iText与数字签名

Question

我这里需要帮助，有人能帮我吗？

 try {
        String pkcs11Config = "name=GemPC" + "\n" + "library=C:/WINDOWS/system32/pteidpkcs11.dll";
        ByteArrayInputStream configStream = new ByteArrayInputStream(pkcs11Config.getBytes());
        Provider pkcs11Provider = new sun.security.pkcs11.SunPKCS11(configStream);

        Security.addProvider(pkcs11Provider);
        CallbackHandler cmdLineHdlr = new DialogCallbackHandler();

        KeyStore.Builder builder = KeyStore.Builder.newInstance("PKCS11", pkcs11Provider,
                new KeyStore.CallbackHandlerProtection(cmdLineHdlr));

        KeyStore ks = builder.getKeyStore();

        PdfReader pdf = new PdfReader(filePath);
        FileOutputStream fos = new FileOutputStream(dest);
        PdfStamper stp = PdfStamper.createSignature(pdf, fos, '\0');
        PdfSignatureAppearance sap = stp.getSignatureAppearance();
        sap.setReason("I'm the author");

        String alias = (String) ks.aliases().nextElement();

        PrivateKey pk = (PrivateKey) ks.getKey("CITIZEN SIGNATURE CERTIFICATE", null);
        Certificate chain = ks.getCertificate(alias);

        X509Certificate x509 = (X509Certificate) chain;
        x509.checkValidity();

        ExternalSignature es = new PrivateKeySignature(pk, "SHA-1", "BC");
        ExternalDigest digest = new BouncyCastleDigest();
        Certificate[] certs = new Certificate[1];
        certs[0] = chain;

        MakeSignature.signDetached(sap, digest, es, certs, null, null, null, 0, CryptoStandard.CMS);
        return dest;
    } catch (CertificateExpiredException | CertificateNotYetValidException ex) {
        Logger.getLogger(Signer.class.getName()).log(Level.SEVERE, null, ex);
        return null;
    }

Answer 1

如果您的私钥在智能卡(PKCS11)中，则不能将该密钥包装在java.security.interfaces.rsaprivateKey中，因为您的密钥材料位于安全设备中。

因此，您可能必须更改代码中的提供程序：

 ExternalSignature es = new PrivateKeySignature(pk, "SHA-1", "BC");

对于：

 ExternalSignature es = new PrivateKeySignature(pk, "SHA-1", pkcs11Provider.getName());