验证 PDF 是否使用 iText 进行数字签名

Question

正如标题所说，我想知道给定的 PDF 文件是否已经过数字签名。

我使用 iText 对其进行了签名，但我无法知道它是否已经签名以最终退出或执行其他操作。

有没有办法简单地做到这一点（可能使用 iText）？

Answer 1

使用 iText：

PdfReader reader = new PdfReader(...);
AcroFields acroFields = reader.getAcroFields();
List<String> signatureNames = acroFields.getSignatureNames();

现在signatureNames 包含所有包含签名的可达签名字段的名称，参见。 JavaDoc：

/**
 * Gets the field names that have signatures and are signed.
 *
 * @return the field names that have signatures and are signed
 */
public ArrayList<String> getSignatureNames()

Answer 2

这里有一个例子

    public static final String verifSign(PdfReader pdfReader)
{
    KeyStore kall = PdfPKCS7.loadCacertsKeyStore();
    AcroFields acroFields = pdfReader.getAcroFields();
    List<String> signatureNames = acroFields.getSignatureNames();
    if (signatureNames.isEmpty())
    {
        return ("El documento no tiene ni una firma registrada");
    }
    for(String name : signatureNames)
    {
        if (!acroFields.signatureCoversWholeDocument(name))
        {
            return ("la firma: "+name+" does not covers the whole document.");
        }
        PdfPKCS7 pk = acroFields.verifySignature(name);
        Certificate[] certificates = pk.getCertificates();
        Calendar cal = pk.getSignDate();
        //System.out.println("Document modified: " + !pk.verify());
        Object fails[] = PdfPKCS7.verifyCertificates(certificates, kall, null, cal);
        if (fails == null)
        {
            // Documento PDF firmado correctamente
        }
        else
        {
            return ("Firma no válida");
        }
    }
    // Todo firmado correctamente
    return null;

}

http://www.berthou.com/us/2009/07/01/verify-pdf-signature-with-itext/

Answer 3

如果您使用较新的 iText 版本，如 5.5.x，这里有一个完整的工作示例，您可以如何检查数字签名的 PDF（自 2.1.7 版以来，iText 已经进行了许多有用的开发和更改）：

import com.itextpdf.text.pdf.AcroFields;
import com.itextpdf.text.pdf.PdfReader;
import com.itextpdf.text.pdf.security.PdfPKCS7;
import java.io.IOException;
import java.io.InputStream;
import java.security.GeneralSecurityException;
import java.security.Principal;
import java.security.cert.X509Certificate;
import java.util.Calendar;
import java.util.List;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

public class DigitalSignatureCheck {

    private static final Logger LOGGER = LoggerFactory.getLogger(DigitalSignatureCheck.class);

    public static final boolean verifySignature(PdfReader pdfReader)
            throws GeneralSecurityException, IOException {
        boolean valid = false;
        AcroFields acroFields = pdfReader.getAcroFields();
        List<String> signatureNames = acroFields.getSignatureNames();
        if (!signatureNames.isEmpty()) {
            for (String name : signatureNames) {
                if (acroFields.signatureCoversWholeDocument(name)) {
                    PdfPKCS7 pkcs7 = acroFields.verifySignature(name);
                    valid = pkcs7.verify();
                    String reason = pkcs7.getReason();
                    Calendar signedAt = pkcs7.getSignDate();
                    X509Certificate signingCertificate = pkcs7.getSigningCertificate();
                    Principal issuerDN = signingCertificate.getIssuerDN();
                    Principal subjectDN = signingCertificate.getSubjectDN();
                    LOGGER.info("valid = {}, date = {}, reason = '{}', issuer = '{}', subject = '{}'",
                            valid, signedAt.getTime(), reason, issuerDN, subjectDN);
                    break;
                }
            }
        }
        return valid;
    }

    private static void validate(String name)
            throws IOException, GeneralSecurityException {
        InputStream is = DigitalSignatureCheck.class.getClassLoader()
                         .getResourceAsStream(name);
        PdfReader reader = new PdfReader(is);
        boolean ok = verifySignature(reader);
        LOGGER.info("'{}' is {}signed", name, ok ? "" : "NOT ");
    }

    public static void main(String[] args) throws Exception {
        validate("any.pdf"); // if placed in resources' root
    }
}

使用LOGGER只是为了显示结果。

Answer 4

我有类似的问题，但我使用的是 itext 7 并且没有

PdfReader reader = new PdfReader(...);
AcroFields acroFields = reader.getAcroFields();

在当前版本中。

所以我使用了这个解决方案[更新]

private boolean hasSignatures(final PdfDocument pdfDocument) {
    final List<String> signatureNames = new SignatureUtil(pdfDocument).getSignatureNames();
    return !signatureNames.isEmpty();
}