Example usage for com.itextpdf.text.pdf.security PdfPKCS7 getCertificates

List of usage examples for com.itextpdf.text.pdf.security PdfPKCS7 getCertificates

  1. HOME
  2. Java
  3. com.itextpdf
  4. com.itextpdf.text.pdf.security.*
  5. PdfPKCS7
  6. getCertificates

Introduction

In this page you can find the example usage for com.itextpdf.text.pdf.security PdfPKCS7 getCertificates.

Prototype

public Certificate[] getCertificates()

Source Link

Document

Get all the X.509 certificates associated with this PKCS#7 object in no particular order.

Usage

From source file:controller.CCInstance.java

License:Open Source License

public final ArrayList<SignatureValidation> validatePDF(final String file, final ValidationListener vl)
        throws IOException, DocumentException, GeneralSecurityException {
    this.validating = true;

    final PdfReader reader = new PdfReader(file);
    final AcroFields af = reader.getAcroFields();
    final ArrayList names = af.getSignatureNames();
    final ArrayList<SignatureValidation> validateList = new ArrayList<>();
    X509Certificate x509c = null;

    Security.setProperty("ocsp.enable", "true");
    System.setProperty("com.sun.security.enableCRLDP", "true");

    boolean nextValid = true;

    for (Object o : names) {
        if (!validating) {
            return null;
        }/*from w  ww . java  2s. c  o  m*/

        final String name = (String) o;
        final PdfPKCS7 pk = af.verifySignature(name, "BC");
        final Certificate pkc[] = pk.getCertificates();
        x509c = (X509Certificate) pkc[pkc.length - 1];

        final Certificate[] aL = pkc;//getCompleteCertificateChain(x509c);

        if (null == aL || 0 == aL.length) {
            return null;
        }

        CertificateStatus ocspCertificateStatus = CertificateStatus.UNCHECKED;

        BasicOCSPResp ocspResp = pk.getOcsp();
        if (null != ocspResp && pk.isRevocationValid()) {
            for (SingleResp singleResp : ocspResp.getResponses()) {
                if (null == singleResp.getCertStatus()) {
                    ocspCertificateStatus = CertificateStatus.OK;
                } else if (singleResp.getCertStatus() instanceof RevokedStatus) {
                    if (ocspResp.getProducedAt()
                            .before(((RevokedStatus) singleResp.getCertStatus()).getRevocationTime())) {
                        ocspCertificateStatus = CertificateStatus.OK;
                    } else {
                        ocspCertificateStatus = CertificateStatus.REVOKED;
                    }
                } else if (singleResp.getCertStatus() instanceof UnknownStatus) {
                    ocspCertificateStatus = CertificateStatus.UNKNOWN;
                }
            }
        }

        CertificateStatus crlCertificateStatus = CertificateStatus.UNCHECKED;
        Collection<CRL> crlResp = pk.getCRLs();
        if (null != crlResp) {
            boolean revoked = false;
            for (CRL crl : crlResp) {
                if (crl.isRevoked(x509c)) {
                    revoked = true;
                }
            }
            crlCertificateStatus = revoked ? CertificateStatus.REVOKED : CertificateStatus.OK;
        }

        if (ocspCertificateStatus.equals(CertificateStatus.UNCHECKED)
                && crlCertificateStatus.equals(CertificateStatus.UNCHECKED)) {
            if (pkc.length == 1) {
                Certificate[] completeChain = getCompleteTrustedCertificateChain(x509c);
                if (completeChain.length == 1) {
                    ocspCertificateStatus = CertificateStatus.UNCHAINED;
                } else {
                    ocspCertificateStatus = CertificateStatus.CHAINED_LOCALLY;
                }
            }
        }

        final TimeStampToken tst = pk.getTimeStampToken();
        boolean validTimestamp = false;
        if (null != tst) {
            final boolean hasTimestamp = pk.verifyTimestampImprint();
            validTimestamp = hasTimestamp && CertificateVerification.verifyTimestampCertificates(tst, ks, null);
        }

        PdfDictionary pdfDic = reader.getAcroFields().getSignatureDictionary(name);
        SignaturePermissions sp = new SignaturePermissions(pdfDic, null);

        boolean isValid;
        if (nextValid) {
            isValid = pk.verify();
        } else {
            isValid = false;
        }

        List<AcroFields.FieldPosition> posList = af.getFieldPositions(name);
        final SignatureValidation signature = new SignatureValidation(file, name, pk, !pk.verify(),
                af.signatureCoversWholeDocument(name), af.getRevision(name), af.getTotalRevisions(),
                reader.getCertificationLevel(), ocspCertificateStatus, crlCertificateStatus, validTimestamp,
                posList, sp, isValid);
        validateList.add(signature);

        if (null != vl) {
            vl.onValidationComplete(signature);
        }
        if (!sp.isFillInAllowed()) {
            nextValid = false;
        }
    }
    return validateList;
}

From source file:ec.rubrica.pdf.FirmaPDF.java

License:Open Source License

/**
 * TODO: Mas de dos firmas?/*w w w .j  a  v  a 2  s .  co m*/
 * 
 * @param pdf
 * @throws IOException
 * @throws SignatureException
 */
public static boolean verificar(byte[] pdf) throws IOException, SignatureException {

    PdfReader reader = new PdfReader(pdf);
    AcroFields af = reader.getAcroFields();
    ArrayList<String> names = af.getSignatureNames();

    for (int k = 0; k < names.size(); ++k) {
        String name = (String) names.get(k);
        System.out.println("Signature name: " + name);
        System.out.println("Signature covers whole document: " + af.signatureCoversWholeDocument(name));
        System.out.println("Document revision: " + af.getRevision(name) + " of " + af.getTotalRevisions());

        PdfPKCS7 pk = af.verifySignature(name);
        Calendar cal = pk.getSignDate();
        Certificate[] pkc = pk.getCertificates();
        TimeStampToken ts = pk.getTimeStampToken();

        if (ts != null) {
            cal = pk.getTimeStampDate();
        }

        if (!pk.isTsp() && ts != null) {
            boolean impr;
            try {
                impr = pk.verifyTimestampImprint();
                System.out.println("Timestamp imprint verifies: " + impr);
                System.out.println("Timestamp date: " + cal);
            } catch (NoSuchAlgorithmException e) {
                throw new SignatureException(e);
            }
        }

        System.out.println("Subject: " + CertificateInfo.getSubjectFields(pk.getSigningCertificate()));
        System.out.println("Document modified: " + !pk.verify());

        KeyStore kall = KeyStoreUtil.loadCacertsKeyStore();

        Object fails[] = CertificateVerification.verifyCertificates(pkc, kall, null, cal);

        if (fails == null) {
            System.out.println("Certificates verified against the KeyStore");
        } else {
            System.out.println("Certificate failed: " + fails[0]);
            return false;
        }

        BasicOCSPResp ocsp = pk.getOcsp();

        if (ocsp != null) {
            try {
                X509Certificate cert = new SecurityDataSubCaCert();

                boolean verifies = ocsp.isSignatureValid(new JcaContentVerifierProviderBuilder()
                        .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(cert.getPublicKey()));

                System.out.println("OCSP signature verifies: " + verifies);

                System.out.println("OCSP revocation refers to this certificate: " + pk.isRevocationValid());

                return verifies;
            } catch (OperatorCreationException e) {
                throw new SignatureException(e);
            } catch (OCSPException e) {
                throw new SignatureException(e);
            }
        } else {
            return true;
        }
    }

    return false;
}

From source file:ec.rubrica.pdf.VerificadorFirmaPdf.java

License:Open Source License

public Verificacion verificar() throws OcspValidationException, SignatureException {
    int totalRevisiones = af.getTotalRevisions();
    Verificacion verificacion = new Verificacion(totalRevisiones);

    ArrayList<String> nombres = af.getSignatureNames();
    System.out.println("Cuantos nombres=" + nombres.size());

    for (String nombre1 : nombres) {
        System.out.println("nombre=" + nombre1);
        PdfPKCS7 pk = af.verifySignature(nombre1);
        X509Certificate certificadoFirmante = pk.getSigningCertificate();
        log.info("Subject: " + CertificateInfo.getSubjectFields(pk.getSigningCertificate()));
        Certificate[] chain = pk.getSignCertificateChain();

        // Verificar OCSP:
        try {//  www .j  ava  2 s.co m
            verificarOscp(certificadoFirmante);
        } catch (OcspTimeoutException e) {
            throw new SignatureException(e);
        }
    }

    for (String nombre : nombres) {
        PdfPKCS7 pk = af.verifySignature(nombre);

        boolean firmaCubreTodoDocumento = af.signatureCoversWholeDocument(nombre);

        int revision = af.getRevision(nombre);

        X509Certificate certificadoFirmante = pk.getSigningCertificate();
        log.info("Subject: " + CertificateInfo.getSubjectFields(pk.getSigningCertificate()));

        Calendar fechaFirma = pk.getSignDate();
        TimeStampToken tst = pk.getTimeStampToken();

        if (tst != null) {
            log.fine("La firma Tiene Time Stamp");
            fechaFirma = pk.getTimeStampDate();
        }

        boolean selladoTiempoCorrecto = false;

        if (!pk.isTsp() && tst != null) {
            try {
                selladoTiempoCorrecto = pk.verifyTimestampImprint();
            } catch (NoSuchAlgorithmException e) {
                throw new SignatureException(e);
            }
        }

        Certificate[] certificados = pk.getCertificates();

        // TODO: DEBUG
        Certificate[] chain = pk.getSignCertificateChain();
        for (int i = 0; i < chain.length; i++) {
            X509Certificate cert = (X509Certificate) chain[i];
            System.out.println(String.format("[%s] %s", i, cert.getSubjectDN()));
            System.out.println(CertificateUtil.getOCSPURL(cert));
        }
        // TODO: DEBUG

        boolean documentoModificado = !pk.verify();

        Firma firma = new Firma(nombre, firmaCubreTodoDocumento, revision, certificadoFirmante, fechaFirma,
                selladoTiempoCorrecto, certificados, documentoModificado);

        // TODO: Implementar CRLs
        Collection<CRL> crls = null;

        Object error[] = CertificateVerification.verifyCertificates(certificados, cacerts, crls, fechaFirma);

        // TODO: Quitar el mensaje y usar una Enum
        if (error != null) {
            Object objetoConFalla = error[0];
            String mensaje = (String) error[1];

            Falla falla;

            if (objetoConFalla != null) {
                Certificate certConFalla = (Certificate) objetoConFalla;
                falla = new Falla(certConFalla, mensaje);
            } else {
                falla = new Falla(mensaje);
            }

            firma.setFalla(falla);
        }

        verificacion.addFirma(firma);
    }

    return verificacion;
}