https://bugs.documentfoundation.org/show_bug.cgi?id=159612
--- Comment #7 from Kyle Fortin <[email protected]> --- Root cause on Windows (LibreOffice 26.8.1 / xmlsec 1.3.12; also 26.2.6 and 7.6.7): signing silently loops back to the certificate chooser when the signing certificate's issuer DN is UTF8String-encoded. xmlsec's mscng backend finds the private key by re-encoding the X509IssuerName with CertStrToName(), which yields PrintableString for ASCII text, and CERT_FIND_SUBJECT_CERT compares encodings byte for byte, so the store certificate is never found; xmlsec falls back to the key-less embedded copy and xmlSecDSigCtxSign fails with KEY_NOT_FOUND. DigitalSignaturesDialog::AddButtonHdlImpl then re-opens the chooser without reporting the error. Certificates whose issuer uses PrintableString sign fine (tested with software keys and a PIV smart card). Upstream xmlsec report: https://github.com/lsh123/xmlsec/issues/1381 Two LibreOffice-side improvements would help users regardless: 1. Show an error instead of silently re-opening the chooser when GetSignatureInformation(nSecurityId).nStatus is not OPERATION_SUCCEEDED 2. Keep xmlsec's error text (currently only in SAL_WARN that is compiled out of release builds). -- You are receiving this mail because: You are the assignee for the bug.
