itextdigital-signaturetrusted-timestamprfc3161

PDF signing with timestamp: certificate details does not appear in timestamp properties


I have a code that implements TSA server in format RFC 3161. When I try to sign PDF file with timestamp using TSAClientBouncyCastle, I receive a signature where certificate details doesn't appear

enter image description here

Somebody know how to solve that?

I can post the code here, but I don't know which part of it. It would be nice if someone could guide me to a specific section in the RFC, then I will post the relevant part of the code and we can discuss about it. Thanks in advance

Link to sample pdf file https://drive.google.com/file/d/0B61KdyZ43x-9cEk5YVV6WVd4WUU/view?usp=sharing


Solution

  • The reason why certain timestamp authority details do not appear is indicated in the Signature Properties dialog beneath the Advanced Signature Properties dialog you have in front in your screenshot:

    The signature includes an embedded timestamp but it is invalid.

    Thus, you do not only have to inspect your PDF signing code but also your code that implements TSA server in format RFC 3161 or the certificates it uses.

    The TSA certificate

    Your TSA certificate is invalid.

    Digging through your signature, I eventually had a look at the certificates. As it turns out, you seem to use the same certificate for signing the signature and the time stamp. This cannot work!

    Cf the specification:

    The TSA MUST sign each time-stamp message with a key reserved specifically for that purpose. A TSA MAY have distinct private keys, e.g., to accommodate different policies, different algorithms, different private key sizes or to increase the performance. The corresponding certificate MUST contain only one instance of the extended key usage field extension as defined in [RFC2459] Section 4.2.1.13 with KeyPurposeID having value:

    id-kp-timeStamping.  This extension MUST be critical.
    

    (Section 2.3.* Identification of the TSA *of RFC3161)

    Your user certificate in particular does not have the required extended key usage marking it as a time stamping certificate.