how reliable the signed PDF. (c#, Itextsharp )
I sign a PDF file with a USB token I received from GlobalSign. However I cannot see any icon by Adobe indicating that the certificate is valid.
The USB token I received from GlobalSign is a trustable (secure/trust) certificate. But I am not sure why I cannot see the trusted/secure certificate icon.
Signed PDF is as shown below:
I can also see the signing of this icon from Adobe Acrobat DC:
ICollection<ICrlClient> crlList = new List<ICrlClient> { new CrlClientOnline(chain) };
ICrlClient crl = new CrlClientOnline(chain);
IOcspClient ocsp;
ocsp = new OcspClientBouncyCastle();
//var sdf0= ocsp.GetEncoded(chain[0] , chain[1], "http://ocsp2.globalsign.com/gsalphag2");
PdfReader r = new PdfReader(hedefPDFpath + "Emre.pdf");
FileStream fos = new FileStream(hedefPDFpath + "Emre" + fi.Name, FileMode.Create);
PdfStamper stp = PdfStamper.CreateSignature(r, fos, '\0', null, true);
LtvVerification v = stp.LtvVerification;
AcroFields fields = stp.AcroFields;
List<String> names = fields.GetSignatureNames();
String sigName = names[names.Count - 1];
PdfPKCS7 pkcs7 = fields.VerifySignature(sigName);
if (pkcs7.IsTsp)
v.AddVerification(sigName, ocsp, crl, LtvVerification.CertificateOption.SIGNING_CERTIFICATE, LtvVerification.Level.OCSP_CRL, LtvVerification.CertificateInclusion.YES);
else foreach (String name in names)
v.AddVerification(name, ocsp, crl, LtvVerification.CertificateOption.WHOLE_CHAIN, LtvVerification.Level.OCSP_CRL, LtvVerification.CertificateInclusion.YES);
PdfSignatureAppearance sap = pdfStamper.SignatureAppearance;
MakeSignature.SignDetached(signatureAppearance, externalSignature, chain, crlList, ocsp, TsaCliente, estimatedSize, CryptoStandard.CMS);
The OP clearified in a comment:
how reliable/trusted the signed PDF? how the blue ribbon placed in the pdf globalsign.com/en/resources/CDS_OCSP_Services.pdf
Thus, the OP essentially is trying to do as GlobalSign asks him to in that flyer:
And doesn't find the exact pendant on documents he signed with his GlobalSign device and iTextSharp.
There are three aspects to consider here:
- Different types of PDF signatures
- Different Adobe Reader versions
- Trust in signatures in general
Types of PDF signatures
According to the PDF specification ISO 32000-1:
A PDF document may contain the following standard types of signatures:
- One or more approval signatures. [...]
- At most one certification signature (PDF 1.5). [...]
- At most two usage rights signatures (PDF 1.5).
The usage rights signatures are not of interest here because they essentially only are a tool by which extra features in PDF viewers can be activated for PDFs generated using particular software packages, e.g. features in Adobe Reader activated for PDFs generated by certain Adobe software.
Approval and certification signatures, on the other hand, can both be of interest to you. The differences:
certification signature
- If a PDF shall have one, it must be the first signature in it.
- It in particular is meant for the author / source of a document to announce authorship and carries the information which later changes to the document shall be allowed.
- Some PDF viewers may choose to have higher security requirements to certificates used for certification than for approval.
approval signature
- Unless forbidden by a certification signature in a PDF, there may be any number of approval signatures in it.
- It can be used for different purposes; an author does not need to use a certification signature, he can alternatively use an approval signature and use a signing "Reason" like "I authored this document"; it can also only mean that the person in question read the document; or anything in between. Thus, be sure to use the signing "Reason" to indicate what you want to express with your signature.
Considering the OP's images, this one represents an approval signature:
and this one a certification signature:
iTextSharp can create both types, cf. PdfSignatureAppearance.CertificationLevel.
Considering your code, though, it is clear that you have already signed PDFs as input and now want to add validation information for those prior signatures and then sign yourself. Thus, your signature is not the first in the document and, therefore, cannot be a certification signature.
Validation result display in Adobe Reader
Just like the general UI of Adobe Reader changes every few major versions, so do the specific UI elements it uses to represent the result of signature validation.
E.g. for the GlobalSign document you linked you see at least up to Adobe Reader 9 the blue ribbon bar and the blue rosette it advertises:
but in Adobe Reader DC it looks different
As the GlobalSign flyer dates back to 2007, they obviously did not have any idea how Adobe would display ribbon and rosette now, nearly 9 years later.
GlobalSign could of course update their documentation. In particular, if they had pointed the OP towards the flyer, they'd have done a lousy job.
Trust in digital signatures
The OP wonders
how reliable/trusted the signed PDF
In contrast to what the GlobalSign flyer tells us, the question which signature to trust cannot generally be answered by saying "open the file in Adobe Reader and look for this or that symbol."
Which signatures you can trust, depends very much on the legal context. You usually only want to trust digital signatures which (if the matter eventually is dealt with at court) will be accepted as evidence.
Adobe for a long time by default only trusted signatures by certificates issued by some US American CAs.
Thus, for a long time e.g. in Germany you knew that a signature was a funny gimmick but worthless if you saw that Adobe Reader completely accepted it. If on the other hand Adobe Reader said that the document has not been manipulated but the Reader could not trust the signer identity, it was worth inspecting some more to see whether the signer certificate had been issues by a qualified CA according to the German signature act.
Meanwhile Adobe also accepts certificates issued by CAs on the EUTL (European list of trusted certificate authorities). Thus, nowadays one has to look what Adobe shows as its source of trust.
Thus, to answer your question for your case at hand, one needs to know which is the legal context in which the recipients of your PDF evaluate the signature.