Did this really
come from askFinz?

The name proves nothing. The fingerprint does.

Comparing is enough. Installing is optional.

Steps one to three answer the question completely, and we would rather you stopped there. Step four is a convenience — it turns the warning into our name on every future document — and it is not free, so it carries its own note.

1. Open the document and click the certification bar at the top.
2. Choose Signature Properties, then Show Signer’s Certificate.
3. On the Details tab, compare the SHA-256 fingerprint with the one above. If it matches, the document is ours and unaltered. If it does not, stop — and please tell us.
4. Optional. To have future documents verify without this check, open Trust → Add to Trusted Certificates and tick Use this certificate as a trusted root.

Installing it, platform by platform.

This puts the certificate in your operating system’s own store. It is worth knowing what that does and does not change: Acrobat keeps a trust list of its own on every platform, so the four steps above are still what turns its banner green. What an OS install gets you is everything else — the built-in viewers, and anything you check from a shell.

& {
  $fp  = "2DAC9A5E90FE667F5EAE0262BAFBC61E856FCFA7DEEE6900661F9E4FD749F7DF"
  $crt = "$env:USERPROFILE/Downloads/askfinz-document-signing.crt"
  Invoke-WebRequest https://askfinz.com/askfinz-document-signing.crt -OutFile $crt

  $c = New-Object Security.Cryptography.X509Certificates.X509Certificate2 $crt
  if ($c.GetCertHashString("SHA256") -ne $fp) {
    Remove-Item $crt
    Write-Host "STOPPED - fingerprint did not match. Nothing installed." -Fore Red
    return
  }

  Import-Certificate -FilePath $crt -CertStoreLocation Cert:\CurrentUser\Root | Out-Null
  Write-Host "Installed. SHA-256 now trusted:" -Fore Green
  Get-ChildItem Cert:\CurrentUser\Root |
    Where-Object Subject -like "*askFinz*" |
    ForEach-Object { $_.GetCertHashString("SHA256") }
}

(
  set -e
  fp="2D:AC:9A:5E:90:FE:66:7F:5E:AE:02:62:BA:FB:C6:1E:85:6F:CF:A7:DE:EE:69:00:66:1F:9E:4F:D7:49:F7:DF"
  crt="$HOME/Downloads/askfinz-document-signing.crt"
  curl -fsSL https://askfinz.com/askfinz-document-signing.crt -o "$crt"

  openssl x509 -in "$crt" -noout -fingerprint -sha256 | grep -q "$fp" || {
    rm -f "$crt"
    echo "STOPPED - fingerprint did not match. Nothing installed."; exit 1
  }

  # Keychain will ask you to confirm
  security add-trusted-cert -r trustRoot \
    -k "$HOME/Library/Keychains/login.keychain-db" "$crt"
  echo "Installed:"
  security find-certificate -c "askFinz Document Signing" | head -4
)

(
  set -e
  fp="2D:AC:9A:5E:90:FE:66:7F:5E:AE:02:62:BA:FB:C6:1E:85:6F:CF:A7:DE:EE:69:00:66:1F:9E:4F:D7:49:F7:DF"
  crt="$HOME/askfinz-document-signing.crt"
  curl -fsSL https://askfinz.com/askfinz-document-signing.crt -o "$crt"

  openssl x509 -in "$crt" -noout -fingerprint -sha256 | grep -q "$fp" || {
    rm -f "$crt"
    echo "STOPPED - fingerprint did not match. Nothing installed."; exit 1
  }

  # Okular and Evince validate through NSS, not the system bundle
  mkdir -p "$HOME/.pki/nssdb"
  certutil -d sql:"$HOME/.pki/nssdb" -A -t "C,," \
    -n "askFinz Document Signing" -i "$crt"
  echo "Installed:"
  certutil -d sql:"$HOME/.pki/nssdb" -L | grep askFinz
)

Everything above installs for your user alone, which is the right scope for a certificate you are trusting on your own judgement — the one exception is the second Linux command, which writes to the system bundle and says so. To undo any of them, remove the same entry. The note about revocation applies here too: if you ever hear from us that the fingerprint has changed, remove the old one first.

On a work laptop it may not stick. We watched this happen on a machine joined to a company directory and managed centrally: the certificate installed, reported itself correctly, and had been removed from every store again a few minutes later. Managed devices routinely clear root certificates their owner did not authorise, and that is your employer’s policy working as intended rather than anything going wrong here. If it vanishes, comparing the fingerprint still answers the question perfectly well — which is the better habit anyway.

If you would rather not use a reader.

Every issued copy is served with its SHA-256 in an x-askFinz-Sha256 response header, and the same value is recorded against the copy on our side.

# the file you hold
shasum -a 256 askFinz-deck-long-<id>.pdf

# the certificate this page publishes
openssl x509 -in askfinz-document-signing.crt -noout -fingerprint -sha256

# the same fingerprint, from DNS rather than from this page
dig +short TXT _docsign.askfinz.com