Internal certification center for documents and 1C?

Question

1C

In a fairly large organization, 1C Document Management is being introduced. The management wants to use an electronic signature (it is not yet clear how).

Accordingly, for this task, a domain was deployed from 0 (the task stood for a long time - there was a reason). Installed a certificate authority. Works, issues certificates to domain users.

Question: how to sign documents?
We installed VipNet CSP (it's free), looked at the instructions, everything should work according to it, in fact - we realized that the certificate service does not start, there is no root certificate when we select the Infotecs cryptoprovaider role when installing.

Maybe there are other ways to use self-issued certificates?
Maybe 1C can simply take certificate data from the registry storage, and all our attempts are unnecessary?

PS
Here we did not receive explicit wishes from the management, therefore we are working on two issues -
1) 1C signs inside itself and
2) sign files separately by the crypto provider and put them in 1C.

Answer 1

1. 1C TO, you can pick up free certificates. See the description of the connection on the ITS.
https://infostart.ru/public/449016/
2. Why a certificate, password entry already has user verification. The rest rests on the internal regulations of the EDF, which is written there.
https://forum.mista.ru/topic.php?id=784359
https://habr.com/ru/company/cybersafe/blog/247019/

Answer 2

You need to start with the most tramp question - is the CA root certificate set as the root certificate on the 1C server? In Windows, everything is connected through and through with each other, and it is quite possible that it checks the validity of a stupid request to the system, and the system does not see the root and returns "the certificate is not valid."
Using your own CA is still cybersex, especially the topic of certificate validity :)