java - 使用 java api 和 epass2003 token 的 pdf 数字签名

Question

我正在尝试使用 java api 向 pdf 添加数字签名，并且签名由 epass2003 token 读取。所以，我在这里完成了这项工作(将数字签名添加到 pdf)，它工作正常，但是当我在另一个系统中打开这个 pdf 文档时它显示“至少一个签名有问题”，但在我的系统中正确验证签名请帮助我。我在下面附上了我的代码，请找到它。

 public class Test {
    public static void main(String args[]) throws IOException, GeneralSecurityException, DocumentException, CertificateVerificationException{
    // Create instance of SunPKCS11 provider

    String userFile = "C:/results/test.pdf";
    String userFile_signed = "C:/results/test_signed.pdf";

    String pkcs11Config = "name=eToken\nlibrary=C:\\Windows\\System32\\eps2003csp11.dll";
    java.io.ByteArrayInputStream pkcs11ConfigStream = new java.io.ByteArrayInputStream(pkcs11Config.getBytes());
    sun.security.pkcs11.SunPKCS11 providerPKCS11 = new sun.security.pkcs11.SunPKCS11(pkcs11ConfigStream);
    java.security.Security.addProvider(providerPKCS11);

    // Get provider KeyStore and login with PIN
    String pin = "12345678";
    java.security.KeyStore keyStore = java.security.KeyStore.getInstance("PKCS11", providerPKCS11);
    keyStore.load(null, pin.toCharArray());

    // Enumerate items (certificates and private keys) in the KeyStore
    java.util.Enumeration<String> aliases = keyStore.aliases();
    String alias = null;
    while (aliases.hasMoreElements()) {
        alias = aliases.nextElement();
        System.out.println(alias);
    }

     PrivateKey pk = (PrivateKey)keyStore.getKey(alias, "12345678".toCharArray());
        Certificate[] chain = keyStore.getCertificateChain(alias);
        OcspClient ocspClient = new OcspClientBouncyCastle();
        TSAClient tsaClient = null;
        for (int i = 0; i < chain.length; i++) {
            X509Certificate cert = (X509Certificate)chain[i];
            String tsaUrl = CertificateUtil.getTSAURL(cert);
            if (tsaUrl != null) {
                tsaClient = new TSAClientBouncyCastle(tsaUrl);
                break;
            }
        }
        List<CrlClient> crlList = new ArrayList<CrlClient>();
        crlList.add(new CrlClientOnline(chain));
        Test t = new Test();
        t.sign(userFile, userFile_signed, chain, pk, DigestAlgorithms.SHA256, providerPKCS11.getName(),
                     CryptoStandard.CMS, "Test", "Signature", crlList, ocspClient, tsaClient, 0);
}
public void sign(String src, String dest,
        Certificate[] chain, PrivateKey pk,
        String digestAlgorithm, String provider, CryptoStandard subfilter,
        String reason, String location,
        Collection<CrlClient> crlList,
        OcspClient ocspClient,
        TSAClient tsaClient,
        int estimatedSize)
                throws GeneralSecurityException, IOException, DocumentException {
    // Creating the reader and the stamper
    PdfReader reader = new PdfReader(src);
    FileOutputStream os = new FileOutputStream(dest);
    PdfStamper stamper = PdfStamper.createSignature(reader, os, '\0');
    // Creating the appearance
    PdfSignatureAppearance appearance = stamper.getSignatureAppearance();
    appearance.setReason(reason);
    appearance.setLocation(location);
    appearance.setVisibleSignature(new Rectangle(100, 100, 200, 200), 1, "sig");
    // Creating the signature
    ExternalSignature pks = new PrivateKeySignature(pk, digestAlgorithm, provider);
    ExternalDigest digest = new BouncyCastleDigest();
    MakeSignature.signDetached(appearance, digest, pks, chain, crlList, ocspClient, tsaClient, estimatedSize, subfilter);
}
}

上面是我的代码，请帮助我。

Answer 1

查看签名属性可以看到:

这个对话框说明了问题:

The signer's identity is unknown because it has not been included in your list of trusted certificates and none of its parent certificates are trusted certificates.

进一步查看签名者的证书显示:

因此，您的代码仅嵌入签名者证书本身，而不是其证书路径(否则它们会显示在证书查看器窗口中)。不幸的是，颁发者证书(RCAI 2 类 2014 的 SafeScrypt 子 CA)不是立即受信任的，该证书的颁发者(SafeScrypt CA 2014)也不是，但该证书的颁发者(CCA India 2014)反过来是。

很可能在您的计算机上，整个证书链是已知的，或者至少是明确信任的证书。

要在其他只知道根证书的计算机上获得相同的效果，只需将“RCAI 2 类 2014 的 SafeScrypt 子 CA”和“SafeScrypt CA 2014”的证书添加到您的 Certificate[] 链.