在服务器上对 PDF 进行数字签名
我有一个使用 ASP.NET (C#) 在服务器上生成 PDF 的项目。但现在我们需要客户能够对这些 PDF 进行数字签名。据我所知，文档必须在客户端使用小程序进行签名，因为在服务器中我无法访问证书的私钥，但正如我上面所说，PDF是在服务器上生成的，我把它们留在那里。
所以，我需要的是在服务器上对 PDF 进行数字签名，获取客户端的证书。
谢谢
I have a project to generate PDFs on a server using ASP.NET (C #). But now we need the customer to be able to digitally sign these PDF. From what I saw, the documents must be signed at the client side, using an applet, as in the server I have no access to the private key of the certificate, but as I said above, the PDFs are generated on the server and I keep them there.
So, what I need is to digitally sign PDFs on the server, taking the client's certificate.
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
由于提取和发送客户端的私钥是不可能或安全的，因此要在服务器上签署 pdf，您需要与客户端建立“会话”并让他们计算签名。
步骤应该类似于：
客户端发送他的公共证书以嵌入到签名的 pdf 中
服务器生成pdf，嵌入证书并计算哈希值（例如：sha1）
服务器将哈希值发送到客户端小程序
小程序用她的私钥计算数字签名
小程序将签名发送到服务器
服务器嵌入数字签名并关闭 pdf。
要使用 itext 执行此操作，您必须在嵌入证书后使用 preclose 方法，以便能够计算最终文档的 sha1 哈希值。
然后在预关闭 pdf 后，您必须计算 pdf 的哈希值并将其发送给客户端。
请注意：在预先关闭时，您必须将文档保存在内存中，例如在服务器会话中。
要生成 pdf、嵌入证书并准备文档，您可以使用 itextsharp（itext 库的 C# 端口）。要计算哈希值并创建 pkcs7 信封，您可以使用 .net crypto api。
希望这有帮助。
Since it is not possible or anyway safe to extract and send the client's private key, to sign pdfs on the server you need to establish a "session" with the client and let them calculate the signature.
The steps should be something like:
the client sends his public certificate to be embedded in the signed pdf
the server generates the pdf, embeds the certificate and calculates the hash (eg: sha1)
the server sends the hash to the client applet
the applet calculates the digital signature with her private key
the applet sends the signature to the server
the server embeds the digital signature and closes the pdf.
To do this with itext you will have to use the preclose method after ambedding the certificate, so to be able to alculate the sha1 hash on the final document.
Then after pre-closing the pdf you will have to calculate the hash of the pdf and send it to the client.
Be careful: while preclosed you will have to keep the document in memory, for example in a server session.
To generate the pdf, embed certificates and prepaare the document you can use itextsharp, the c# port of the itext library. To calculate the hash and create the pkcs7 envelopes you can use the .net crypto api.
Hope this helps.
您可能忽略了对文档进行数字签名的要点。签署文档的行为是一项用户活动。
您可以在服务器端创建文档并使用内容类型“application/pdf”提供该文档，这将提供要签名的文档。当他们签名时，您可以使用 pdf 表单提交将签名的文档提交回服务器。
You might be missing the point of digitally signing a document. The act of signing a document is meant to be a user activity.
You can create the document on the server side and serve it with the content-type "application/pdf" and that will serve the document to be signed. When they sign it you can use pdf form submit to submit the signed document back to the server.
AspPdf + USB Network Gate 或 AnywhereUSB如果客户在其计算机上使用 USB 智能卡，可能会有所帮助。
AspPdf + USB Network Gate or AnywhereUSB might help if the client uses USB smard card on their machine.
您还可以使用签名服务，例如（抱歉，我只知道这个有效）http://www.signagate .de - 这些人提供了一项 Web 服务，使您能够“上传”未签名的 pdf，该 PDF 将以所谓的“中间”签名发回，该签名甚至符合欧盟的所有签名法，作为合格的签名签名（至少据我所知是发票）。
有趣的是，您只需要能够对他们的服务进行后调用即可获得 pdf 签名作为答案。
因此，“中间”事物允许您（从法律角度来看）不在世界范围内推广私钥等，而是在您的 PDF 上获得有效签名，并通过对该公司的签名服务进行适当的身份验证来保持法律需求。
吉米
you can also use a signing service like (I'm sorry, I just know this one as working) http://www.signagate.de - these guys offer an Web service that enables you to 'upload' an unsigned pdf which will be sent back with an so called 'intermediate' signature that is conforming to even all signature laws in the EU as a qualified signature (at least for invoices as I know).
The fun is, you just need to be able to do a post call to their service to get the pdf singed back as answer.
So the 'intermediate' thing allows you (from a legal view) to NOT promote the private key etc. around the world but getting a valid signature on your PDF and keeping so the legal needs by a proper authentication to the signature service of this company.
Jimmy