Java ittext pdf延迟签名，签名无效

现有代码无法成功签署PDF，因为它需要签署者证书才能签署，而iAM Smart签署服务(最终将使用代码)仅提供证书和签名.

这种只返回签名者证书和签名字节的签名服务通常很难用于PDF签名，因为大多数CMS签名容器生成器期望在开始组装待签名属性并请求签名之前访问所有数据(显然签名字节除外).对于PAdES PDF签名的特殊情况，它们甚至根本不能被使用，因为PAdES基线签名要求在待签名属性中提供有关签名者证书的信息.

在 comments 中，幸运的是，iAM Smart服务还提供了返回一个完整的PKCS#7对象(即CMS签名容器)的功能，该对象明确描述用于PDF签名.如果您使用此服务功能，您可以简化现有代码，并使用其使用iText签署PDF，如下所示:

File origFile = new File("deferredContainerSigningOriginal.pdf");
File tempFile = new File("deferredContainerSigningTemp.pdf");
File resultFile = new File("deferredContainerSigningResult.pdf");
String fieldName = "Signature";

byte[] hash = null;

try (
    OutputStream tempOutput = new FileOutputStream(tempFile)
) {
    PdfReader pdfReader = new PdfReader(origFile.getPath());
    hash = prepareAndHashForSigning(pdfReader, tempOutput, fieldName);
}

// execute your signature container request for the calculated hash here 
byte[] signatureContainer = retrievePkcs7ContainerForHash(hash);

try (
    OutputStream resultOutput = new FileOutputStream(resultFile)
) {
    PdfReader pdfReader = new PdfReader(tempFile.getPath());
    injectPkcs7Container(pdfReader, resultOutput, fieldName, signatureContainer);
}

使用以下helper方法和类:

/**
 * This method adds a signature field to the given PDF and sets its value signature
 * dictionary. The placeholder for the signature container therein is filled with 0s.
 * 
 * @return the hash of the signed byte ranges of the added signature.
 * @see #testExternalSignatureContainer()
 */
byte[] prepareAndHashForSigning(PdfReader pdfReader, OutputStream outputStream, String fieldName) throws DocumentException, IOException, GeneralSecurityException {
    PdfStamper pdfStamper = PdfStamper.createSignature(pdfReader, outputStream, (char) 0);
    PdfSignatureAppearance pdfSignatureAppearance = pdfStamper.getSignatureAppearance();
    pdfSignatureAppearance.setVisibleSignature(new Rectangle(50, 680, 144, 780), 1, fieldName);

    ExternalSignatureContainer blankContainer = new ExternalBlankSignatureContainer(PdfName.ADOBE_PPKLITE, PdfName.ADBE_PKCS7_DETACHED);
    MakeSignature.signExternalContainer(pdfSignatureAppearance, blankContainer, 12000);
    InputStream rangeStream = pdfSignatureAppearance.getRangeStream();
    BouncyCastleDigest bouncyCastleDigest = new BouncyCastleDigest();
    byte[] hash = Digest算法rithms.digest(rangeStream, bouncyCastleDigest.getMessageDigest("SHA256"));
    return hash;
}

/**
 * This method sets the signature container placeholder in the signature dictionary
 * value of the signature field with the given name.
 * 
 * @see #testExternalSignatureContainer()
 */
void injectPkcs7Container(PdfReader pdfReader, OutputStream outputStream, String fieldName, byte[] signatureContainer) throws DocumentException, IOException, GeneralSecurityException {
    ExternalSignatureContainer injectingContainer = new InjectingSignatureContainer(signatureContainer);
    MakeSignature.signDeferred(pdfReader, fieldName, outputStream, injectingContainer);
}

/**
 * This is a dummy method that returns the given hash itself instead of a signature
 * container for it. Obviously, it is not for production purposes.
 * 
 * @see #testExternalSignatureContainer()
 */
byte[] retrievePkcs7ContainerForHash(byte[] hash) {
    return hash;
}

/**
 * This {@link ExternalSignatureContainer} implementation returns a pre-generated
 * byte array in its {@link #sign(InputStream)} method.
 */
static class InjectingSignatureContainer implements ExternalSignatureContainer {
    final byte[] signatureContainer;

    public InjectingSignatureContainer(byte[] signatureContainer) {
        this.signatureContainer = signatureContainer;
    }

    @Override
    public byte[] sign(InputStream data) throws GeneralSecurityException {
        return signatureContainer;
    }

    @Override
    public void modifySigningDictionary(PdfDictionary signDic) {
    }
}

(100 test)

这一切与您的代码非常相似，代码已经实现了许多正确的概念，但最终不得不使用不适当的签名服务功能.

请注意，我还修改了一些常量，特别是我将签名容器保留的大小从8192增加到12000(因为你提供的示例签名容器已经是10462大)，并且我将矩形的坐标更改为高0.