具有多个签名的数字签名 PDF 过期
上下文
我的总体目标是提供一组 PDF，以便用户可以确信文档的来源（即，它们来自预期的来源） ）。我正在考虑通过在服务器上对 PDF 进行数字签名来实现此目的。这些签名不会有过期的风险，因为服务器可以在证书更新时重新颁发新签名的 PDF。使用 SSL 来提供文档是不够的，因为这些文件可以传递给不想/不需要访问服务器的第三方。
问题
出现过期问题是因为其中一些 PDF 已经具有一个或多个数字签名（例如，为合法目的而创建）。我的问题是，如果服务器对 PDF 进行签名，只要最新的签名有效，它是否也会确保以前的签名持续有效，即使它们过期后也是
如此 ？在理论方面，虽然我计划使用 iText 来实现我所描述的内容，所以也欢迎任何关于如何将它用于我的目的的指示。
Context
My overall goal is to make a set of PDFs available, in such a way that users can be assured of the provenance of the documents (i.e., they came from the origin that they are expected to come from). I'm thinking about doing this by digitally signing the PDFs on the server. These signatures won't be in risk of expiring, because the server can just reissue new signed PDFs when the certificate is updated. Using SSL to serve the documents wouldn't be enough, because the files can be passed on to third parties, who don't want/need to access the server.
Problem
The expiration issue arises because some of these PDFs will already have one or more digital signatures (e.g., created for legal purposes). My question is, if the server signs the PDFs, will it also be ensuring the continued validity of the previous signatures, even after they expire, as long as the latest signature is valid?
I'm asking more on the theoretical side, although I plan to implement what I describe using iText, so any pointers on how to use it for my purpose are also welcome.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
不可以，PDF 中的所有签名均应独立验证。如果您在 Adbobe Reader 中打开具有多个签名的 PDF，所有签名都会经过验证，如果其中一个签名验证失败，您将收到一条警告消息。
如果您想防止签名验证问题（例如由于签名证书过期而导致验证失败），您应该查看 PAdES 标准（PDF 高级电子签名）第 4 部分（PAdES-LTV 配置文件 - PAdES 长期验证）。标准的这一部分涉及维护跨时间验证的证明，以便将来能够重新验证签名。
我不太了解 iText，但似乎支持 PAdES-LTV，因为我发现了此代码示例： 如何根据PAdES-LTV申请验证
No, in a PDF all signatures should be validated independently. If you open a PDF with multiple signatures In Adbobe Reader all signatures are validated and you are going to get a warning message if one of the signature validations fails.
If you want to prevent against signature validation issues (for instance a validation failure due to signing certificate expiration) you should look at the PAdES standard (PDF Advanced Electronic Signature) Part #4 (PAdES-LTV Profile - PAdES Long Term Validation). This section of the standard deals with maintaining a proof of the validation across time in order to be able to revalidate the signatures in the future.
I don't know iText very much but it seems that PAdES-LTV is supported since I found this code sample : How to apply verification according to PAdES-LTV