QES-QSCD (EN)
- Eivin Peter Hansen
- May-Britt Eikemo
QCeSeal on eToken (QCSD) for production of Qualified Electronic Seal
Norsk: QES-QSCD (NO)
Getting Started
Congratulations on purchasing the Buypass Qualified Certificate for electronic Seal (QCeSeal) issued to your organization.
As soon as you have finished the installation, you can generate a qualified electronic seal on any PDF document from an ordinary office PC, on behalf of the organization.
Below you will find guidance on how to set up your device, how to use it for sealing and verification, important information regarding security, as well as tips if errors occur.
For more help, contact Buypass Customer Services.
What is a Qualified Electronic Seal?
An “electronic seal” is similar to a digital signature representing your organization/company, instad of you as a physical person. Many EU based recipients of formal documents such as agreements, declarations etc. require the document to be sealed with a Qualified Electronic Seal.
To be able to create a Qualified Electronic Seal it is required to have a Qualified Certificate for electronic Seal AND a Qualified Signature Creation Device (QSCD).
Distribution of certificate and PIN code (Norway)
After ordering a Buypass qualified certificate for electronic seal on QSCD, Buypass generate the necessary certificates and install them on a USB-based eToken ( the QSCD).
Personal attendance at Norwegian Postal service:
The device is sent in a separate shipment that requires attendance at Posten with personal ID verification (PUM).
Separate letter with PIN and PUK code:
The 6-digit PIN code and PUK code are received in a separate letter from Buypass to the person appointed as recipient..
Installation Microsoft users
To add a qualified electronic seal to a document, you need to use a document application. Most recipients require a PDF document, and the most commonly used application is Adobe Acrobat.
Insert the eToken into the USB port of the computer to be used.
Install the necessary drivers for Safenet Minidriver ( See “Drivers Installation” section)
Configure Adobe Acrobat (or other document application) (See “Setting up PDF Reader” section)
Driver Installation
Download the lastest driver file (.zip) from SafeNet Minidriver (thalesgroup.com)
Open the file/folder. If necessary, clarify with your system administrator about any restrictions for downloading .zip files.
Select the folder /MSI and the package for either 64-bit or 32-bit operating system (contact your system administrator if you are not familiar with which options to choose)
Select SafeNet-Minidriver Windows Installer Package (it should be the only file in this folder) and follow the instructions.
We recommend restarting the PC to activate the eToken driver after completing the installation.
Problems during/after installation :
Contact your system administrator for help.
Contact Buypass Kundeservice for more detailed assistance.
Setting up PDF reader (Acrobat DC)
Acrobat Reader DC (PRO) is the most common used application for PDF based document management, and referred to in this description. If you do not have Adobe Acrobat DC , go to Adobe: Creative, marketing and document management solutions , download the application and follow the instructions for installation or contact your system administrator for advice on editing PDF documents.
The certificate on the eToken will appear in the certificate list in Adobe automatically. You can verify this by:
Open Acrobat Reader application.
Select: Edit>Preferences>Signatures
Select “Identities and Trusted Certificates Settings” and verify that your company name is on the list (in example shown below the company name is “Test AS”).
Sealing a document
Acrobat Reader DC is the most widely used application for PDF based document management and the one used in this description.
Open the PDF document to be sealed.
Select the icon “Certificates” in the Tools menu
In the certificates menu select “Certify (Visible Signature)”
Select Certify or Digital Signature
Place the signature frame where you want it to be visible in the document. You will be asked to choose which certificate to sign with.
Select the certificate with the name of your business.
Enter the PIN associated with the certificate. You find this on the code letter received from Buypass.
The document has been sealed and is ready to be distributed.
Verifying a sealed document
You can also use Adobe Acrobat Reader to verify that a document is sealed with a qualified electronic seal.
Open the document in Acrobat Reader or similar application. (We have used Acrobat Reader in our example.)
Verify that the blue line show a green validation symbol and the text : Signed and all signatures are valid. (Note that the application uses the term “Signature” and not “Seal”. This is common description.
Select the pen-symbol in the left menu and expand the line showing signature/seal information.
Verify that the text: This is a Qualified Electronic Seal according to EU regulation 910/2014 Is shown. This confirm that the document is sealed with a Qualified Electronic Seal.
Security and Safety
Your USB eToken is an advanced HW device containing a digital certificate that represents your organization/company in the same way as delegated signature and power of attorney rights for the organization/company and must therefore be stored securely. We recommend you to keep your eToken in a safe place, when not in use.
The supplied PIN and PUK codes must also be kept in a safe place apart from the eToken to avoid accidental use. Please note that Buypass does not store a copy of the PIN/PUK codes. If lost you will not be able to re-produce the electronic seal or codes.
We recommend that you only share access to the eToken and the PIN code with authorized personnel.
The USB device is free of malware when distributed by Buypass AS. Since the device is delivered in a secure and controlled channel, the risk of malware is also minimal.
The certificate has a lifetime of 3 years. After the certificate's expiry date, the device and the certificate can be discarded. There is no information on the device that could harm your business. Safe disposal is not required, but always recommended.
We recommend that you note the date of receiving your QC eSeal Token on the box to keep track of the expiry date.
The recipient of the document can not find the organization number or claims that this is a mistake in the format: Buypass uses international/EU standards for certificates and the company's identity is in the format: NTRNO-XXXXXXXX which is in the field Subject: under certificate details.
The PDF SW cannot find the certificate: If you have installed other certificates on your computer (locally on your HD or on a smartcard or similar, the driver may have precedence to the driver for this eToken. Contact your systems administrator.
Adobe is running protected mode and cannot show the certificate: un-select protected mode and restart Adobe Reader DC.
The driver is not downloaded: Download driver SafeNet Minidriver 10.8 R6 (Post GA)
My computer has NETid driver installed: Your NETid driver will take precedence from the eToken driver and in most instances wil this work. If the Certificate is not visible You need to remove two registry settings related to NETid. Start Regedit.exe as Administrator and delete the following two keys:
\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\SmartCards\Acc Net iD - GPK 34
\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Calais\SmartCards\Acc Net iD - GPK 34