Top Description Fields Constructors Methods
org.apache.pdfbox.examples.signature.validation

public Class AddValidationInformation

extends Object
Class Inheritance
Imports
java.io.File, .FileNotFoundException, .FileOutputStream, .IOException, .OutputStream, java.net.URISyntaxException, java.security.GeneralSecurityException, .MessageDigest, .NoSuchAlgorithmException, .Security, java.security.cert.CertificateEncodingException, .X509CRL, .X509Certificate, java.util.Calendar, .HashMap, .HashSet, .Map, .Set, org.apache.commons.logging.Log, .LogFactory, org.apache.pdfbox.Loader, org.apache.pdfbox.cos.COSArray, .COSBase, .COSDictionary, .COSName, .COSStream, .COSUpdateInfo, org.apache.pdfbox.examples.signature.SigUtils, org.apache.pdfbox.examples.signature.cert.CRLVerifier, .CertificateVerificationException, .OcspHelper, .RevokedCertificateException, org.apache.pdfbox.examples.signature.validation.CertInformationCollector.CertSignatureInformation, org.apache.pdfbox.pdmodel.PDDocument, .PDDocumentCatalog, org.apache.pdfbox.pdmodel.encryption.SecurityProvider, org.apache.pdfbox.pdmodel.interactive.digitalsignature.PDSignature, org.apache.pdfbox.util.Hex, org.bouncycastle.asn1.BEROctetString, org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers, org.bouncycastle.cert.ocsp.BasicOCSPResp, .OCSPException, .OCSPResp, org.bouncycastle.cms.CMSException, .CMSSignedData, org.bouncycastle.tsp.TSPException, .TimeStampToken, .TimeStampTokenInfo
An example for adding Validation Information to a signed PDF, inspired by ETSI TS 102 778-4 V1.1.2 (2009-12), Part 4: PAdES Long Term - PAdES-LTV Profile. This procedure appends the Validation Information of the last signature (more precise its signer(s)) to a copy of the document. The signature and the signed data will not be touched and stay valid.

See also Bachelor thesis (in German) about LTV

Author
Alexis Suter

Field Summary

Modifier and TypeField and Description
private CertInformationCollector
certInformationHelper

private final Map<X509Certificate, COSStream>
certMap

private COSArray
certs

private COSArray
correspondingCRLs

private COSArray
correspondingOCSPs

private COSArray
crls

private PDDocument
document

private final Set<X509Certificate>
foundRevocationInformation

private static final Log
LOG

private final Set<X509Certificate>
ocspChecked

private COSArray
ocsps

private Calendar
signDate

private COSDictionary
vriBase

Constructor Summary

AccessConstructor and Description
public
AddValidationInformation()

Method Summary

Modifier and TypeMethod and Description
private void
addAllCertsToCertArray()

Adds all certs to the certs-array.

private void
addCrlRevocationInfo(CertInformationCollector.CertSignatureInformation
the certificate info, for it to check CRL data.
certInfo)

Fetches and adds CRL data to storage for the given Certificate.

private void
addExtensions(PDDocumentCatalog
to add Extensions into
catalog)

Adds Extensions to the document catalog.

private void
addOcspData(CertInformationCollector.CertSignatureInformation
the certificate info, for it to check OCSP data.
certInfo)

Fetches and adds OCSP data to storage for the given Certificate.

private void
addOcspData(X509Certificate certificate, X509Certificate issuerCertificate, String ocspURL)

private void
addRevocationData(CertInformationCollector.CertSignatureInformation
Certificate information from CertInformationHelper containing certificate chains.
certInfo)

Fetches and adds revocation information based on the certInfo to the DSS.

private void
addRevocationDataRecursive(CertInformationCollector.CertSignatureInformation
from which to fetch revocation data. Will work recursively through its chains.
certInfo)

Tries to get Revocation Data (first OCSP, else CRL) from the given Certificate Chain.

private void
doValidation(String
in file to extract signature
filename, OutputStream
where to write the changed document
output)

Fetches certificate information from the last signature of the document and appends a DSS with the validation information to the document.

private void
fetchCrlData(CertInformationCollector.CertSignatureInformation
the certificate info, for it to check CRL data.
certInfo)

Tries to fetch and add CRL Data to its containers.

private boolean

Returns:

true when the OCSP data has successfully been fetched and added
fetchOcspData(CertInformationCollector.CertSignatureInformation
the certificate info, for it to check OCSP data.
certInfo)

Tries to fetch and add OCSP Data to its containers.

private static <T extends COSBase & COSUpdateInfo> T

Returns:

a Element of given class, new or existing
getOrCreateDictionaryEntry(Class<T>
the class of the dictionary entry, must implement COSUpdateInfo
clazz, COSDictionary
where to find the element
parent, String
of the element
name)

Gets or creates a dictionary entry.

public static void
main(String[] args)

private void
updateVRI(CertInformationCollector.CertSignatureInformation certInfo, COSDictionary vri)

private static void
usage()

public void
validateSignature(File
input PDF file
inFile, File
output PDF file
outFile)

Signs the given PDF file.

private COSStream

Returns:

COSStream a COSStream object that can be added to the document
writeDataToStream(byte[]
to write into the COSStream
data)

Creates a Flate encoded COSStream object with the given data.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

certInformationHelperback to summary
private CertInformationCollector certInformationHelper
certMapback to summary
private final Map<X509Certificate, COSStream> certMap
certsback to summary
private COSArray certs
correspondingCRLsback to summary
private COSArray correspondingCRLs
correspondingOCSPsback to summary
private COSArray correspondingOCSPs
crlsback to summary
private COSArray crls
documentback to summary
private PDDocument document
foundRevocationInformationback to summary
private final Set<X509Certificate> foundRevocationInformation
LOGback to summary
private static final Log LOG
ocspCheckedback to summary
private final Set<X509Certificate> ocspChecked
ocspsback to summary
private COSArray ocsps
signDateback to summary
private Calendar signDate
vriBaseback to summary
private COSDictionary vriBase

Constructor Detail

AddValidationInformationback to summary
public AddValidationInformation()

Method Detail

addAllCertsToCertArrayback to summary
private void addAllCertsToCertArray() throws IOException

Adds all certs to the certs-array. Make sure that all certificates are inside the certificateStore of certInformationHelper. This should be the only call to fill certs.

addCrlRevocationInfoback to summary
private void addCrlRevocationInfo(CertInformationCollector.CertSignatureInformation certInfo) throws IOException, RevokedCertificateException, GeneralSecurityException, CertificateVerificationException, URISyntaxException

Fetches and adds CRL data to storage for the given Certificate.

Parameters
certInfo:CertInformationCollector.CertSignatureInformation

the certificate info, for it to check CRL data.

addExtensionsback to summary
private void addExtensions(PDDocumentCatalog catalog)

Adds Extensions to the document catalog. So that the use of DSS is identified. Described in PAdES Part 4, Chapter 4.4.

Parameters
catalog:PDDocumentCatalog

to add Extensions into

addOcspDataback to summary
private void addOcspData(CertInformationCollector.CertSignatureInformation certInfo) throws IOException, OCSPException, CertificateProccessingException, RevokedCertificateException, URISyntaxException

Fetches and adds OCSP data to storage for the given Certificate.

Parameters
certInfo:CertInformationCollector.CertSignatureInformation

the certificate info, for it to check OCSP data.

addOcspDataback to summary
private void addOcspData(X509Certificate certificate, X509Certificate issuerCertificate, String ocspURL) throws IOException, OCSPException, CertificateProccessingException, RevokedCertificateException, URISyntaxException
addRevocationDataback to summary
private void addRevocationData(CertInformationCollector.CertSignatureInformation certInfo) throws IOException

Fetches and adds revocation information based on the certInfo to the DSS.

Parameters
certInfo:CertInformationCollector.CertSignatureInformation

Certificate information from CertInformationHelper containing certificate chains.

addRevocationDataRecursiveback to summary
private void addRevocationDataRecursive(CertInformationCollector.CertSignatureInformation certInfo) throws IOException

Tries to get Revocation Data (first OCSP, else CRL) from the given Certificate Chain.

Parameters
certInfo:CertInformationCollector.CertSignatureInformation

from which to fetch revocation data. Will work recursively through its chains.

Exceptions
IOException:
when failed to fetch an revocation data.
doValidationback to summary
private void doValidation(String filename, OutputStream output) throws IOException

Fetches certificate information from the last signature of the document and appends a DSS with the validation information to the document.

Parameters
filename:String

in file to extract signature

output:OutputStream

where to write the changed document

fetchCrlDataback to summary
private void fetchCrlData(CertInformationCollector.CertSignatureInformation certInfo) throws IOException

Tries to fetch and add CRL Data to its containers.

Parameters
certInfo:CertInformationCollector.CertSignatureInformation

the certificate info, for it to check CRL data.

Exceptions
IOException:
when failed to fetch, because no validation data could be fetched for data.
fetchOcspDataback to summary
private boolean fetchOcspData(CertInformationCollector.CertSignatureInformation certInfo) throws IOException

Tries to fetch and add OCSP Data to its containers.

Parameters
certInfo:CertInformationCollector.CertSignatureInformation

the certificate info, for it to check OCSP data.

Returns:boolean

true when the OCSP data has successfully been fetched and added

Exceptions
IOException:
when Certificate is revoked.
getOrCreateDictionaryEntryback to summary
private static <T extends COSBase & COSUpdateInfo> T getOrCreateDictionaryEntry(Class<T> clazz, COSDictionary parent, String name) throws IOException

Gets or creates a dictionary entry. If existing checks for the type and sets need to be updated.

Parameters
clazz:Class<T>

the class of the dictionary entry, must implement COSUpdateInfo

parent:COSDictionary

where to find the element

name:String

of the element

Returns:T

a Element of given class, new or existing

Exceptions
IOException:
when the type of the element is wrong
mainback to summary
public static void main(String[] args) throws IOException
updateVRIback to summary
private void updateVRI(CertInformationCollector.CertSignatureInformation certInfo, COSDictionary vri) throws IOException
usageback to summary
private static void usage()
validateSignatureback to summary
public void validateSignature(File inFile, File outFile) throws IOException

Signs the given PDF file.

Parameters
inFile:File

input PDF file

outFile:File

output PDF file

Exceptions
IOException:
if the input file could not be read
writeDataToStreamback to summary
private COSStream writeDataToStream(byte[] data) throws IOException

Creates a Flate encoded COSStream object with the given data.

Parameters
data:byte[]

to write into the COSStream

Returns:COSStream

COSStream a COSStream object that can be added to the document