itextpdf 数字签名

**************

相关类与接口

PdfSingner

public class PdfSigner {
    public static final int NOT_CERTIFIED = 0;
    public static final int CERTIFIED_NO_CHANGES_ALLOWED = 1;
    public static final int CERTIFIED_FORM_FILLING = 2;
    public static final int CERTIFIED_FORM_FILLING_AND_ANNOTATIONS = 3;
    protected int certificationLevel;
    protected String fieldName;
    protected RandomAccessFile raf;
    protected byte[] bout;
    protected long[] range;
    protected PdfDocument document;
    protected PdfSignature cryptoDictionary;
    private PdfName digestMethod;
    protected PdfSigner.ISignatureEvent signatureEvent;
    protected OutputStream originalOS;
    protected ByteArrayOutputStream temporaryOS;
    protected File tempFile;
    protected Map<PdfName, PdfLiteral> exclusionLocations;
    protected boolean preClosed;
    protected PdfSigFieldLock fieldLock;
    protected PdfSignatureAppearance appearance;
    protected Calendar signDate;
    protected boolean closed;


********
构造方法

    public PdfSigner(PdfReader reader, OutputStream outputStream, StampingProperties properties) throws IOException {
    public PdfSigner(PdfReader reader, OutputStream outputStream, String path, StampingProperties properties) throws IOException {


********
其他方法

    public void setFieldName(String fieldName) {
    public void setSignDate(Calendar signDate) {
    public void setFieldLockDict(PdfSigFieldLock fieldLock) {
    public void setCertificationLevel(int certificationLevel) {
    public void setOriginalOutputStream(OutputStream originalOS) {
    public void setSignatureEvent(PdfSigner.ISignatureEvent signatureEvent) {

    public String getFieldName() {
    public Calendar getSignDate() {
    public PdfDocument getDocument() {
    public int getCertificationLevel() {
    public String getNewSigFieldName() {
    public PdfSigFieldLock getFieldLockDict() {
    public PdfSignature getSignatureDictionary() {
    public PdfSigner.ISignatureEvent getSignatureEvent() {
    public PdfSignatureAppearance getSignatureAppearance() {

    public void signDetached(IExternalDigest externalDigest, IExternalSignature externalSignature, Certificate[] chain, Collection<ICrlClient> crlList, IOcspClient ocspClient, ITSAClient tsaClient, int estimatedSize, PdfSigner.CryptoStandard sigtype) throws IOException, GeneralSecurityException {
    public void signDetached(IExternalDigest externalDigest, IExternalSignature externalSignature, Certificate[] chain, Collection<ICrlClient> crlList, IOcspClient ocspClient, ITSAClient tsaClient, int estimatedSize, PdfSigner.CryptoStandard sigtype, SignaturePolicyInfo signaturePolicy) throws IOException, GeneralSecurityException {
    public void signDetached(IExternalDigest externalDigest, IExternalSignature externalSignature, Certificate[] chain, Collection<ICrlClient> crlList, IOcspClient ocspClient, ITSAClient tsaClient, int estimatedSize, PdfSigner.CryptoStandard sigtype, SignaturePolicyIdentifier signaturePolicy) throws IOException, GeneralSecurityException {
                            //签名方法

    public void signExternalContainer(IExternalSignatureContainer externalSignatureContainer, int estimatedSize) throws GeneralSecurityException, IOException {
    public static void signDeferred(PdfDocument document, String fieldName, OutputStream outs, IExternalSignatureContainer externalSignatureContainer) throws IOException, GeneralSecurityException {
    public void timestamp(ITSAClient tsa, String signatureName) throws IOException, GeneralSecurityException {


    protected boolean isPreClosed() {
    protected void addDocMDP(PdfSignature crypto) {
    protected void setDocument(PdfDocument document) {
    protected InputStream getRangeStream() throws IOException {
    protected int getWidgetPageNumber(PdfWidgetAnnotation widget) {
    protected Rectangle getWidgetRectangle(PdfWidgetAnnotation widget) {
    protected boolean documentContainsCertificationOrApprovalSignatures() {
    protected void addDeveloperExtension(PdfDeveloperExtension extension) {
    protected IRandomAccessSource getUnderlyingSource() throws IOException {
    protected void addFieldMDP(PdfSignature crypto, PdfSigFieldLock fieldLock) {
    protected void preClose(Map<PdfName, Integer> exclusionSizes) throws IOException {
    protected PdfSigFieldLock populateExistingSignatureFormField(PdfAcroForm acroForm) throws IOException {
    protected PdfDocument initDocument(PdfReader reader, PdfWriter writer, StampingProperties properties) {
    protected Collection<byte[]> processCrl(Certificate cert, Collection<ICrlClient> crlList) {
    protected PdfSigFieldLock createNewSignatureFormField(PdfAcroForm acroForm, String name) throws IOException {

    private void setDigestParamToSigRefIfNeeded(PdfDictionary reference) {
    private PdfName getHashAlgorithmNameInCompatibleForPdfForm(String hashAlgorithm) {
    private boolean isDocumentPdf2() {
    private static StampingProperties initStampingProperties(boolean append) {


********
内部接口：ISignatureEvent

    public interface ISignatureEvent {
        void getSignatureDictionary(PdfSignature var1);
    }


********
内部枚举：CryptoStandard

    public static enum CryptoStandard {
        CMS,
        CADES;

        private CryptoStandard() {
        }
    }
}

StampingProperties

public class StampingProperties extends DocumentProperties {
    protected boolean appendMode = false;
    protected boolean preserveEncryption = false;

    public StampingProperties() {
    }

    public StampingProperties(StampingProperties other) {
        super(other);
        this.appendMode = other.appendMode;
        this.preserveEncryption = other.preserveEncryption;
    }

    public StampingProperties useAppendMode() {
        this.appendMode = true;
        return this;
    }

    public StampingProperties preserveEncryption() {
        this.preserveEncryption = true;
        return this;
    }
}

DocumentProperties

public class DocumentProperties {
    protected IMetaInfo metaInfo = null;

    public DocumentProperties() {
    }

    public DocumentProperties(DocumentProperties other) {
        this.metaInfo = other.metaInfo;
    }

    public DocumentProperties setEventCountingMetaInfo(IMetaInfo metaInfo) {
        this.metaInfo = metaInfo;
        return this;
    }
}

PdfSignatureAppearance

public class PdfSignatureAppearance {
    private static final float TOP_SECTION = 0.3F;
    private static final float MARGIN = 2.0F;
    private PdfDocument document;
    private int page = 1;
    private Rectangle rect;
    private Rectangle pageRect;
    private PdfFormXObject n0;
    private PdfFormXObject n2;
    private PdfFormXObject topLayer;
    private PdfSignatureAppearance.RenderingMode renderingMode;
    private String reason;
    private String reasonCaption;
    private String location;
    private String locationCaption;
    private String signatureCreator;
    private String contact;
    private Calendar signDate;
    private Certificate signCertificate;
    private ImageData signatureGraphic;
    private ImageData image;
    private float imageScale;
    private String layer2Text;
    private PdfFont layer2Font;
    private float layer2FontSize;
    private Color layer2FontColor;
    private String fieldName;
    private boolean reuseAppearance;


********
构造方法

    protected PdfSignatureAppearance(PdfDocument document, Rectangle pageRect, int pageNumber) {


********
其他方法

    public PdfSignatureAppearance setReason(String reason) {
    public PdfSignatureAppearance setImage(ImageData image) {
    public PdfSignatureAppearance setLayer2Text(String text) {
    public PdfSignatureAppearance setContact(String contact) {
    public PdfSignatureAppearance setLocation(String location) {
    public PdfSignatureAppearance setPageNumber(int pageNumber) {
    public PdfSignatureAppearance setLayer2FontColor(Color color) {
    public PdfSignatureAppearance setPageRect(Rectangle pageRect) {
    public PdfSignatureAppearance setImageScale(float imageScale) {
    public PdfSignatureAppearance setLayer2Font(PdfFont layer2Font) {
    public PdfSignatureAppearance setLayer2FontSize(float fontSize) {
    public PdfSignatureAppearance setReasonCaption(String reasonCaption) {
    public PdfSignatureAppearance setLocationCaption(String locationCaption) {
    public PdfSignatureAppearance setReuseAppearance(boolean reuseAppearance) {
    public PdfSignatureAppearance setCertificate(Certificate signCertificate) {
    public PdfSignatureAppearance setSignatureCreator(String signatureCreator) {
    public PdfSignatureAppearance setSignatureGraphic(ImageData signatureGraphic) {
    public PdfSignatureAppearance setRenderingMode(PdfSignatureAppearance.RenderingMode renderingMode) {


    public String getReason() {
    public String getContact() {
    public int getPageNumber() {
    public String getLocation() {
    public ImageData getImage() {
    public float getImageScale() {
    public boolean isInvisible() {
    public String getLayer2Text() {
    public PdfFont getLayer2Font() {
    public Rectangle getPageRect() {
    public float getLayer2FontSize() {
    public Color getLayer2FontColor() {
    public PdfFormXObject getLayer0() {
    public PdfFormXObject getLayer2() {
    public String getSignatureCreator() {
    public Certificate getCertificate() {
    public ImageData getSignatureGraphic() {
    public PdfSignatureAppearance.RenderingMode getRenderingMode() {


    protected PdfFormXObject getAppearance() throws IOException {
    protected Calendar getSignDate() {
    protected PdfSignatureAppearance setSignDate(Calendar signDate) {
    protected PdfSignatureAppearance setFieldName(String fieldName) {

    private static Rectangle rotateRectangle(Rectangle rect, int angle) {
    private void createBlankN0() {
    private void addTextToCanvas(String text, PdfFont font, Rectangle dataRect) {
    private void applyCopyFittingFontSize(Paragraph paragraph, Rectangle rect, IRenderer parentRenderer) {

    String generateLayer2Text() {


********
内部枚举：RenderingMode

    public static enum RenderingMode {
        DESCRIPTION,
        NAME_AND_DESCRIPTION,
        GRAPHIC_AND_DESCRIPTION,
        GRAPHIC;

        private RenderingMode() {
        }
    }
}

IExternalDigest

public interface IExternalDigest {
    MessageDigest getMessageDigest(String var1) throws GeneralSecurityException;
}

ProviderDigest

public class ProviderDigest implements IExternalDigest {
    private String provider;

    public ProviderDigest(String provider) {
        this.provider = provider;
    }

    public MessageDigest getMessageDigest(String hashAlgorithm) throws GeneralSecurityException {
        return DigestAlgorithms.getMessageDigest(hashAlgorithm, this.provider);
    }
}

BouncyCastleDigest

public class BouncyCastleDigest implements IExternalDigest {
    public BouncyCastleDigest() {
    }

    public MessageDigest getMessageDigest(String hashAlgorithm) throws GeneralSecurityException {

IExternalSignature

public interface IExternalSignature {
    String getHashAlgorithm();

    String getEncryptionAlgorithm();

    byte[] sign(byte[] var1) throws GeneralSecurityException;
}

PrivateKeySignature

public class PrivateKeySignature implements IExternalSignature {
    private PrivateKey pk;
    private String hashAlgorithm;
    private String encryptionAlgorithm;
    private String provider;

    public PrivateKeySignature(PrivateKey pk, String hashAlgorithm, String provider) {

    public String getHashAlgorithm() {
    public String getEncryptionAlgorithm() {

    public byte[] sign(byte[] message) throws GeneralSecurityException {

**************

生成p12证书

keytool 命令参数

[root@centos keytool]# keytool -h
密钥和证书管理工具

命令:

 -certreq            生成证书请求
 -changealias        更改条目的别名
 -delete             删除条目
 -exportcert         导出证书
 -genkeypair         生成密钥对
 -genseckey          生成密钥
 -gencert            根据证书请求生成证书
 -importcert         导入证书或证书链
 -importpass         导入口令
 -importkeystore     从其他密钥库导入一个或所有条目
 -keypasswd          更改条目的密钥口令
 -list               列出密钥库中的条目
 -printcert          打印证书内容
 -printcertreq       打印证书请求的内容
 -printcrl           打印 CRL 文件的内容
 -storepasswd        更改密钥库的存储口令
 -showinfo           显示安全相关信息

keytool -genkeypair：生成密钥对

[root@centos keytool]# keytool -genkeypair -h
keytool -genkeypair [OPTION]...

生成密钥对

选项:

 -alias <alias>          要处理的条目的别名
 -keyalg <alg>           密钥算法名称
 -keysize <size>         密钥位大小
 -groupname <name>       组名。例如，椭圆曲线名称。
 -sigalg <alg>           签名算法名称
 -dname <name>           唯一判别名
 -startdate <date>       证书有效期开始日期/时间
 -ext <value>            X.509 扩展
 -validity <days>        有效天数
 -keypass <arg>          密钥口令
 -keystore <keystore>    密钥库名称
 -storepass <arg>        密钥库口令
 -storetype <type>       密钥库类型
 -providername <name>    提供方名称
 -addprovider <name>     按名称 (例如 SunPKCS11) 添加安全提供方
   [-providerarg <arg>]    配置 -addprovider 的参数
 -providerclass <class>  按全限定类名添加安全提供方
   [-providerarg <arg>]    配置 -providerclass 的参数
 -providerpath <list>    提供方类路径
 -v                      详细输出
 -protected              通过受保护的机制的口令

keytool -importkeystore：导入密钥库，转换生成p12证书

[root@centos keytool]# keytool -importkeystore -h
keytool -importkeystore [OPTION]...

从其他密钥库导入一个或所有条目

选项:

 -srckeystore <keystore>   源密钥库名称
 -destkeystore <keystore>  目标密钥库名称
 -srcstoretype <type>      源密钥库类型
 -deststoretype <type>     目标密钥库类型
 -srcstorepass <arg>       源密钥库口令
 -deststorepass <arg>      目标密钥库口令
 -srcprotected             受保护的源密钥库口令
 -destprotected            受保护的目标密钥库口令
 -srcprovidername <name>   源密钥库提供方名称
 -destprovidername <name>  目标密钥库提供方名称
 -srcalias <alias>         源别名
 -destalias <alias>        目标别名
 -srckeypass <arg>         源密钥口令
 -destkeypass <arg>        目标密钥口令
 -noprompt                 不提示
 -addprovider <name>       按名称 (例如 SunPKCS11) 添加安全提供方
   [-providerarg <arg>]      配置 -addprovider 的参数
 -providerclass <class>    按全限定类名添加安全提供方
   [-providerarg <arg>]      配置 -providerclass 的参数
 -providerpath <list>      提供方类路径
 -v                        详细输出

示例：生成p12证书

# 生成签名证书（keystore）
[root@centos keytool]# keytool -genkeypair -alias serverkey \
> -keypass 123456 -storepass 123456 \
> -dname "C=CN,ST=SD,L=QD,O=ali,OU=dev,CN=li" \
> -keyalg RSA -keysize 2048 -validity 3650 \
> -keystore ./cert.keystore
正在为以下对象生成 2,048 位RSA密钥对和自签名证书 (SHA256withRSA) (有效期为 3,650 天):
	 C=CN, ST=SD, L=QD, O=ali, OU=dev, CN=li

# 生成p12证书
[root@centos keytool]#  keytool -importkeystore \
> -srckeystore ./cert.keystore -destkeystore ./cert.p12 \
> -srcstorepass 123456 -deststorepass 123456 -noprompt \
> -srcalias serverkey -destalias serverkey \
> -srcstoretype jks -deststoretype pkcs12 \
> ;
正在将密钥库 ./cert.keystore 导入到 ./cert.p12...


# 查看生成的证书
[root@centos keytool]# % ls cert*
cert.keystore	cert.p12

**************

示例

public class Test3 {
 
    public static final String src = "./signature/1.pdf";      //待签名的pdf文件
    public static final String cert = "./signature/cert.p12";  //使用上面生成的p12证书
    public static final String img = "./signature/sign.jpg";   //签名图章
 
    private static final String dest = "./signature/sign.pdf"; //签名后的pdf文件
 
    public static void fun() throws Exception {
        PdfSigner pdfSigner = new PdfSigner(new PdfReader(src), new FileOutputStream(dest),
                new StampingProperties());
        pdfSigner.setCertificationLevel(PdfSigner.CERTIFIED_NO_CHANGES_ALLOWED);
        pdfSigner.setFieldName("signature");

        PdfSignatureAppearance signatureAppearance = pdfSigner.getSignatureAppearance();
        signatureAppearance.setRenderingMode(PdfSignatureAppearance.RenderingMode.GRAPHIC);
        signatureAppearance.setReason("");
        signatureAppearance.setLocationCaption("");

        ImageData image = ImageDataFactory.create(img);
        signatureAppearance.setSignatureGraphic(image);
        signatureAppearance.setPageNumber(1);
        signatureAppearance.setPageRect(new Rectangle(300, 600, 100, 100));

        char[] password = "123456".toCharArray();
        IExternalSignature pks = getPrivateKeySignature(password);
        Certificate[] chain = getCertificateChain(password);

        pdfSigner.signDetached(new BouncyCastleDigest(), pks,chain,null, null, null,
                0, PdfSigner.CryptoStandard.CMS);
    }
 
    private static PrivateKeySignature getPrivateKeySignature(char[] password) throws Exception {
        PrivateKey pk = null;

        KeyStore p12 = KeyStore.getInstance("pkcs12");
        p12.load(new FileInputStream(cert), password);
 
        Enumeration<String> aliases = p12.aliases();
        while (aliases.hasMoreElements()) {
            String alias = aliases.nextElement();
            if (p12.isKeyEntry(alias)) {
                pk = (PrivateKey) p12.getKey(alias, password);
                break;
            }
        }
 
        Security.addProvider(new BouncyCastleProvider());
        return new PrivateKeySignature(pk, DigestAlgorithms.SHA512, BouncyCastleProvider.PROVIDER_NAME);
    }
 
 
    private static Certificate[] getCertificateChain(char[] password) throws Exception {
        Certificate[] certChain = null;
 
        KeyStore p12 = KeyStore.getInstance("pkcs12");
        p12.load(new FileInputStream(cert), password);
 
        Enumeration<String> aliases = p12.aliases();
        while (aliases.hasMoreElements()) {
            String alias = aliases.nextElement();
            if (p12.isKeyEntry(alias)) {
                certChain = p12.getCertificateChain(alias);
                break;
            }
        }
        return certChain;
    }
 
    public static void main(String[] args) throws Exception {
        fun();
    }
}

源文件：1.pdf

 数字签名后的文件：sign.pdf