[BUG] NSS_Init failed: security library: bad database

[Olybo]

Describe the bug

When I try to validate a signature of a previously signed document I get Failed to validate document

To reproduce

• Go to https://your.domain.com/apps/libresign/f/validation
• Upload a document previously signed with libresign
• Get : Failed to validate document

In Nextcloud container I get a log :

NSS_Init failed: security library: bad database

Expected behavior

The document should be validated

Screenshots

Environment information

• OS : Rocky linux - Podman - Nexcloud AIO
• Browser : Firefox
• LibreSign version : Version 12.4.2
• Nexcloud Server version : Nextcloud Hub 25 Autumn (32.0.8)

Additional context

I have made an upgrade from Nextcloud 31 to Nextcloud 32.

If you need more information, I will be happy to provide it.

Thanks

[Olybo]

I tried to update to the last version available of LibreSign: 12.4.3
I get an error, but I wasn't able to read it fully or take a screenshot.
Then at reload my Nexcloud display Update needed - Please use the command line updater because automatic updating is disabled in the config.php
I have restarted the container manually.
Once nextcloud is up I checked, LibreSign is updated to 12.4.3, but the issue is the same.

[vitormattos]

Could you test your pdfsig binary with the signed pdf file that you used executing at your terminal the follow command inside your container?

pdfisg <pathToPdf>.pdf

[Olybo]

Hello @vitormattos ,
Thanks for your answer.

I style get the NSS_Init failed: security library: bad database message but then I have a lot more info.
The most interesting is that it's say Signature is valid.
However, I also get a Certificate issuer is unknown, I don't know if it is normal or not.

Here are the full output :

$ pdfsig bon_de_commande_signé.pdf
NSS_Init failed: security library: bad database.
Digital Signature Info of: bon_de_commande_signé.pdf
Signature #1:
  - Signature Field Name: Signature1
  - Signer Certificate Common Name: account:--remove-for-privacy--
  - Signer full Distinguished Name: CN="account:--remove-for-privacy--",L=--removed-for-privacy--,ST=France,C=FR
  - Signing Time: Jan 26 2026 11:45:45
  - Signing Hash Algorithm: SHA1
  - Signature Type: adbe.pkcs7.detached
  - Signed Ranges: [0 - 420373], [450375 - 469107]
  - Not total document signed
  - Signature Validation: Signature is Valid.
  - Certificate Validation: Certificate issuer is unknown.
Signature #2:
  - Signature Field Name: Signature2
  - Signer Certificate Common Name: account:--remove-for-privacy--
  - Signer full Distinguished Name: CN="account:--remove-for-privacy--",L=--removed-for-privacy--,ST=France,C=FR
  - Signing Time: Jan 26 2026 11:45:48
  - Signing Hash Algorithm: SHA1
  - Signature Type: adbe.pkcs7.detached
  - Signed Ranges: [0 - 784757], [814759 - 833398]
  - Total document signed
  - Signature Validation: Signature is Valid.
  - Certificate Validation: Certificate issuer is unknown.

I also want to add that in LibreSign Files I can see the document Signed :

But when I right-click and select Validate it says : Failed to validate document (see screenshot in my first message)

[vitormattos]

I'm thinking about removing the pdfsig dependency. It's possible to implement everything using only PHP.

About the issuer: yes, that's normal. The issuer is a private CA and therefore unknown.

Failed to validate document

That sounds like a JS issue. I reproduced it here and will look into what needs to be done.

[Olybo]

Hi @vitormattos,

Yes, it could be a front-end issue as in the GET response I get a success message :

Keep me inform. I remain available if you need more info or tests.

[vitormattos]

@Olybo, about pdfsig, I started replacing pdfsig in this PR: #7596, it's working fine so far. I created a package that provides the same functionality as pdfsig, but I’d like to run more tests before merging. I plan to validate it against an external corpus of signed PDFs to ensure compatibility with various signed documents. If you can find a good database of signed PDF documents, please share it here, that would be very helpful.

[Olybo]

@vitormattos, Great, thanks !
I know that there are datasets of human written signatures available on internet, but I am not aware about datasets of signed PDF documents.
I have found this, but it is pretty limited : https://www.tecxoft.com/samples.php I haven't tested or open these PDFs so open it with care.
Furthermore, I think it is quite hard to find publicly available datasets of signed PDF, as digital signatures contain certificate data tied to real identities. (privacy concerns obviously)

[vitormattos]

@Olybo

Yes, it could be a front-end issue as in the GET response I get a success message

Confirmed this was a problem on the JavaScript side. After we adopted strong typing on both frontend and backend and started using TypeScript, the issue was revealed. I fixed the type mismatch and updated the code to use the correct types and behavior; everything works fine now. To prevent regressions, I also added e2e regression tests.

Fixed here:

• fix: align signer email contract with API runtime behavior #7602