You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pdfbox.apache.org by ti...@apache.org on 2018/10/31 05:04:31 UTC
svn commit: r1845308 -
/pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java
Author: tilman
Date: Wed Oct 31 05:04:31 2018
New Revision: 1845308
URL: http://svn.apache.org/viewvc?rev=1845308&view=rev
Log:
PDFBOX-3017: validate certificate + verify certificate chain of adbe.x509.rsa_sha1 type signature; add a TODO because of missing case
Modified:
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java
Modified: pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java
URL: http://svn.apache.org/viewvc/pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java?rev=1845308&r1=1845307&r2=1845308&view=diff
==============================================================================
--- pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java (original)
+++ pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java Wed Oct 31 05:04:31 2018
@@ -205,6 +205,7 @@ public final class ShowSignature
{
// example: PDFBOX-2693.pdf
COSString certString = (COSString) sigDict.getDictionaryObject(COSName.CERT);
+ //TODO this could also be an array.
if (certString == null)
{
System.err.println("The /Cert certificate string is missing in the signature dictionary");
@@ -215,9 +216,35 @@ public final class ShowSignature
ByteArrayInputStream certStream = new ByteArrayInputStream(certData);
Collection<? extends Certificate> certs = factory.generateCertificates(certStream);
System.out.println("certs=" + certs);
+
+ X509Certificate cert = (X509Certificate) certs.iterator().next();
// to verify signature, see code at
// https://stackoverflow.com/questions/43383859/
+
+ try
+ {
+ if (sig.getSignDate() != null)
+ {
+ cert.checkValidity(sig.getSignDate().getTime());
+ System.out.println("Certificate valid at signing time");
+ verifyCertificateChain(new JcaCertStore(certs),
+ (X509Certificate) certs.iterator().next(),
+ sig.getSignDate().getTime());
+ }
+ else
+ {
+ System.err.println("Certificate cannot be verified without signing time");
+ }
+ }
+ catch (CertificateExpiredException ex)
+ {
+ System.err.println("Certificate expired at signing time");
+ }
+ catch (CertificateNotYetValidException ex)
+ {
+ System.err.println("Certificate not yet valid at signing time");
+ }
break;
}
case "ETSI.RFC3161":