---
title: "Adobe Reader validation"
description: "How to set Adobe Reader to also trust the Windows roots when validating signatures, including through a GPO with a Registry change."
canonical: "https://docs.lacunasoftware.com/en-us/articles/pki-sdk/signatures/pades/adobe-validation"
locale: "en"
product: "PKI SDK"
last_updated: "2026-10-12"
---

# Adobe Reader validation

Adobe Reader is installed with a default setting that trusts only its own list of trusted root certificates. Because of that,
readers with the default setting may show signatures made with some certificates as untrusted, for instance certificates
of the ICP-Brasil V5 chain.

We usually advise users to set their readers to also accept the Windows list of root certificates. The link below has a
step-by-step guide to this setting:

[Configuring Adobe Reader to trust Windows roots for signature validation](https://docs.lacunasoftware.com/en-us/content/configuring-windows-roots-on-adobe-reader/)

To distribute this setting through a *Group Policy Object* (GPO), the *Registry* change needed is:

```ini
[HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\Security\cASPKI\cMSCAPI_DirectoryProvider]
"iMSStoreTrusted"=dword:00000060
```

[Click here](https://docs.lacunasoftware.com/en-us/content/enable-adobe-trust-on-windows-roots.zip) to get a .reg file that makes the change above.