[SOLVED] iText7 breaks PAdES signature when filling in fields

iText7 breaks PAdES signature when filling in fields

I have a PDF with a valid PAdES signature applied. This PDF has also a TextField yet to be filled in and another SignatureField, to apply another PAdES (the use case is a multi signer workflow).

When I try to set the value of the TextField, by using

       field.setValue("TEST", font, 0f);

and then closing the Document, the output PDF has the PAdES signature broken. It has the value "TEST" inside the TextField, but it breaks the PAdES.

Is there any way to fill in a TextField inside a PDF that has been previously signed using PAdES without breaking the signature?

From the point of view of the standard this should be possible. For example, if I fill in the field using Adobe Acrobat the previous signature does not break.

Thanks in advance for the help

Saludos

Solution

To add something to a signed PDF without mathematically breaking the signature, you must append it in an incremental update without changing any byte of the original PDF revision. In iText version 7 and 8 such incremental updates are generated by activating append mode in the StampingProperties:

PdfDocument pdfDoc = new PdfDocument(
    new PdfReader(src),
    new PdfWriter(dest),
    new StampingProperties().useAppendMode());
...
pdfDoc.close();

There are further requirements for having validators accept after-signature changes. For example, depending on the certification value of the existing signature(s), only certain changes are allowed, see this answer. Also small errors in the original PDF which PDF viewers usually ignore, suddenly may cause any attempt to add an update to be rejected. But without using append mode any change automatically will invalidate signatures.