使用PKCS#11和iText使用eID签名PDF

Question

遵循http://itextpdf.com/book/digitalsignatures中的“使用智能卡和PKCS#11签名文档”主题并创建与所提供的代码示例类似的代码示例后，签名的文件签名在Adobe Reader中无效，签名外观具有不可否认证书的名称（即eID所有者的名称），但在Adobe Reader的签名面板中显示：

我使用的是金雅拓PinPad和葡萄牙语eIDpteidpkcs11.dll与eID中间件软件一起安装，位于C:\Windows\System32中。

我试过：

• 空检查
• 手动创建证书链，因为ks.getCertificateChain（“公民签名证书”）返回的证书[]；只有签名证书

Answer 1

作为另一种选择，您可以只使用www.poreid.org上提供的java组件使用葡萄牙语eid卡（cartão de cidadão）进行签名。它还可以在maven central repository上使用artifactid poreid

下面是一个基于itext文档中提供的示例的示例

public void createPdf(String filename) throws IOException, DocumentException {
    Document document = new Document();
    PdfWriter.getInstance(document, new FileOutputStream(filename));
    document.open();
    document.add(new Paragraph("Assinado com o Cartão de Cidadão!"));
    document.close();
}

public void signPdf(String src, String dest)
    throws IOException, DocumentException, GeneralSecurityException {
    KeyStore ks = KeyStore.getInstance(POReIDConfig.POREID);
    ks.load(null);
    PrivateKey pk = (PrivateKey) ks.getKey(POReIDConfig.AUTENTICACAO, null);
    Certificate[] chain = ks.getCertificateChain(POReIDConfig.AUTENTICACAO);

    // reader and stamper
    PdfReader reader = new PdfReader(src);
    FileOutputStream os = new FileOutputStream(dest);
    PdfStamper stamper = PdfStamper.createSignature(reader, os, '\0');

    // appearance
    PdfSignatureAppearance appearance = stamper .getSignatureAppearance();
    appearance.setReason("qualquer motivo");
    appearance.setLocation("qualquer localização");
    appearance.setVisibleSignature(new Rectangle(72, 732, 144, 780), 1, "primeira assinatura");

    // digital signature
    ExternalSignature es = new PrivateKeySignature(pk, "SHA-256", POReIDConfig.POREID);
    ExternalDigest digest = new ProviderDigest(null); // find provider
    MakeSignature.signDetached(appearance, digest, es, chain, null, null, null, 0, CryptoStandard.CMS);
}


public static void main(String[] args) throws DocumentException, IOException, GeneralSecurityException {
    Security.addProvider(new POReIDProvider());

    App exemplo = new App();
    exemplo.createPdf("/home/quim/exemplo.pdf");
    exemplo.signPdf("/home/quim/exemplo.pdf","/home/quim/exemplo.assinado.pdf");
}