我需要使用 Windows 证书存储区中存在的证书签署 PDF 文档。我一整天都在四处寻找,试图找出答案,而我如此接近却如此遥远。
所缺少的是:如何获取 IExternalSignature 对象来签署 PDF 文件?
Rahul Singla 编写了一个关于如何使用新的 iText 5.3.0 API 签署 PDF 文档的精美示例 - 只要您可以访问 PC 上某处的 .pfx 文件。
有一个关于使用 Windows 证书存储中的证书进行签名的之前的问题,只不过它使用的是
SetCrypto
仍然存在的 API 版本,并且签名显然是可选的。在 iText 5.3.0 中,API 发生了变化,SetCrypto
不再是一个东西了。
这是我到目前为止所得到的(为后代添加评论,因为这可能是如何在“网络上执行此操作的最完整和最新版本”):
using iTextSharp.text.pdf;
using iTextSharp.text.pdf.security;
using BcX509 = Org.BouncyCastle.X509;
using Org.BouncyCastle.Pkcs;
using Org.BouncyCastle.Crypto;
using DotNetUtils = Org.BouncyCastle.Security.DotNetUtilities;
...
// Set up the PDF IO
PdfReader reader = new PdfReader(@"some\dir\SomeTemplate.pdf");
PdfStamper stamper = PdfStamper.CreateSignature(reader,
new FileStream(@"some\dir\SignedPdf.pdf", FileMode.Create), '\0');
PdfSignatureAppearance sap = stamper.SignatureAppearance;
sap.Reason = "For no apparent raisin";
sap.Location = "...";
// Acquire certificate chain
var certStore = new X509Store(StoreName.My, StoreLocation.LocalMachine);
certStore.Open(OpenFlags.ReadOnly);
X509CertificateCollection certCollection =
certStore.Certificates.Find(X509FindType.FindBySubjectName,
"My.Cert.Subject", true);
X509Certificate cert = certCollection[0];
// iTextSharp needs this cert as a BouncyCastle X509 object; this converts it.
BcX509.X509Certificate bcCert = DotNetUtils.FromX509Certificate(cert);
var chain = new List<BcX509.X509Certificate> { bcCert };
certStore.Close();
// Ok, that's the certificate chain done. Now how do I get the PKS?
IExternalSignature signature = null; /* ??? */
// Sign the PDF file and finish up.
MakeSignature.SignDetached(sap, signature, chain, // the important stuff
null, null, null, 0, CryptoStandard.CMS);
stamper.Close();
如你所见:我除了签名之外什么都有了,我不知道如何获得它!
X509Certificate cert = certCollection[0]; // Your code
X509Certificate2 signatureCert = new X509Certificate2(cert);
var pk = Org.BouncyCastle.Security.DotNetUtilities.GetKeyPair(signatureCert.PrivateKey).Private;
如果你有pk,可以通过上面的方法得到,你可以按如下方式创建一个IExternalSignature:
IExternalSignature es = new PrivateKeySignature(pk, "SHA-256");
您还可能找到以下使用文章:
public byte[] SignPdf(byte[] pdf)
{
using (MemoryStream output = new MemoryStream())
{
//get certificate from path
X509Certificate2 cert1 = new X509Certificate2(@"C:\temp\certtemp.pfx", "12345", X509KeyStorageFlags.Exportable);
//get private key to sign pdf
var pk = Org.BouncyCastle.Security.DotNetUtilities.GetKeyPair(cert1.PrivateKey).Private;
// convert the type to be used at .SetCrypt();
Org.BouncyCastle.X509.X509Certificate bcCert = Org.BouncyCastle.Security.DotNetUtilities.FromX509Certificate(cert1);
// get the pdf u want to sign
PdfReader pdfReader = new PdfReader(pdf);
PdfStamper stamper = PdfStamper.CreateSignature(pdfReader, output, '\0');
PdfSignatureAppearance pdfSignatureAppearance = stamper.SignatureAppearance;
//.SetCrypt(); sign the pdf
pdfSignatureAppearance.SetCrypto(pk, new Org.BouncyCastle.X509.X509Certificate[] { bcCert }, null, PdfSignatureAppearance.WINCER_SIGNED);
pdfSignatureAppearance.Reason = "Este documento está assinado digitalmente pelo Estado Portugues";
pdfSignatureAppearance.Location = " Lisboa, Portugal";
pdfSignatureAppearance.SignDate = DateTime.Now;
stamper.Close();
return output.ToArray();
}
}
我使用此代码获取
byte[]
PDF 并再次返回已签名的 byte[]
PDF。
它是 iTextSharp-LGPL。
请下载有关PDF 和数字签名的书籍。您将在第 3 章中找到有关如何使用 Windows 证书存储进行签名的 Java 示例。如您所见,您需要 Windows-MY 密钥存储。
现在转到我们发布了这些示例的 C# 端口的存储库。查找 C3_11_SignWithToken.cs。
X509Store x509Store = new X509Store("My");
x509Store.Open(OpenFlags.ReadOnly);
X509Certificate2Collection certificates = x509Store.Certificates;
IList<X509Certificate> chain = new List<X509Certificate>();
X509Certificate2 pk = null;
if (certificates.Count > 0) {
X509Certificate2Enumerator certificatesEn = certificates.GetEnumerator();
certificatesEn.MoveNext();
pk = certificatesEn.Current;
X509Chain x509chain = new X509Chain();
x509chain.Build(pk);
foreach (X509ChainElement x509ChainElement in x509chain.ChainElements) {
chain.Add(DotNetUtilities.FromX509Certificate(x509ChainElement.Certificate));
}
}
x509Store.Close();
如果我理解正确的话
chain
和 pk
是您正在寻找的变量;
我也有同样的问题,你能发布一下你是如何解决你的问题的吗?如果不是太烦人的话,你能分享一下签名代码吗?