Example usage for com.itextpdf.text.pdf.security PdfPKCS7 getSignCertificateChain

Introduction

In this page you can find the example usage for com.itextpdf.text.pdf.security PdfPKCS7 getSignCertificateChain.

Prototype

public Certificate[] getSignCertificateChain() 

Source Link

Document

Get the X.509 sign certificate chain associated with this PKCS#7 object.

Usage

From source file:cz.hobrasoft.pdfmu.operation.OperationInspect.java

License:Open Source License

private Signature display(PdfPKCS7 pkcs7) {
    Signature signature = new Signature();

    // digitalsignatures20130304.pdf : Code sample 5.3
    to.println("Signature metadata:");
    {/*from w  ww.j ava2s.c om*/
        SignatureMetadata metadata = new SignatureMetadata();

        to.indentMore();

        // Only name may be null.
        // The values are set in {@link PdfPKCS7#verifySignature}.
        { // name
            String name = pkcs7.getSignName(); // May be null
            metadata.name = name;
            if (name == null) {
                to.println("Name is not set.");
            } else {
                to.println(String.format("Name: %s", name));
            }
        }

        // TODO?: Print "N/A" if the value is an empty string
        // TODO?: Determine whether the value is set in the signature
        to.println(String.format("Reason: %s", pkcs7.getReason()));
        metadata.reason = pkcs7.getReason();
        to.println(String.format("Location: %s", pkcs7.getLocation()));
        metadata.location = pkcs7.getLocation();

        { // Date
            Date date = pkcs7.getSignDate().getTime();
            to.println(String.format("Date and time: %s", date));
            metadata.date = date.toString();
        }

        to.indentLess();

        signature.metadata = metadata;
    }
    { // Certificate chain
        to.indentMore("Certificate chain:");
        Certificate[] certificates = pkcs7.getSignCertificateChain();
        to.println(String.format("Number of certificates: %d", certificates.length));
        int i = 0;
        List<CertificateResult> certificatesResult = new ArrayList<>();
        for (Certificate certificate : certificates) {
            to.indentMore(String.format("Certificate %d%s:", i, (i == 0 ? " (the signing certificate)" : "")));
            CertificateResult certRes;
            String type = certificate.getType();
            to.println(String.format("Type: %s", type));
            // http://docs.oracle.com/javase/1.5.0/docs/guide/security/CryptoSpec.html#AppA
            if ("X.509".equals(type)) {
                X509Certificate certificateX509 = (X509Certificate) certificate;
                certRes = showCertInfo(certificateX509);
            } else {
                certRes = new CertificateResult();
            }
            certRes.type = type;
            to.indentLess();
            certificatesResult.add(certRes);
            ++i;
        }
        signature.certificates = certificatesResult;
        to.indentLess();
    }

    return signature;
}

---

From source file:ec.rubrica.pdf.VerificadorFirmaPdf.java

License:Open Source License

public Verificacion verificar() throws OcspValidationException, SignatureException {
    int totalRevisiones = af.getTotalRevisions();
    Verificacion verificacion = new Verificacion(totalRevisiones);

    ArrayList<String> nombres = af.getSignatureNames();
    System.out.println("Cuantos nombres=" + nombres.size());

    for (String nombre1 : nombres) {
        System.out.println("nombre=" + nombre1);
        PdfPKCS7 pk = af.verifySignature(nombre1);
        X509Certificate certificadoFirmante = pk.getSigningCertificate();
        log.info("Subject: " + CertificateInfo.getSubjectFields(pk.getSigningCertificate()));
        Certificate[] chain = pk.getSignCertificateChain();

        // Verificar OCSP:
        try {/*  ww  w  .j  a v  a2 s. c  o m*/
            verificarOscp(certificadoFirmante);
        } catch (OcspTimeoutException e) {
            throw new SignatureException(e);
        }
    }

    for (String nombre : nombres) {
        PdfPKCS7 pk = af.verifySignature(nombre);

        boolean firmaCubreTodoDocumento = af.signatureCoversWholeDocument(nombre);

        int revision = af.getRevision(nombre);

        X509Certificate certificadoFirmante = pk.getSigningCertificate();
        log.info("Subject: " + CertificateInfo.getSubjectFields(pk.getSigningCertificate()));

        Calendar fechaFirma = pk.getSignDate();
        TimeStampToken tst = pk.getTimeStampToken();

        if (tst != null) {
            log.fine("La firma Tiene Time Stamp");
            fechaFirma = pk.getTimeStampDate();
        }

        boolean selladoTiempoCorrecto = false;

        if (!pk.isTsp() && tst != null) {
            try {
                selladoTiempoCorrecto = pk.verifyTimestampImprint();
            } catch (NoSuchAlgorithmException e) {
                throw new SignatureException(e);
            }
        }

        Certificate[] certificados = pk.getCertificates();

        // TODO: DEBUG
        Certificate[] chain = pk.getSignCertificateChain();
        for (int i = 0; i < chain.length; i++) {
            X509Certificate cert = (X509Certificate) chain[i];
            System.out.println(String.format("[%s] %s", i, cert.getSubjectDN()));
            System.out.println(CertificateUtil.getOCSPURL(cert));
        }
        // TODO: DEBUG

        boolean documentoModificado = !pk.verify();

        Firma firma = new Firma(nombre, firmaCubreTodoDocumento, revision, certificadoFirmante, fechaFirma,
                selladoTiempoCorrecto, certificados, documentoModificado);

        // TODO: Implementar CRLs
        Collection<CRL> crls = null;

        Object error[] = CertificateVerification.verifyCertificates(certificados, cacerts, crls, fechaFirma);

        // TODO: Quitar el mensaje y usar una Enum
        if (error != null) {
            Object objetoConFalla = error[0];
            String mensaje = (String) error[1];

            Falla falla;

            if (objetoConFalla != null) {
                Certificate certConFalla = (Certificate) objetoConFalla;
                falla = new Falla(certConFalla, mensaje);
            } else {
                falla = new Falla(mensaje);
            }

            firma.setFalla(falla);
        }

        verificacion.addFirma(firma);
    }

    return verificacion;
}

---

From source file:org.opencps.pki.PdfVerifier.java

License:Open Source License

/**
 * (non-Javadoc)/*from   w  w w  .  j  a  v a  2s  .  c om*/
 * @throws SignatureException 
 * @see org.opencps.pki.Verifier#verifySignature()
 */
public Boolean verifySignature(InputStream inputStream, KeyStore ks) throws SignatureException {
    Boolean verified = false;
    try {
        PdfReader reader = new PdfReader(inputStream);
        AcroFields fields = reader.getAcroFields();
        ArrayList<String> names = fields.getSignatureNames();
        for (String name : names) {
            PdfPKCS7 pkcs7 = fields.verifySignature(name);
            if (pkcs7.verify()) {
                Certificate[] certs = pkcs7.getSignCertificateChain();
                Calendar cal = pkcs7.getSignDate();
                List<VerificationException> errors = CertificateVerification.verifyCertificates(certs, ks, cal);
                if (errors.size() == 0) {
                    X509Certificate signCert = (X509Certificate) certs[0];
                    X509Certificate issuerCert = (certs.length > 1 ? (X509Certificate) certs[1] : null);
                    verified = checkSignatureRevocation(pkcs7, signCert, issuerCert, cal.getTime())
                            && checkSignatureRevocation(pkcs7, signCert, issuerCert, new Date());
                }
            }
        }
        reader.close();
    } catch (Exception e) {
        throw new SignatureException(e.getMessage(), e);
    }
    return verified;
}

---

From source file:org.roda.common.certification.PDFSignatureUtils.java

public static String runDigitalSignatureVerify(Path input) throws IOException, GeneralSecurityException {
    Security.addProvider(new BouncyCastleProvider());

    PdfReader reader = new PdfReader(input.toString());
    AcroFields fields = reader.getAcroFields();
    ArrayList<String> names = fields.getSignatureNames();
    String result = "Passed";

    for (int i = 0; i < names.size(); i++) {
        String name = names.get(i);

        try {/*w  w w .ja  v a 2s .c  o m*/
            PdfPKCS7 pk = fields.verifySignature(name);
            X509Certificate certificate = pk.getSigningCertificate();
            certificate.checkValidity();

            if (!SignatureUtils.isCertificateSelfSigned(certificate)) {

                Set<Certificate> trustedRootCerts = new HashSet<Certificate>();
                Set<Certificate> intermediateCerts = new HashSet<Certificate>();

                for (Certificate c : pk.getSignCertificateChain()) {
                    X509Certificate cert = (X509Certificate) c;
                    cert.checkValidity();

                    if (SignatureUtils.isCertificateSelfSigned(c))
                        trustedRootCerts.add(c);
                    else
                        intermediateCerts.add(c);
                }

                SignatureUtils.verifyCertificateChain(trustedRootCerts, intermediateCerts, certificate);
                if (pk.getCRLs() != null) {
                    for (CRL crl : pk.getCRLs()) {
                        if (crl.isRevoked(certificate)) {
                            result = "Signing certificate is included on a Certificate Revocation List";
                        }
                    }
                }
            }
        } catch (NoSuchFieldError e) {
            result = "Missing signature timestamp field";
        } catch (CertificateExpiredException e) {
            result = "Contains expired certificates";
        } catch (CertificateNotYetValidException e) {
            result = "Contains certificates not yet valid";
        }
    }

    reader.close();
    return result;
}

---

From source file:org.roda.core.plugins.plugins.characterization.PDFSignatureUtils.java

public static String runDigitalSignatureVerify(Path input) throws IOException, GeneralSecurityException {
    Security.addProvider(new BouncyCastleProvider());

    PdfReader reader = new PdfReader(input.toString());
    AcroFields fields = reader.getAcroFields();
    ArrayList<String> names = fields.getSignatureNames();
    String result = "Passed";

    for (int i = 0; i < names.size(); i++) {
        String name = names.get(i);

        try {//from w  w w.j  a  va 2  s .c o m
            PdfPKCS7 pk = fields.verifySignature(name);
            X509Certificate certificate = pk.getSigningCertificate();
            certificate.checkValidity();

            if (!SignatureUtils.isCertificateSelfSigned(certificate)) {

                Set<Certificate> trustedRootCerts = new HashSet<>();
                Set<Certificate> intermediateCerts = new HashSet<>();

                for (Certificate c : pk.getSignCertificateChain()) {
                    X509Certificate cert = (X509Certificate) c;
                    cert.checkValidity();

                    if (SignatureUtils.isCertificateSelfSigned(c))
                        trustedRootCerts.add(c);
                    else
                        intermediateCerts.add(c);
                }

                SignatureUtils.verifyCertificateChain(trustedRootCerts, intermediateCerts, certificate);
                if (pk.getCRLs() != null) {
                    for (CRL crl : pk.getCRLs()) {
                        if (crl.isRevoked(certificate)) {
                            result = "Signing certificate is included on a Certificate Revocation List";
                        }
                    }
                }
            }
        } catch (NoSuchFieldError e) {
            result = "Missing signature timestamp field";
        } catch (CertificateExpiredException e) {
            result = "Contains expired certificates";
        } catch (CertificateNotYetValidException e) {
            result = "Contains certificates not yet valid";
        }
    }

    reader.close();
    return result;
}

---