title: Import root CA to MS Office
body: <p>I've use Apache POI and my certificate to digitally sign a .docx document:</p>
  <pre><code>@Override
  public byte[] sign(byte[] content, List&lt;X509Certificate&gt; certChain, PrivateKey privateKey) throws Exception {
      OPCPackage pkg = OPCPackage.open(new ByteArrayInputStream(content));
  
      SignatureConfig signatureConfig = new SignatureConfig();
      signatureConfig.setKey(privateKey);
      signatureConfig.setSigningCertificateChain(certChain);
      signatureConfig.setOpcPackage(pkg);
  
      ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
      SignatureInfo si = new SignatureInfo();
      si.setSignatureConfig(signatureConfig);
      si.confirmSignature();
      pkg.save(outputStream);
  
      IOUtils.closeQuietly(pkg);
      return outputStream.toByteArray();
  }
  </code></pre>
  <p>certChain contains my certificate and a self-signed certificate (root CA) that is used to sign my certificate (the root CA is the issuer of my certificate). This code run perfectly and a get signed .docx file. But when I open it by Microsoft Word 2016, I get this message:</p>
  <p><a href="https://i.stack.imgur.com/PQscX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/PQscX.png" alt="Enter image description here" /></a></p>
  <p><a href="https://i.stack.imgur.com/HgiZB.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/HgiZB.png" alt="Enter image description here" /></a></p>
  <p>I also sign PDF content with Apache PDFBox and when I open a signed PDF file by Acrobat Reader, I get similar issue, but it's easily to solve by adding root CA to the list of <em>Trusted certificates</em> inside Acrobat Reader. But in Microsoft Office, I can not see any similar option. How can I get MS Office to trust the root CA (or at least trust my certificate)?</p>