Wunder Sign Documentation

Introduction

Wunder Sign is a desktop application for Windows and macOS that enables secure digital signing of patent documents using SmartCards. This documentation is intended for IT administrators and technical staff at law firms and IP departments.

Key Features

• Native SmartCard integration (PKCS#11)
• Support for D-Trust and LuxTrust qualified certificates
• Batch PDF signing with progress tracking
• UPC Opt-Out form generation and submission
• Session-based workflow management
• Automatic updates via enterprise-ready update server

System Requirements

Hardware Requirements

• USB SmartCard reader
• Qualified signature card (D-Trust or LuxTrust)
• 4GB RAM minimum (8GB recommended)
• 500MB available disk space

Installation

Download the latest version from the product page or use the direct download links below.

Windows Installation

1. Download Wunder.Sign-x.x.x.exe from the download page
2. Run the installer with administrator privileges
3. Follow the installation wizard
4. Launch Wunder Sign from the Start Menu

Silent Installation (Enterprise)

For automated deployment via SCCM, Intune, or GPO:

Wunder.Sign-1.23.0.exe /S /D=C:\Program Files\Wunder Sign

Parameters:

• /S - Silent mode (no UI)
• /D=<path> - Installation directory (must be last parameter)

macOS Installation

1. Download Wunder.Sign-x.x.x-arm64.dmg (Apple Silicon) or Wunder.Sign-x.x.x.dmg (Intel)
2. Open the DMG file
3. Drag Wunder Sign to your Applications folder
4. Launch from Applications or Spotlight

SmartCard Configuration

Wunder Sign supports SmartCard readers and certificates via the PKCS#11 standard.

Supported Certificates

Wunder Sign currently supports the following qualified signature certificates:

D-Trust Card Authentication

D-Trust cards (especially version 5.1 and 5.4) use a multi-step authentication process:

CAN (Card Access Number)

The CAN is a 6-digit number printed on the physical card. It is used to establish a secure PACE (Password Authenticated Connection Establishment) channel between the card and reader. The CAN is handled automatically by the cryptovision scInterface middleware popup when the card is inserted.

PIN Types for D-Trust Cards

LuxTrust Card Authentication

LuxTrust cards use standard single-PIN authentication but require the SafeNet/ClassicClient middleware to be installed.

PKCS#11 Middleware Installation

Windows

D-Trust Cards:

1. Download and install the D-Trust PKI Client (sc/interface 8.2.8 or later) from D-Trust
2. The PKCS#11 library will be installed to:

- C:\Windows\System32\cvP11.dll (cryptovision) - C:\Windows\System32\DTRUST_PKI_PKCS11.dll

LuxTrust Cards:

1. Download and install the LuxTrust SmartCard Middleware
2. The PKCS#11 library will be installed to:

- C:\Program Files\LuxTrust\SmartCardMiddleware\ltpkcs11.dll - C:\Program Files (x86)\LuxTrust\SmartCardMiddleware\ltpkcs11.dll

macOS

D-Trust Cards:

1. Download and install the cryptovision sc/interface (8.2.8 or later) from D-Trust
2. The PKCS#11 library will be installed to:

- /Library/cv cryptovision/libcvP11.dylib

LuxTrust Cards:

1. Install the SafeNet/ClassicClient package
2. The PKCS#11 library will be installed to:

- /usr/local/lib/ClassicClient/libgclib.dylib - /usr/local/lib/pkcs11/libgclib.dylib

PKCS#11 Library Paths Reference

Middleware Configuration

Wunder Sign supports selecting the middleware type in Settings:

CSV File Format

Wunder Sign uses CSV (Comma-Separated Values) files to batch-process multiple patents for opt-out filings. This section explains how to prepare your CSV file correctly.

Quick Start

Download the CSV template from within Wunder Sign (File → Open CSV Template) or create a file with the following structure:

Reference number,Internal reference,Patent Status,Applicant Name,Applicant Address,Applicant Email,Designated States
EP1234567,P-001,Granted,Example AG,Sample str. 42,info@example.com,"DE, FR, IT"
EP7654321,P-002,pending,Another Corp,Main Road 123,contact@another.com,"AL, AT, BE, BG"

Column Reference

Patent Status Field

The Patent Status field is critical as it determines which section of the opt-out document gets filled:

Visual Difference in Generated PDFs

When Patent Status = pending / filed / Application:

• The PATENT APPLICATION DETAILS section shows:

- Publication number of the patent application - Designated countries/All EPC states - Applicant name, address, and email

• The EUROPEAN PATENT DETAILS section remains empty

When Patent Status = granted / Granted (or any other value):

• The PATENT APPLICATION DETAILS section remains empty

• The EUROPEAN PATENT DETAILS section shows:

- Publication number of the European Patent - Country abbreviations for granted states - Proprietor name (Applicant), address, and email

Designated States Format

The Designated States field should contain a comma-separated list of two-letter EPC country codes.

Valid Examples:

DE, FR, IT
"AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LI, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR"
DE,FR,IT

Supported EPC States: AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LI, LT, LU, LV, MC, ME, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR

Reference Number Format

The Reference number must be a valid European patent or application number.

Valid Formats:

• EP1234567 - Standard format (recommended)
• EP 1234567 - With space
• 1234567 - Number only (EP prefix will be assumed)

Complete CSV Example

Here's a complete example showing different patent statuses:

Reference number,Internal reference,Patent Status,Applicant Name,Applicant Address,Applicant Email,Designated States
EP1111111,REF-001,granted,Acme Corporation,"123 Example Street, 10115 Berlin, Germany",patents@acme-example.test,"AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LI, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR"
EP2222222,REF-002,pending,Globex Industries,"456 Innovation Avenue, 75001 Paris, France",legal@globex-example.test,"DE, FR, IT, ES"
EP3333333,REF-003,Granted,Initech GmbH,"789 Tech Park, 1010 Vienna, Austria",ip@initech-example.test,"GB, DE, FR, NL, BE"
EP4444444,REF-004,filed,Umbrella Labs AG,"101 Research Road, 8001 Zürich, Switzerland",contact@umbrella-example.test,"CH, DE, AT"

CSV for Withdrawal Sessions

When creating a withdrawal (opt-in) session, include the Opt-Out Case Number column with the existing case number you want to withdraw:

Reference number,Internal reference,Patent Status,Applicant Name,Applicant Address,Applicant Email,Designated States,Opt-Out Case Number
EP1234567,P-001,Granted,Example AG,Sample str. 42,info@example.com,"DE, FR, IT",590000/2024

Common Mistakes to Avoid

Preparing CSV from Excel

When exporting from Microsoft Excel:

1. Select File → Save As
2. Choose CSV UTF-8 (Comma delimited) (*.csv) as the format
3. Click Save

Preparing CSV from Google Sheets

1. Select File → Download → Comma Separated Values (.csv)
2. The file will be downloaded in UTF-8 encoding automatically

UPC Integration

Wunder Sign integrates with the Unified Patent Court (UPC) Case Management System for automated opt-out filings.

UPC Portal Requirements

To use the UPC integration, you need:

1. UPC Portal Account: Register at the UPC CMS Portal
2. API Credentials: Username and password for the A2A (Application-to-Application) API
3. Network Access: Outbound HTTPS access to UPC endpoints

UPC Environments

UPC Filing Workflow

1. Generate Opt-Out PDF: Wunder Sign generates the opt-out form with patent and proprietor details
2. Sign with SmartCard: The PDF is digitally signed using your qualified certificate
3. Submit to UPC: The signed document is submitted via the UPC A2A API
4. Track Status: Monitor submission status (ACCEPTED → PROCESSING → PROCESSED)
5. Download Receipt: Retrieve the official UPC receipt once processed

UPC Document Requirements

• Format: PDF (application/pdf)
• Signature: Qualified electronic signature (QES) with valid certificate
• Language: English (en), German (de), or French (fr)
• Patent Number Format: EP followed by 7 digits (e.g., EP1234567)

Network Configuration

Wunder Sign requires network access to communicate with the Wunder API, UPC services, and receive updates.

Required Endpoints

Firewall Rules

For enterprise firewall configurations, allow outbound HTTPS (443) to the endpoints listed above.

Signature Details

Wunder Sign creates PDF signatures according to industry standards.

Signature Format

Supported Key Types

Auto-Update API

Wunder Sign includes an enterprise-ready auto-update system compatible with electron-updater.

Update Server Endpoints

YAML Manifest Format

The update manifests follow the electron-builder format:

version: 1.23.0
files:
  - url: Wunder.Sign-1.23.0.exe
    sha512: <base64-encoded-sha512>
    size: 98765432
path: Wunder.Sign-1.23.0.exe
sha512: <base64-encoded-sha512>
releaseDate: '2024-12-09T10:30:00.000Z'

Self-Hosted Update Server

For air-gapped environments, you can host your own update server:

1. Mirror the release assets to your internal server
2. Configure the YAML manifests with your server URLs
3. Update the electron-updater config in your deployment:

{
  "publish": {
    "provider": "generic",
    "url": "https://your-internal-server.com/updates"
  }
}

Enterprise Deployment (baramundi, SCCM, Intune)

This section provides comprehensive guidance for deploying Wunder Sign via enterprise management tools such as baramundi, Microsoft SCCM, Intune, and similar platforms.

Quick Reference

Download Links

Download the latest version from the WunderIP release server:

• MSI Installer (Recommended): Wunder Sign-{version}.msi
• EXE Installer: Wunder Sign Setup {version}.exe

Contact WunderIP for access to the download portal.

MSI Installation (Recommended for Enterprise)

The MSI installer is optimized for enterprise deployment tools.

Basic Silent Install

msiexec /i "Wunder Sign-2.0.0.msi" /qn ALLUSERS=1

Silent Install with Logging

msiexec /i "Wunder Sign-2.0.0.msi" /qn ALLUSERS=1 /L*v "C:\Logs\wundersign-install.log"

Install Parameters

Installation Path: C:\Program Files\Wunder Sign\

EXE Installer (NSIS)

For manual installations or when MSI is not suitable.

Silent Install

"Wunder Sign Setup 2.0.0.exe" /S /AllUsers

Install to Custom Directory

"Wunder Sign Setup 2.0.0.exe" /S /AllUsers /D=D:\Apps\WunderSign

Uninstallation

MSI Uninstall

By MSI File:

msiexec /x "Wunder Sign-2.0.0.msi" /qn

By Product Code:

msiexec /x {PRODUCT-GUID} /qn

To find the Product Code:

Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Wunder Sign*" } | Select-Object Name, IdentifyingNumber

With Logging:

msiexec /x "Wunder Sign-2.0.0.msi" /qn /L*v "C:\Logs\wundersign-uninstall.log"

EXE Uninstall

"C:\Program Files\Wunder Sign\Uninstall Wunder Sign.exe" /S

Complete Removal (Including User Data)

After uninstallation, remove user data and settings:

# Remove application data for all users
Get-ChildItem "C:\Users\*\AppData\Roaming\Wunder Sign" -ErrorAction SilentlyContinue | Remove-Item -Recurse -Force

# Remove registry settings
reg delete "HKLM\SOFTWARE\WunderIP\Wunder Sign" /f 2>nul

Update Management

Option 1: IT-Managed Updates (Recommended)

Disable auto-updates and deploy new versions via your management tool:

1. Disable Auto-Updates (during initial deployment or via GPO):

``bash reg add "HKLM\SOFTWARE\WunderIP\Wunder Sign" /v DisableAutoUpdate /t REG_DWORD /d 1 /f ``

1. Deploy Updates using the standard MSI install command. The installer handles upgrades automatically.

1. Subscribe to Release Notifications: Contact WunderIP to receive email notifications for new releases.

Option 2: Automatic Updates

By default, Wunder Sign checks for updates on startup and installs them automatically. This is suitable for smaller deployments without centralized management.

Upgrade Process

MSI upgrades are handled automatically:

msiexec /i "Wunder Sign-2.1.0.msi" /qn ALLUSERS=1

The installer will:

1. Detect the existing installation
2. Preserve user settings
3. Upgrade to the new version

Registry Configuration

Pre-configure Wunder Sign settings via Windows Registry. These settings can be deployed via Group Policy, baramundi Registry Jobs, or login scripts.

Registry Path

HKEY_LOCAL_MACHINE\SOFTWARE\WunderIP\Wunder Sign

Available Settings

Configuration Commands

Disable Auto-Updates:

reg add "HKLM\SOFTWARE\WunderIP\Wunder Sign" /v DisableAutoUpdate /t REG_DWORD /d 1 /f

Set Default Language to German:

reg add "HKLM\SOFTWARE\WunderIP\Wunder Sign" /v DefaultLanguage /t REG_SZ /d "de" /f

Remove All Custom Settings:

reg delete "HKLM\SOFTWARE\WunderIP\Wunder Sign" /f

Environment Variable Alternative

Auto-updates can also be disabled via environment variable:

setx WUNDER_SIGN_DISABLE_UPDATE 1 /M

Smartcard Driver Deployment

Wunder Sign requires smartcard drivers to be installed before the application.

LuxTrust Cards

1. Download LuxTrust Middleware from the LuxTrust portal
2. Install silently:

``bash msiexec /i "LuxTrust_Middleware.msi" /qn ``

1. Expected driver path: C:\Program Files\LuxTrust\LuxTrust Middleware\pkcs11\p11Lux64.dll

D-Trust Cards

1. Download D-Trust Card Assistant 5 / sc/interface (8.2.8+) from D-Trust
2. Install silently (refer to D-Trust documentation)
3. Expected driver path: C:\Program Files\D-Trust GmbH\D-TRUST Card Assistant 5\bin\dkck201564.dll

Deployment Order

1. Deploy smartcard driver
2. Deploy Wunder Sign
3. (Optional) Deploy registry configuration

baramundi Job Examples

Job: Install Wunder Sign

Job Type: Software Installation

Job: Uninstall Wunder Sign

Job Type: Software Uninstallation

Job: Configure Auto-Update Disable

Job Type: Registry

Complete Deployment Sequence

1. Job 1: Install LuxTrust/D-Trust Middleware
2. Job 2: Install Wunder Sign
3. Job 3: Configure Registry Settings (disable auto-update, set language)

Installation Troubleshooting

Common MSI Error Codes

Verify Smartcard Driver Installation

# LuxTrust
Test-Path "C:\Program Files\LuxTrust\LuxTrust Middleware\pkcs11\p11Lux64.dll"

# D-Trust
Test-Path "C:\Program Files\D-Trust GmbH\D-TRUST Card Assistant 5\bin\dkck201564.dll"

Check Smartcard Service

sc query SCardSvr

Log Files for Enterprise Deployment

Collecting Logs for Support

# Create support bundle
$supportDir = "C:\Temp\WunderSign-Support"
New-Item -ItemType Directory -Path $supportDir -Force

# Copy application logs
Copy-Item "$env:APPDATA\Wunder Sign\logs\*" $supportDir -ErrorAction SilentlyContinue

# Get system info
systeminfo > "$supportDir\systeminfo.txt"

# Get installed software
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Wunder*" -or $_.Name -like "*LuxTrust*" -or $_.Name -like "*D-Trust*" } | Out-File "$supportDir\software.txt"

# Create ZIP
Compress-Archive -Path $supportDir -DestinationPath "C:\Temp\WunderSign-Support.zip"

Troubleshooting

Common issues and their solutions.

SmartCard Not Detected

Symptoms: "No SmartCard reader found" or "No certificate detected"

Solutions:

1. Ensure the reader is properly connected (try different USB port)
2. Check Device Manager (Windows) or System Information (macOS) for the reader
3. Verify the correct PKCS#11 middleware is installed for your card type
4. Check the middleware type in Settings matches your card

PKCS#11 Error Codes: | Code | Name | Cause | | --- | --- | --- | | 6 | CKR_FUNCTION_FAILED | Card not ready or communication issue | | 48 | CKR_DEVICE_ERROR | Hardware communication problem | | 224 | CKR_TOKEN_NOT_RECOGNIZED | Wrong driver for this card type |

Certificate PIN Errors

Symptoms: "Invalid PIN" or "PIN blocked"

Solutions:

1. Verify you're entering the correct PIN
2. For D-Trust 5.x cards: ensure you're using the right PIN type (Card PIN vs Signature PIN)
3. Check remaining PIN attempts (usually 3 before lockout)
4. If blocked, contact your certificate provider for PUK unlock

PIN Error Codes: | Code | Name | Solution | | --- | --- | --- | | 160 | CKR_PIN_INCORRECT | Wrong PIN entered | | 161 | CKR_PIN_LOCKED | PIN blocked, requires PUK | | 162 | CKR_PIN_INVALID | PIN format invalid | | 165 | CKR_PIN_LEN_RANGE | PIN length outside valid range |

D-Trust CAN Issues

Symptoms: scInterface popup appears repeatedly or CAN errors

Solutions:

1. Verify the 6-digit CAN printed on your physical card
2. Ensure the cryptovision sc/interface middleware is installed
3. The CAN popup is normal for D-Trust 5.x cards on first use per session
4. If CAN is rejected, check you're reading the correct number from the card

Log Locations

Application logs are stored at:

# Windows
%APPDATA%\Wunder Sign\logs\

# macOS
~/Library/Logs/Wunder Sign/

Security Considerations

Certificate Security

• Private keys never leave the SmartCard
• All cryptographic operations are performed on the card hardware
• PIN is transmitted securely via PKCS#11

Excluded Virtual Cards

Wunder Sign automatically filters out virtual/software SmartCards to ensure only hardware-based signatures are used:

• DATEV virtual cards
• Windows Virtual Smart Card
• Microsoft virtual readers

Support

For technical support, contact us at hello@wunder-ip.com or visit the Contact page.

Useful Links

• Product Page - Download latest version
• Contact - Get in touch with our team
• Trust Center - Security and compliance information