This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
7 Westferry Circus ● Canary Wharf ● London E14 4HB ● United Kingdom
Verification and Certificates ........................................................................ 6
How to digitally sign an EMA PDF Form ..................................................... 23
General Questions ..................................................................................... 25
Contact us ................................................................................................. 26
EMA eSignature capabilities: frequently asked questions relating to practical and
technical aspects of the implementation
EMA/264709/2013 Page 3/26
Objectives of the EMA eSignature Capabilities
1) What are the European Medicines Agency’s eSignature capabilities?
The EMA’s eSignature capabilities enable the EMA to send digitally signed electronic documents (PDF)
to industry. The EMA also have the capacity to verify digital signatures embedded in digitally signed
electronic documents (PDF).
The EMA’s capabilities are in line with the EMA’s strategy for a future electronic only workflow.
These capabilities enable the secure archiving of legally binding digitally signed documents in a more
efficient manner and they reduce the requirement to sign and archive paper documents.
2) Which types of documents can be sent with a digital signature?
The EMA accept digital signatures in portable document format (PDF) electronic documents.
3) Who is the eSignature solution for?
Currently, the EMA’s eSignature capabilities are restricted to electronic documents for Scientific Advice,
Orphan Medicines and Paediatric submissions between EMA and the pharmaceutical industry.
4) How do I send a digitally signed document to the EMA?
You should send digitally signed documents via your usual submission channel e.g. email or Eudralink.
Registration Process
5) Do companies need to register to access EMA’s eSignature capabilities?
There is no registration requirement to send or receive digitally signed documents.
Business process
6) Who should digitally sign a document on behalf of a company?
The signatory of a digitally signed document should be the person authorised to fulfil this role within
the company.
7) What do I do if I cannot provide a digital signature on an EMA PDF electronic document?
You can complete the necessary document, sign it using wet-ink and scan and send it to the EMA via
email or EudraLink. Alternatively you may send the signed document via courier.
8) Does the EMA accept only digitally signed documents?
No, the use of digital signatures is not yet mandatory.
9) How do I know my digitally signed document has been successfully received?
Digitally signed documents will be dealt with in accordance to existing business processes and
therefore no additional notification of receipt will be provided.
EMA eSignature capabilities: frequently asked questions relating to practical and
technical aspects of the implementation
EMA/264709/2013 Page 4/26
10) Will digitally signed documents submitted to the EMA go through a different process?
All digitally signed documents received by the EMA will be handled in line with current processes.
11) Do we need to digitally sign applications for all procedure types? Updated September 2013
No, the Agency provides specific PDF certified electronic application forms in the areas of Scientific Advice, Orphan
Medicines and Paediatric Medicines for industry to digitally sign and submit using a PDF Reader Application. Details
of the available forms can be found here.
Technical Questions
12) When should I involve my organisation’s IT colleagues in the configuration of the eSignature solution?
Please engage with your technical colleagues from the outset. It is advisable to obtain technical
support with the configuration.
13) Are all types of PDF software supported?
We have successfully tested the solution using Adobe Reader, however the EMA’s eSignature solution
is designed to be compatible with other PDF compliant applications.
14) When I try to open one of the EMA PDF forms with my web browser, I see a message on screen indicating that my web browser cannot open the PDF. Why does this occur? Updated September 2013
Please save the PDF in a suitable location and open it with your chosen PDF reader. Depending on the browser you use and the way in which your computer has been configured, the
message you see on screen may differ. If you are using Firefox you might see the message below:
If you are using internet explorer you might see the following:
EMA eSignature capabilities: frequently asked questions relating to practical and
technical aspects of the implementation
EMA/264709/2013 Page 18/26
Figure 15.
3. Scroll down the list in the left hand panel and select “Signatures”.
4. Under the section “Identities & Trusted Certificates” click “More”.
EMA eSignature capabilities: frequently asked questions relating to practical and
technical aspects of the implementation
EMA/264709/2013 Page 19/26
Figure 16.
5. Click “Trusted Certificates”.
6. Sort by “Certificate Issuer”.
7. Look down the list for “Adobe Root CA”. Select it.
EMA eSignature capabilities: frequently asked questions relating to practical and
technical aspects of the implementation
EMA/264709/2013 Page 20/26
Figure 17.
8. Confirm that the details in the bottom panel match the following:
Adobe Root CA
Adobe Systems Incorporated
Issued by: Adobe Root CA
Adobe Systems Incorporated
Valid from: 2003.01.08 23:37:23 Z
Valid to: 2023.01.09 00:07:23 Z
Intended usage: Sign certificate (CA), Sign CRL
9. If the settings match click close. If not continue to Step 10.
10. Click “Edit Trust”.
EMA eSignature capabilities: frequently asked questions relating to practical and
technical aspects of the implementation
EMA/264709/2013 Page 21/26
Figure 18.
11. Make sure the following options are ticked on this screen:
a) Use this certificate as a trusted root
b) Signed document or data
c) Certified documents
12. Click “OK”.
13. You have now completed the steps to update an imported certificate’s trust permissions.
EMA eSignature capabilities: frequently asked questions relating to practical and
technical aspects of the implementation
EMA/264709/2013 Page 22/26
27) Do you have suggestions on how FNMT Root Certification Authority Certificates can be dispersed company-wide rather than each person, in that organisation, downloading these certificates and importing them into their workstations individually? Updated October 2013
EMA recommends that you request either your security operations or IT operations department to
download the three FNMT certificates from the EMA website and import them into your organisation’s
directories. Your IT operations department will need to configure the PDF reader application on your
workstations to validate the certificate chain, associated with the digital signature, using certificates
maintained in relevant directories. An alternative configuration would be to disperse the certificates
automatically to workstations in your organisation using a Client Management Tool. The certificate
dispersal policy and implementation will very much depend upon the security policies of your
organisation and the configuration of your organisation’s IT infrastructure.
28) How do I know if there is a problem with the verification of a digital signature?
1. Look out for alerts in the Blue Certification notification bar across the top of the PDF display panel.
The alerts that indicate a problem are shown below:
a) User action required to validate a signature field on the form
b) The form Certification is valid but the recipient signature cannot be validated
c) The recipient signature field on the form is valid but the Certification is not valid
d) The document Certification and recipient signature are not valid /cannot be validated.
e) Either the document Certification or Recipient Signature Field is Invalid.
f) All signatures on the form are valid
2. Signature Panel - Certification Field
a) Status unknown
b) Invalid
EMA eSignature capabilities: frequently asked questions relating to practical and
technical aspects of the implementation
EMA/264709/2013 Page 23/26
c) Valid
3. Signature Panel – Recipient Signature Field
a) Status Unknown
b) Signature has Problems
c) Invalid
d) Valid
29) What do I do if I cannot verify a digital signature that is embedded in an EMA document?