org.imixs.archive.signature.pdf.util

Class SigUtils

java.lang.Object

org.imixs.archive.signature.pdf.util.SigUtils

public class SigUtils
extends Object

Utility class for the signature / timestamp examples.

Author:

Tilman Hausherr

Method Summary

Modifier and Type	Method and Description
static void	checkCertificateUsage(X509Certificate x509Certificate) Log if the certificate is not valid for signature usage.
static void	checkResponderCertificateUsage(X509Certificate x509Certificate) Log if the certificate is not valid for responding.
static void	checkTimeStampCertificateUsage(X509Certificate x509Certificate) Log if the certificate is not valid for timestamping.
static org.bouncycastle.tsp.TimeStampToken	extractTimeStampTokenFromSignerInformation(org.bouncycastle.cms.SignerInformation signerInformation)
static org.apache.pdfbox.pdmodel.interactive.digitalsignature.PDSignature	getLastRelevantSignature(org.apache.pdfbox.pdmodel.PDDocument document) Gets the last relevant signature in the document, i.e. the one with the highest offset.
static int	getMDPPermission(org.apache.pdfbox.pdmodel.PDDocument doc) Get the access permissions granted for this document in the DocMDP transform parameters dictionary.
static void	setMDPPermission(org.apache.pdfbox.pdmodel.PDDocument doc, org.apache.pdfbox.pdmodel.interactive.digitalsignature.PDSignature signature, int accessPermissions) Set the "modification detection and prevention" permissions granted for this document in the DocMDP transform parameters dictionary.
static void	validateTimestampToken(org.bouncycastle.tsp.TimeStampToken timeStampToken)
static void	verifyCertificateChain(org.bouncycastle.util.Store<org.bouncycastle.cert.X509CertificateHolder> certificatesStore, X509Certificate certFromSignedData, Date signDate) Verify the certificate chain up to the root, including OCSP or CRL.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

getMDPPermission

public static int getMDPPermission(org.apache.pdfbox.pdmodel.PDDocument doc)

Get the access permissions granted for this document in the DocMDP transform parameters dictionary. Details are described in the table "Entries in the DocMDP transform parameters dictionary" in the PDF specification.

Parameters:

doc - document.

Returns:

the permission value. 0 means no DocMDP transform parameters dictionary exists. Other return values are 1, 2 or 3. 2 is also returned if the DocMDP transform parameters dictionary is found but did not contain a /P entry, or if the value is outside the valid range.

setMDPPermission

public static void setMDPPermission(org.apache.pdfbox.pdmodel.PDDocument doc,
                                    org.apache.pdfbox.pdmodel.interactive.digitalsignature.PDSignature signature,
                                    int accessPermissions)
                             throws IOException

Set the "modification detection and prevention" permissions granted for this document in the DocMDP transform parameters dictionary. Details are described in the table "Entries in the DocMDP transform parameters dictionary" in the PDF specification.

Parameters:

doc - The document.

signature - The signature object.

accessPermissions - The permission value (1, 2 or 3).

Throws:

IOException - if a signature exists.

checkCertificateUsage

public static void checkCertificateUsage(X509Certificate x509Certificate)
                                  throws CertificateParsingException

Log if the certificate is not valid for signature usage. Doing this anyway results in Adobe Reader failing to validate the PDF.

Parameters:

x509Certificate -

Throws:

CertificateParsingException

checkTimeStampCertificateUsage

public static void checkTimeStampCertificateUsage(X509Certificate x509Certificate)
                                           throws CertificateParsingException

Log if the certificate is not valid for timestamping.

Parameters:

x509Certificate -

Throws:

CertificateParsingException

checkResponderCertificateUsage

public static void checkResponderCertificateUsage(X509Certificate x509Certificate)
                                           throws CertificateParsingException

Log if the certificate is not valid for responding.

Parameters:

x509Certificate -

Throws:

CertificateParsingException

getLastRelevantSignature

public static org.apache.pdfbox.pdmodel.interactive.digitalsignature.PDSignature getLastRelevantSignature(org.apache.pdfbox.pdmodel.PDDocument document)
                                                                                                   throws IOException

Gets the last relevant signature in the document, i.e. the one with the highest offset.

Parameters:

document - to get its last signature

Returns:

last signature or null when none found

Throws:

IOException

extractTimeStampTokenFromSignerInformation

public static org.bouncycastle.tsp.TimeStampToken extractTimeStampTokenFromSignerInformation(org.bouncycastle.cms.SignerInformation signerInformation)
                                                                                      throws org.bouncycastle.cms.CMSException,
                                                                                             IOException,
                                                                                             org.bouncycastle.tsp.TSPException

Throws:

org.bouncycastle.cms.CMSException

IOException

org.bouncycastle.tsp.TSPException

validateTimestampToken

public static void validateTimestampToken(org.bouncycastle.tsp.TimeStampToken timeStampToken)
                                   throws org.bouncycastle.tsp.TSPException,
                                          CertificateException,
                                          org.bouncycastle.operator.OperatorCreationException,
                                          IOException

Throws:

org.bouncycastle.tsp.TSPException

CertificateException

org.bouncycastle.operator.OperatorCreationException

IOException

verifyCertificateChain

public static void verifyCertificateChain(org.bouncycastle.util.Store<org.bouncycastle.cert.X509CertificateHolder> certificatesStore,
                                          X509Certificate certFromSignedData,
                                          Date signDate)
                                   throws CertificateVerificationException,
                                          CertificateException

Verify the certificate chain up to the root, including OCSP or CRL. However this does not test whether the root certificate is in a trusted list.

Please post bad PDF files that succeed and good PDF files that fail in PDFBOX-3017.

Parameters:

certificatesStore -

certFromSignedData -

signDate -

Throws:

CertificateVerificationException

CertificateException