certificate conversion

After receiving the ICPG certificate, you need to create a Java Keystore (.jks file) from it. Several steps are to be followed:

1.  Installation of the Keystore Explorer;
2.  Installation of the software Entrust Entelligence Security Provider from this web portal; 
3. Enter the authentication information;
   1. Access path (chemin d'accès) : provide the file .epf
   2. Passeword (mot de passe) : the one of the file .epf

1.3 Actions on the software Entrust

1.  Double-click on the .epf file. A window will open, enter the password of the .epf file and press the "OK" button; 
2. Start Entrust Certificate Explorer. Right-click on the verification certificate, then select "Export Certificate ..."; 
3. If the Entrust window appears, re-enter the password for the .epf file; 
4. Click on the "Next" button; 
5. Choose the option "Yes, export the private key" and then "Next"; 
6. Choose "Personal Information Exchange-PKCS #12 (.PFX)" then check the boxes "Include all certificates in the certification path if possible" and "Enable certificate privacy". Press the "Next" button;
7. Enter a password of your choice, which will be used to import the .pfx file into the Keystore. In encryption choose "TripleDES-SHA1". Press the "Next" button; 
8. Choose the location where the .pfx file will be saved, press the "Next" button; 
9. Click on the "Finish" button. 

1.4 Actions on the software Keystore Explorer

1. Start Keystore Explorer. Click on "file" -> "New ..." . Choose JKS as the type of Keystore and press the "OK" button; 
2. Click on "Tools" -> "Import Key Pair"; 
3. Choose the "PKCS #12" type, click on the "OK" button; 
4. Enter the password created in the previous section (step 7), then choose the .pfx file whose location was chosen in the previous section (step 8). Click on the "import" button; 
5. Choose an Alias referring to the organization for which the Keystore is created; 
6. Enter a new password. Click on the "OK" button; 
7. Click on "File" -> "Save" and choose the location where the Keystore will be placed. This is the file that will be uploaded into Constellio's driver; 
8. Use the same password created in step 6, this is the password that should be entered in the Constellio driver; 
9. Save on the hard disk with a .jks extension (e.g.: keystore_my_organization.jks).

2. Electronic signature

The electronic signature is a feature that allows Constellio users to apply their signature and/or initials to documents as well as certify them. In addition, the plugin also allows you to generate a signature URL to send to external users. 

2.1 Prerequisites

To enable all signature functions, make sure that the following configurations are completed: 

1. The electronic signature plugin (eSignature) is installed (in Administration->Progress Management);
2. The signing certificate has been configured (in Administration -> Configuration -> Signing Certificate);
3. The configuration for the email server is completed (in Management of email servers);
4. The " Start Signature " option is enabled for roles (in Role management);
5. The user who wants to make a signature request has a role with the " Request a signature " option. 

2.2 Actions in the viewer

Two new actions are available in the Constellio viewer: 

1.  Certify: Certify the signatures applied to the document.
2. Sign: Apply a signature or initials.
3. Predefined signature area: Prepare a signature area.
4. Text box: Apply a text box.
   Actions in viewer - Electronic signature
    

2.2.1 Certify

When one or more signatures are applied, it is possible to certify them. This applies the certificate configured in the server to the document to prove the source of the signature. A new version of the document is then generated by making the signatures immutable and automatically converting the document to PDF format.

Configuration

In order to certify a document, a signing certificate must be configured on the server. It is possible to add this certificate through the configuration page. Control -> Configuration -> Signing Certificate and Signing Certificate Password.  

2.2.2 Sign

When the user presses the Sign button, the user can apply a signature or apply initials, and then he must determine the area where his signature will be applied. If it is the first signature, several choices are offered to him. 

Signature and initials

Three options are available when adding a signature or initials.

1. Type a signature or initials. A calligraphic font is used.
2. Draw a signature or initials.
3. Upload a signature or initials.

2.3 Predefined signature area

When the user presses the button to predefine a signature area, their cursor changes to allow them to draw the predefined area. After affixing it, the internal or external user can press it to select his signature or initials which are then automatically framed in the box. The signature or initials can then be resized or moved if desired.

Predefined Signature Area - Electronic Signature

 

2.4 Signature request