相关疑难解决方法(0)

我正在使用iText 5.5.3对PDF文档进行签名和加时间戳.它工作得很好.但我最近从Acrobat Pro X切换到XI,现在我看到了这个新行:

the signature is not LTV enabled and will expire after <date>

我想这会警告我,在此日期之后,签名者的签名将被视为无效,对吧？但是签名属性告诉我:

the signature includes an embedded timestamp : <date/time>
signature was validated as of the secure timestamp time : <same date/time>

现在我有点困惑:由于签名在已知且经过认证的日期被宣布有效,为什么它将来会变得无效？

我们正在尝试启用已签名的签名 LTV。我正在使用下面的代码来添加验证。当signature.isTsp()为假时，PDF显示Signature is not LTV enabled，但在其他情况下（signature.isTsp()为真）它显示为有效。当我们打开 PDF 并尝试通过右键单击签名来手动添加验证信息时，它会毫无问题地启用 LTV。不确定我们在这里缺少什么。任何输入都会非常有帮助。

// Adds LTV-enabled information to the PDF document.
private ByteArrayOutputStream addLtv(final IOcspClient ocspClient,
                                     final ByteArrayOutputStream docStream)
        throws IOException, GeneralSecurityException {
    final ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
    final InputStream signedStream = new ByteArrayInputStream(docStream.toByteArray());
    final PdfReader reader = new PdfReader(signedStream);
    final PdfDocument document =
            new PdfDocument(reader, new PdfWriter(outputStream), new StampingProperties().useAppendMode());
    final LtvVerification verification = new LtvVerification(document);
    final SignatureUtil signatureUtil = new SignatureUtil(document);

    final List<String> signatureNames = signatureUtil.getSignatureNames();
    final String sigName = …

该方法接收 pdf 文档作为应签名的字节数组、要签名的证书和 TSA 客户端，并以字节数组形式返回签名文档，如果出现错误，则返回 null。现在它返回签名的 pdf 文档，但未启用 LTV。签署的文档必须启用 LTV。如何使退回的文档启用 LTV？我将非常感谢任何建议。

public byte[] Sign(byte[] document, X509Certificate2 certificate, ITSAClient tsaClient)
    {
    byte[] signedDocument = null;

    IExternalSignature signature = new X509Certificate2Signature(certificate, "SHA-1");
    Org.BouncyCastle.X509.X509CertificateParser cp = new Org.BouncyCastle.X509.X509CertificateParser();
    Org.BouncyCastle.X509.X509Certificate[] chain = new Org.BouncyCastle.X509.X509Certificate[] { cp.ReadCertificate(certificate.RawData) };

    PdfReader reader = new PdfReader(document);
    MemoryStream ms = new MemoryStream();
    PdfStamper st = PdfStamper.CreateSignature(reader, ms, '\0');

    PdfSignatureAppearance sap = st.SignatureAppearance;
    sap.CertificationLevel = PdfSignatureAppearance.CERTIFIED_NO_CHANGES_ALLOWED;
    sap.SignatureCreator = "NAME";
    sap.Reason = "REASON";
    sap.Contact = "CONTACT";
    sap.Location = "LOCATION";
    sap.SignDate = …

我正在使用数字证书签署 pdf iText。现在我可以签名并添加 LTV，但证书级别可以是：

signatureAppearance.setCertificationLevel(PdfSignatureAppearance.CERTIFIED_FORM_FILLING_AND_ANNOTATIONS);

我只想设置PdfSignatureAppearance.CERTIFIED_NO_CHANGES_ALLOWED. 最终结果应如下所示：

sap.setCertificationLevel(PdfSignatureAppearance.CERTIFIED_NO_CHANGES_ALLOWED);
MakeSignature.signDetached(signatureAppearance, privateKey, "SHA-512", chain, null, ocspClient, tsaClient, 0, MakeSignature.CryptoStandard.CADES);

如果我使用上面的代码进行签名，那么使用AdobeLtvEnabling.java添加LTV在使用ACROBAT检查时会提示签名无效，因为添加LTV时该文件正在修改不可修改的PDF文件。那么，我该怎么做才能达到最终的效果呢？