iText PDF 批准和认证签名

Question

我正在使用 iText 进行 PDF 签名。

我的 PDF 表单有 3 个签名域。前两个字段用于批准签名，最后一个字段用于认证签名。认证签名总是在批准签名之后签名，并且所有签名的追加模式都设置为 true。

我的问题是在签署证书签名后(证书级别设置为 CERTIFIED_NO_CHANGES_ALLOWED)，在验证证书签名时，已验证的批准签名将失效。

我应该如何解决这个问题？

Answer 1

Certification signature is always signed after the approval signatures

这是不允许的。

PDF 规范 ISO 32000-1表示

The signature dictionary of a certification signature shall be the value of a signature field and shall contain a ByteRange entry. It may also be referenced from the DocMDP entry in the permissions dictionary (see 12.8.4, “Permissions”). The signature dictionary shall contain a signature reference dictionary (see Table 253) that has a DocMDP transform method.

(section 12.8.1 Digital Signatures / General)

The DocMDP transform method shall be used to detect modifications relative to a signature field that is signed by the author of a document (the person applying the first signature). A document can contain only one signature field that contains a DocMDP transform method; it shall be the first signed field in the document. It enables the author to specify what changes shall be permitted to be made the document and what changes invalidate the author’s signature.

(section 12.8.2.2.1 Digital Signatures / Transform Methods / DocMDP / General)

即证书签名具有 DocMDP 转换方法，并且具有 DocMDP 转换方法的签名必须是文档中第一个签名的签名。

不过，如果您对 PDF2 功能没问题，那么您尝试实现的目标可能是可行的，请参见。布鲁诺的白皮书Digital Signatures for PDF documents第 2.5.5 节 在签名后锁定字段和文档:

Since PDF 1.5, it’s possible to lock specific fields when signing a document. In PDF 2.0, there will be a new feature that allows you to define the document-level permissions that are already available for certification signatures, but now also for approval signatures.

有关详细信息(超出此处答案的范围)，请阅读该部分...