Top Description Fields Constructors Methods
org.apache.pdfbox.examples.signature

public Class SigUtils

extends Object
Class Inheritance
Imports
java.io.ByteArrayInputStream, .IOException, .InputStream, java.net.HttpURLConnection, .URI, .URISyntaxException, .URL, java.security.GeneralSecurityException, .MessageDigest, java.security.cert.CertificateException, .CertificateParsingException, .X509Certificate, java.util.Collection, .Comparator, .Date, .HashSet, .List, .Optional, .Set, .TreeSet, org.apache.commons.logging.Log, .LogFactory, org.apache.pdfbox.cos.COSArray, .COSBase, .COSDictionary, .COSName, .COSObjectKey, org.apache.pdfbox.examples.signature.cert.CertificateVerificationException, .CertificateVerifier, org.apache.pdfbox.examples.util.ConnectedInputStream, org.apache.pdfbox.pdmodel.PDDocument, org.apache.pdfbox.pdmodel.encryption.SecurityProvider, org.apache.pdfbox.pdmodel.interactive.digitalsignature.PDSignature, org.bouncycastle.asn1.ASN1Object, org.bouncycastle.asn1.cms.Attribute, .AttributeTable, org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers, org.bouncycastle.asn1.x509.KeyPurposeId, org.bouncycastle.cert.X509CertificateHolder, org.bouncycastle.cert.jcajce.JcaX509CertificateConverter, org.bouncycastle.cms.CMSException, .CMSSignedData, .SignerInformation, .SignerInformationVerifier, org.bouncycastle.cms.jcajce.JcaSimpleSignerInfoVerifierBuilder, org.bouncycastle.operator.OperatorCreationException, org.bouncycastle.tsp.TSPException, .TimeStampToken, org.bouncycastle.util.Store
Utility class for the signature / timestamp examples.
Author
Tilman Hausherr

Field Summary

Modifier and TypeField and Description
private static final Log
LOG

Constructor Summary

AccessConstructor and Description
private
SigUtils()

Method Summary

Modifier and TypeMethod and Description
public static void
checkCertificateUsage(X509Certificate x509Certificate)

Log if the certificate is not valid for signature usage.

public static void
checkCrossReferenceTable(PDDocument
document.
doc)

Look for gaps in the cross reference table and display warnings if any found.

public static void
checkResponderCertificateUsage(X509Certificate x509Certificate)

Log if the certificate is not valid for responding.

public static void
checkTimeStampCertificateUsage(X509Certificate x509Certificate)

Log if the certificate is not valid for timestamping.

public static TimeStampToken
extractTimeStampTokenFromSignerInformation(SignerInformation signerInformation)

public static X509Certificate

Returns:

the X.509 certificate.
getCertificateFromTimeStampToken(TimeStampToken timeStampToken)

Extract X.509 certificate from a timestamp

public static PDSignature

Returns:

last signature or null when none found
getLastRelevantSignature(PDDocument
to get its last signature
document)

Gets the last relevant signature in the document, i.e. the one with the highest offset.

public static int

Returns:

the permission value. 0 means no DocMDP transform parameters dictionary exists. Other return values are 1, 2 or 3. 2 is also returned if the DocMDP transform parameters dictionary is found but did not contain a /P entry, or if the value is outside the valid range.
getMDPPermission(PDDocument
document.
doc)

Get the access permissions granted for this document in the DocMDP transform parameters dictionary.

public static X509Certificate

Returns:

the X.509 certificate.
getTsaCertificate(String
URL
tsaUrl)

Get certificate of a TSA.

public static InputStream
openURL(String urlString)

Like URL#openStream() but will follow redirection from http to https.

public static void
setMDPPermission(PDDocument
The document.
doc, PDSignature
The signature object.
signature, int
The permission value (1, 2 or 3).
accessPermissions)

Set the "modification detection and prevention" permissions granted for this document in the DocMDP transform parameters dictionary.

public static void
validateTimestampToken(TimeStampToken timeStampToken)

public static void
verifyCertificateChain(Store<X509CertificateHolder> certificatesStore, X509Certificate certFromSignedData, Date signDate)

Verify the certificate chain up to the root, including OCSP or CRL.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

LOGback to summary
private static final Log LOG

Constructor Detail

SigUtilsback to summary
private SigUtils()

Method Detail

checkCertificateUsageback to summary
public static void checkCertificateUsage(X509Certificate x509Certificate) throws CertificateParsingException

Log if the certificate is not valid for signature usage. Doing this anyway results in Adobe Reader failing to validate the PDF.

checkCrossReferenceTableback to summary
public static void checkCrossReferenceTable(PDDocument doc)

Look for gaps in the cross reference table and display warnings if any found. See also here.

Parameters
doc:PDDocument

document.

checkResponderCertificateUsageback to summary
public static void checkResponderCertificateUsage(X509Certificate x509Certificate) throws CertificateParsingException

Log if the certificate is not valid for responding.

checkTimeStampCertificateUsageback to summary
public static void checkTimeStampCertificateUsage(X509Certificate x509Certificate) throws CertificateParsingException

Log if the certificate is not valid for timestamping.

extractTimeStampTokenFromSignerInformationback to summary
public static TimeStampToken extractTimeStampTokenFromSignerInformation(SignerInformation signerInformation) throws CMSException, IOException, TSPException
getCertificateFromTimeStampTokenback to summary
public static X509Certificate getCertificateFromTimeStampToken(TimeStampToken timeStampToken) throws CertificateException

Extract X.509 certificate from a timestamp

Returns:X509Certificate

the X.509 certificate.

getLastRelevantSignatureback to summary
public static PDSignature getLastRelevantSignature(PDDocument document)

Gets the last relevant signature in the document, i.e. the one with the highest offset.

Parameters
document:PDDocument

to get its last signature

Returns:PDSignature

last signature or null when none found

getMDPPermissionback to summary
public static int getMDPPermission(PDDocument doc)

Get the access permissions granted for this document in the DocMDP transform parameters dictionary. Details are described in the table "Entries in the DocMDP transform parameters dictionary" in the PDF specification.

Parameters
doc:PDDocument

document.

Returns:int

the permission value. 0 means no DocMDP transform parameters dictionary exists. Other return values are 1, 2 or 3. 2 is also returned if the DocMDP transform parameters dictionary is found but did not contain a /P entry, or if the value is outside the valid range.

getTsaCertificateback to summary
public static X509Certificate getTsaCertificate(String tsaUrl) throws GeneralSecurityException, IOException, URISyntaxException

Get certificate of a TSA.

Parameters
tsaUrl:String

URL

Returns:X509Certificate

the X.509 certificate.

openURLback to summary
public static InputStream openURL(String urlString) throws IOException, URISyntaxException

Like URL#openStream() but will follow redirection from http to https.

setMDPPermissionback to summary
public static void setMDPPermission(PDDocument doc, PDSignature signature, int accessPermissions) throws IOException

Set the "modification detection and prevention" permissions granted for this document in the DocMDP transform parameters dictionary. Details are described in the table "Entries in the DocMDP transform parameters dictionary" in the PDF specification.

Parameters
doc:PDDocument

The document.

signature:PDSignature

The signature object.

accessPermissions:int

The permission value (1, 2 or 3).

Exceptions
IOException:
if a signature exists.
validateTimestampTokenback to summary
public static void validateTimestampToken(TimeStampToken timeStampToken) throws TSPException, CertificateException, OperatorCreationException, IOException
verifyCertificateChainback to summary
public static void verifyCertificateChain(Store<X509CertificateHolder> certificatesStore, X509Certificate certFromSignedData, Date signDate) throws CertificateVerificationException, CertificateException

Verify the certificate chain up to the root, including OCSP or CRL. However this does not test whether the root certificate is in a trusted list.

Please post bad PDF files that succeed and good PDF files that fail in PDFBOX-3017.