jmarxuach/batchpdfsign

CLI Command line tool to digital signature of PDF files with PKCS12 certificate. You can find the executable in the releases.

BatchPDFSign

Command line tool for digital signature of PDF files, useful for example in Batch processes, from non Java programming languages like Php, Shell scripts, etc...

BatchPDFSign is a command line to sign PDF file with a PKCS12 certificate or with a PKCS11 Hardware Token.

To use it you need:

• a PKCS12 certificate. It should be a <filename>.pfx or <filename>.p12 file.
• a password for the certificate
• and a PDF file to sign.

For PKCS11 version you need:

• a PKCS11 config file. name=MyToken\nlibrary=/path/to/lib.so\n
• a PIN/password for the certificate
• and a PDF file to sign.

self signed certificate creation

You can create your own self signed certificate with this following 4 commands in Ubuntu.

openssl genrsa -aes128 -out myself.key 2048
openssl req -new -days 365 -key myself.key -out myself.csr
openssl x509 -in myself.csr -out myself.crt -req -signkey myself.key -days 365
openssl pkcs12 -export -out myself.pfx -inkey myself.key -in myself.crt

Signing

Synopsis

usage: BatchPDFSignPortable
 -m,--mode <arg>       pkcs12 or pkcs11 (defaults to pkcs12)
 -i,--input <arg>      input file path
 -k,--key <arg>        key file path or pkcs11 config file
 -o,--output <arg>     output file
 -p,--password <arg>   keyfile password or PIN
    --page <arg>       page of signature rectangle; needs to be specified
                       to output signature rectangle
    --fs <arg>         font size of text in signature rectangle (default:
                       12); needs --page to be specified as well
    --rh <arg>         height of signature rectangle; needs --page to be
                       specified as well
    --rw <arg>         width of signature rectangle; needs --page to be
                       specified as well
    --rx <arg>         x position of signature rectangle; needs --page to
                       be specified as well
    --ry <arg>         y position of signature rectangle; needs --page to
                       be specified as well
    --signtext <arg>   signature text; needs --page to be specified as
    --tsa <arg>        URI of the time service authority (TSA) 
    --reason <arg>     Reason field of signature
    --location <arg>   Location field of signature

Mode

PKCS mode operation pkcs12 or pkcs11. Defaults to pkcs12.

key file path

This parameter is the certificate you want to sign the pdf with. It can be generated with the code documented in the chapter self signed certificate creation.

For pkcs11 mode, this file is the config file of the HSM/Token ex: name=MyToken\nlibrary=/path/to/lib.so\n

password

This parameter is the password for the certificate. The password is set during the creation of the certificate file.

For pkcs11 mode, this is the PIN/Password for the certificate.

input file path

The file you want to sign.

output file

If this parameter is set, a new file with this name will be created and signed. The original file will remain untouched.

visible signature

By default, the signature will not be (easily) visible in the final PDF file. If you want to make it easier for users to see, and with that and some GUIs easier to check the signature, you have to specify the location and size of the "signature rectangle". You also have the option to change the font size and to specify your own text.

• --page this option is required if you want the signature to appear. If you give this option, you will also have to specify --rx, --ry, --rw and --rh.
• --rx and --ry specify the location of the signature rectangle
• --rw and --rh specify the width and height of the signature rectangle
• --fs specify the font size of the text within the signature rectangle; 12 by default
• --signtext override the standard text provided by the signature-library with your own, provided text
• --reason Reason field of the signature
• --location Location field of the signature

Development

You'll need:

• Maven
• Java 11 JDK

That's all folks....

batchpdfsign's Issues

Reporting a string of error when running.

I remember when I use it at the beginning of the year, it run successfully.
today, I tried to use it but it said:

D:\home λ gsudo java -jar ..\batchpdfsign-portable.jar -k `pfx` -p `password` -i `pdf` -o `_out.pdf`        
Exception in thread "main" com.itextpdf.kernel.PdfException: Unknown PdfException.
        at com.itextpdf.signatures.PdfPKCS7.getEncodedPKCS7(PdfPKCS7.java:934)
        at com.itextpdf.signatures.PdfSigner.signDetached(PdfSigner.java:648)
        at com.itextpdf.signatures.PdfSigner.signDetached(PdfSigner.java:538)
        at BatchPDFSign.lib.BatchPDFSign.signFile(BatchPDFSign.java:77)
        at BatchPDFSign.portable.Main.main(Main.java:48)
Caused by: java.net.SocketException: Permission denied: connect
        at java.net.DualStackPlainSocketImpl.connect0(Native Method)
        at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)
        at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
        at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
        at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
        at java.net.PlainSocketImpl.connect(Unknown Source)
        at java.net.SocksSocketImpl.connect(Unknown Source)
        at java.net.Socket.connect(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.connect(Unknown Source)
        at sun.security.ssl.BaseSSLSocketImpl.connect(Unknown Source)
        at sun.net.NetworkClient.doConnect(Unknown Source)
        at sun.net.www.http.HttpClient.openServer(Unknown Source)
        at sun.net.www.http.HttpClient.openServer(Unknown Source)
        at sun.net.www.protocol.https.HttpsClient.<init>(Unknown Source)
        at sun.net.www.protocol.https.HttpsClient.New(Unknown Source)
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(Unknown Source)
        at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(Unknown Source)
        at sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source)
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
        at sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(Unknown Source)
        at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(Unknown Source)
        at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(Unknown Source)
        at com.itextpdf.signatures.SignUtils.getTsaResponseForUserRequest(SignUtils.java:280)
        at com.itextpdf.signatures.TSAClientBouncyCastle.getTSAResponse(TSAClientBouncyCastle.java:268)
        at com.itextpdf.signatures.TSAClientBouncyCastle.getTimeStampToken(TSAClientBouncyCastle.java:227)
        at com.itextpdf.signatures.PdfPKCS7.getEncodedPKCS7(PdfPKCS7.java:900)
        ... 4 more

Proposed feature - Add signature field and signature text

Hi,

I'm looking for a program that can detect a signature field in the PDF and sing it. I think it'd be a good feature to add to this program. Could be adding something like --field <arg>, where arg is the name of the field.

For example,
java -jar BatchPDFSignPortable.jar -k mycertificate.pfx -p CertificatePassword -i myfile.pdf -o myfilesigned.pdf --field "Signature" --signtext "Signed by John Doe"

Unfamiliar with java otherwise id do it myself. Great job nonetheless.

Kind regards

Not enough space

Hi Guys !!! What`s Up ? Going Well ? I hope so !!!

When i run over java 17, it it returns to me Not enough space ... What could be ? THANKS

java -jar BatchPDFSignPortable.jar -k pfxfile.pfx -p pfxpwd -i pdfIn.pdf -o pdfOut.pdf

[main] INFO com.itextpdf.signatures.TSAClientBouncyCastle - Timestamp generated: Thu Dec 01 08:52:27 BRT 2022

Not enough space

usage: BatchPDFSignPortable
--fs font size of text in signature rectangle (default:
12); needs --page to be specified as well
-i,--input input file path
-k,--key key file path
-o,--output output file
-p,--password keyfile password
--page page of signature rectangle; needs to be specified
to output signature rectangle
--rh height of signature rectangle; needs --page to be
specified as well
--rw width of signature rectangle; needs --page to be
specified as well
--rx x position of signature rectangle; needs --page to
be specified as well
--ry y position of signature rectangle; needs --page to
be specified as well
--signtext signature text; needs --page to be specified as
well
--tsa URI of the time service authority (TSA)

[Request] Maven Package

A Maven package can be created every time a new version is created.

The feature is already included and just has to be activated.

https://github.com/jmarxuach/BatchPDFSign/blob/master/.github/workflows/maven-publish.yml

ERROR com.itextpdf.kernel.pdf.PdfReader - Error occurred while reading cross reference table. Cross reference table will be rebuilt

@jmarxuach can you try out if version 1.0.5.1 works, because I only removed .useAppendMode().

It Works !! Even if prints the exception

[main] ERROR com.itextpdf.kernel.pdf.PdfReader - Error occurred while reading cross reference table. Cross reference table will be rebuilt.
com.itextpdf.io.IOException: Error at file pointer 46,820.
        at com.itextpdf.io.source.PdfTokenizer.throwError(PdfTokenizer.java:686)
        at com.itextpdf.kernel.pdf.PdfReader.readXrefSection(PdfReader.java:1011)
        at com.itextpdf.kernel.pdf.PdfReader.readXref(PdfReader.java:929)
        at com.itextpdf.kernel.pdf.PdfReader.readPdf(PdfReader.java:677)
        at com.itextpdf.kernel.pdf.PdfDocument.open(PdfDocument.java:1871)
        at com.itextpdf.kernel.pdf.PdfDocument.<init>(PdfDocument.java:324)
        at com.itextpdf.signatures.PdfSigner.initDocument(PdfSigner.java:306)
        at com.itextpdf.signatures.PdfSigner.<init>(PdfSigner.java:288)
        at com.itextpdf.signatures.PdfSigner.<init>(PdfSigner.java:271)
        at BatchPDFSign.lib.BatchPDFSign.signFile(BatchPDFSign.java:75)
        at BatchPDFSign.portable.Main.main(Main.java:48)
Caused by: com.itextpdf.io.IOException: file position {0} cross reference entry in this xref subsection.
        ... 11 more
[main] ERROR com.itextpdf.kernel.pdf.PdfReader - Error occurred while reading cross reference table. Cross reference table will be rebuilt.
com.itextpdf.io.IOException: Error at file pointer 46,820.
        at com.itextpdf.io.source.PdfTokenizer.throwError(PdfTokenizer.java:686)
        at com.itextpdf.kernel.pdf.PdfReader.readXrefSection(PdfReader.java:1011)
        at com.itextpdf.kernel.pdf.PdfReader.readXref(PdfReader.java:929)
        at com.itextpdf.kernel.pdf.PdfReader.readPdf(PdfReader.java:677)
        at com.itextpdf.kernel.pdf.PdfDocument.open(PdfDocument.java:1871)
        at com.itextpdf.kernel.pdf.PdfDocument.<init>(PdfDocument.java:324)
        at com.itextpdf.signatures.PdfSigner.initDocument(PdfSigner.java:306)
        at com.itextpdf.signatures.PdfSigner.<init>(PdfSigner.java:288)
        at com.itextpdf.signatures.PdfSigner.<init>(PdfSigner.java:271)
        at BatchPDFSign.lib.BatchPDFSign.signFile(BatchPDFSign.java:79)
        at BatchPDFSign.portable.Main.main(Main.java:48)
Caused by: com.itextpdf.io.IOException: file position {0} cross reference entry in this xref subsection.
        ... 11 more
[main] INFO com.itextpdf.signatures.TSAClientBouncyCastle - Timestamp generated: Thu Jul 23 14:54:01 CEST 2020

Originally posted by @jmarxuach in #6 (comment)

Location, reason options not recognized

From the documentation:

--reason Reason field of the signature
--location Location field of the signature

However,

Unrecognized option: --reason
Unrecognized option: --location

I would like to use these options. Is it in a development branch only?

Hi, timeout tsa problem.

First of all, thank you for this api.

¿Could you add a timeout to get the tsa ?
Some times it takes 5 minutes to get the response and it's really annoying.

Thank you.

[Request] Updating the About page

The About description of the project still mentions Version 1.0.0.zip which is long outdated.

I propose this:
CLI Command line tool to digital signature of PDF files with PKCS12 certificate. You can find the executable in the releases.

Also adding tags would probably help other people find this project and I think it could be very useful to other people.
I propose the following tags:

• cli
• pdf
• signature
• java-8
• java

Does not sign, the error is displayed: "PdfReader is not opened with owner password" and last "Unknown PdfException."

Does not sign, the error is displayed: "PdfReader is not opened with owner password"

And change line 71 from BatchPDFSign.java, the error responce is: "Unknown PdfException."

Is it possible to add a reason to signature?

Good morning,
I need to add a reason to PDF signatures..... is there a way to do it?
Greetings,
Gonzalo

Maven portable pom.xml has wrong dependency version

The version of the lib dependency in the portable pom.xml is still on 1.0.5, should be 1.0.5.1

Signature validation

how to validate a signed document against a certificate ?

Timestamp server down

The timestamp server seems to be down. Indeed, a wget to https://freetsa.org/tsr fails:

BatchPDFSign/lib/src/main/java/BatchPDFSign/lib/BatchPDFSign.java

Line 71 in f18b65f

ITSAClient tsaClient = new TSAClientBouncyCastle("https://freetsa.org/tsr");

Does someone knows another timestamp server that we can temporarily use to direct, and can we make this a configurable attribute?

com.itextpdf.kernel.PdfException: Append mode requires a document without errors, even if recovery is possible

Searching in google I found this that suggest there is a bug in itext7, but im not sure.

I have a PDF that throws this error, but i can't attach because is confidential.

New functions

I would like to request two options.
1st - Have the possibility of disabling the use of TSA.
2nd - Have the possibility of inserting variables in the personalized signature text, such as: Electronically signed by ${signer}, ${timestamp}, ${location},
${reason}, ${contact}