30
Replies
Can you pls suggest other validation services pls!! it would be of great help.
Suggesting other validation services makes only sense after inspecting the signed PDF in which Adobe Acrobat sees "illegal data".
Thus, please share an representative example of your problem PDFs for analysis. Depending on the analysis result, a suggestion may be possible.
Hello, is there any sloution? My file freezes so much 😞
As @Keshav_pki, @Ravinder5FC4, and @Red5E0F could not share example documents, there was no solution for them.
In @rossi.nicolas' case his file simply was completely broken (and apparently broken by a signing software that worked incorrectly), so the solution there was to sign using an application that does sign correctly.
As long as you don't share an example PDF that's representative for your issue, you're unlikely to find any analysis let alone solution here.
Now we ... make the digital signature using node-signpdf libary to sign the document and we are having another problem in the process. If we try to sign a pdf that was signed previously with Acrobat for example and after that we use node-signpdf we have a diferent /type/sig section. ...
I don't really understand the issue:
- Are the entries of your new signature dictionary in another order than those of the old signature? That would be harmless, as long as name/value pairs remain together, the order of the pairs is arbitrary.
- Or has the dictionary of the old signature changed, too? That indeed would be bad, the whole original PDF must remain unchanged in the new one.
Unfortunately I don't know node-sign at all, so I cannot tell you how to use it. Just make sure that it adds the new signature in an incremental update of the PDF, at least if there already are signatures in the PDF.
There are some errors in your signed PDF:
- The ByteRange entry is incorrect. For signatures in general the signed byte ranges should be exactly the whole signed revision except the value of the signature Contents key, and for PAdES signatures they must be - and Adobe Acrobat only accepts signatures with byte ranges of that kind. Your signed ranges are a bit off, though:
...
The Contents value starts at 0x3521 = 13601 but according to your ByteRange value it should start at 13589. Similarly it ends at 0x40db = 16603 but it should end at 16591.
- Your signed attributes are not properly DER encoded:
The algorithm SHA256 is the DEFAULT value of the signingCertificateV2 attribute. Thus, it must be left out of the DER encoding.
(There might be more issues but these two lept to the eye.)
Adobe Acrobat is very sensitive in regard to the ByteRange value but probably not in regard to the DER encoding. Other validators, though, may also insist on proper DER encoding.
Please take a look at the details of the signature properties:
"The dopcument has not been modified since the signature was applied." Thus, the signature now mathematically is ok (except for the non-DER encoding of the signingCertificateV2 attribute; as mentioned above, though, Adobe is quite lax in this regard). The remaining problem is your certificate, it is not meant for creating document signatures:
As you can see its Key usage is "Sign CRL, Sign Certificate (CA)" which are values apropriate for root or intermediate certificate authority certificates but not for end user certificates that are meant to sign documents (PDFs, e-mails, whatnots).
You may want to take a look here: If your certificate has a key usage extension, it must contain "nonRepudiation" or "digitalSignature" among its values.
AdChoices