[WDXX] PDFSign

Hi,

has anybody used PDFSign ever before ?

And if Yes, which certificate has you used ? So far I can see all certificates which Adobe accepts come with a token and the user must type a password before he can use it. I need as for a windows service (without User Interface of course).

regards Michael

regards Michael

Hi:

I use a .pfx file with a password and I have a specific path.
From the application I do:

pdfSig is pdfSignature;
pdfSig..Certificate = CertificateLoad("C:\\certificates\\certifFile.pfx", "myPassword")[1];
// --- Rest of propertyes.
PDFSign("MyFile.pdf", pdfSig);

Best regards.

I have used it without problems in WX, the problem is the certificate used.
If you use advance certificates you don't need to use PIN, if you use qualified certificates (normally in USB or card) you need to use the PIN.

In my country (Portugal) the advanced certificates will be discontinued at the end of the year,. The CAs will only isue qualified certificates.

I never tested but it's possible to use qualified cedrtificates in the cloud.
The API is defined in the Cloud Signature Consortium site (https://cloudsignatureconsortium.org/)

If you test the use of certificates with the CSC API in the future please share your findings.

I oppened one post at the beginning of the year regarding the use of the CSC API but i didn't receive any reply
[www.wxforum.info]

Regards

Paulo Oliveira



Edited 3 time(s). Last edit at 09/08/2020 06:28PM by pao.

Hi Paulo,

many thx for your reply.

One Question:

As far I can see, anything at [cloudsignatureconsortium.org] is in test mode ? Or is it possible to use it now ?
Where can I buy the cerificates or is it free ? But I can´t see where I can put a request for a certificate.

regards Michael

Hi Michael,
As far as i know you can use it in production with almost every CA, just ask before you buy the certificate.
we buy the certificates to sign the invoices. If it's a self-signed certificate you don't have tihs problem.
With the free CA like letsencrypt and so on i don't know how it works and if it's possible to issue certificates to sign documents.

Regards

Paulo Oliveira

Hi,

In our company we use the SafeNet eToken 5110 (usb) to sign the documents with JsignPdf software to do the job.
Is it possible to use it with WD sign functions?
If yes how can be done?

Regards

Vassilis Boutsikas

WD- Yes - Check this help pages
[doc.windev.com] [doc.windev.com] [doc.windev.com]
WB - ???? - The USB dongle must be in the server and i don't know if it's possible to select the correct certificate, certificateselect can't be used.
WM - No

Regards

Paulo Oliveira

Hi Paulo,

Thank you for the help. I asked this because some months ago, I asked PCsoft for the same thing and they answered to me that is not possible.
As you can undestrand I'm confused...

Regards

Vassilis Boutsikas

In potugal we have to sign all the invoices and we do it in windev without problems. We use one signture control but we have tested the pdfsign function and it works as well,
We are still using advanced certificates (no need of PIN and USB token) but we must change to the qualified ones.until June/2021

In attach is one pdf signed with the pdfsign and the code used to test was:
mycert is Certificate
arrCertificate is array of Certificates
arrCertificate = CertificateLoad("C:certs\invoice_cert.pfx","xxxxxxxxxxxxxxx")
mycert = arrCertificate[3]
IF mycert..Name = "" THEN
Info("You must select one certificate.")
RETURN
END
IF mycert..ValidForSignature = False THEN
Info("The selected certificate cannot be used to generate a signature.")
RETURN
END
MySignature is pdfSignature
MySignature..Certificate = mycert
MySignature..Caption = "Signed by "+mycert..Name+" Issuer "+mycert..Issuer+" SerialNumber "+mycert..SerialNumber
MySignature..X=1
MySignature..Y=1
MySignature..Width=200
MySignature..Height=5
IF NOT PDFSign(CompleteDir(fExeDir())+"TST_PDF_SIGN.PDF", MySignature) THEN
Info("Error in PDFSign",ErrorInfo())
RETURN
END

Regards

Paulo Oliveira



Edited 1 time(s). Last edit at 09/08/2020 12:23PM by pao.

Dear Paulo,

Thank you for the code.

The SafeNet eToken 5110 uses qualified certificates and we use password.
So, as I can understand the CertificateLoad / CertificateSelect will work (correct me if I'm wrong).
In this case the certificate *.pfx file is still located in the disk?

Regards

Vassilis Boutsikas

No. The certificate is not on disk when using the USB token.
To use the USB token just use the CertificateSelect function instead of the CertificateLoad, We tested in windows 10 with one USB token and it works.
[doc.windev.com]

We are using the advanced certificates because we need to generate the invoices and send it by email in the server and not in the PC, The invoices are generated by one service and sent over night. The USB token is not an option for us.

Regards

Paulo Oliveira



Edited 1 time(s). Last edit at 09/08/2020 12:39PM by pao.

Paulo,

One last question.

How I can use the Password?

Regards

Vassilis Boutsikas

In our tests with the USB token the only thing we have to use was the PIN and when you select the certificate to use from the list presented by the certificateselect the OS asks for it.

PS: the test was done several months ago and my memory isn't as good as it was. test it yourself, my answer can be wrong.

Regards

Paulo Oliveira

Dear Paulo,

Thank you very very much for the huge help.
You make my day with your clarified and detailed info.

Best Regards

Vassilis Boutsikas

Hi Paulo,

mhh, I am a little bit confused.

What I have done till now:

1. Buy a certificate from any CA
2. Downloaded it and save it on my disk
3. Use PDFsign with this certificate
4. It Works, but Adobe says "Some certificates must checked" because my certificate is not a qualified or advanced certificate and Adobe and other PDF Viewer don´t trust them

If I understand your post right I have now to do:

1. Buy a certificate from any CA and ask them if they has heard from CSC ever before and provide the API ?
2. Use the CSC Api to sign the pdf
3. Adobe and other trust them now ?

Its so correct ?

regards Michael

Yes, you are correct.
Must of the CA provide their own solution and API to sign documents using some middleware.
I'm refering the CSC API because it's suposed to be a standard/open solution.
You can see in this CA (we use their certificates) site that they provied qualified certificates for invoice and other pdf signing in 3 ways,

[www.multicert.com]

Regards

Paulo Oliveira

Thx Paulo.

Now I understand.

regards Michael

Dear Paulo,

I tested the CertificateSelect() in Win10, but the OS did'nt asked for the PIN when I selected the certificate.
What am I missing ?

Regards

Vassilis Boutsikas

I really don't know.
I don't have access to the USB token to test it again because i'm working from home and the USB token is at the office.
Unfortunatly our office is closed and i don't know when it will reopen.

Sorry

Regards

Paulo Oliveira



Edited 2 time(s). Last edit at 09/14/2020 01:45PM by pao.

Hi Vassilis,
Sorry for the late response.
The OS (WIN10-20H2 64 bits) only asks for the PIN in the PDFSIGN function, it didn't ask in the CERTIFICATESELECT

My Test code:
mycert is Certificate = CertificateSelect()
// Cancelation or error
IF mycert..Name = "" THEN
Info("You must select one certificate.")
RETURN
END
// Checks whether the selected certificate is valid for signing
IF mycert..ValidForSignature = False THEN
Info("The selected certificate cannot be used to generate a signature.")
RETURN
END
MySignature is pdfSignature
MySignature..Certificate = mycert
MySignature..Caption = "Signed by "+mycert..Name+" Issuer "+mycert..Issuer+" SerialNumber "+mycert..SerialNumber
MySignature..X=1
MySignature..Y=1
MySignature..Width=200
MySignature..Height=5
// THIS IS WHERE THE OS ASKS FOR THE PIN
IF NOT PDFSign(CompleteDir(fExeDir())+"TST_PDF_SIGN.PDF", MySignature) THEN
Info("Error in PDFSign",ErrorInfo())
RETURN
END

Regards

Paulo Oliveira



Edited 1 time(s). Last edit at 10/30/2020 01:11PM by pao.

Deal Paulo,

You are in my mind!
These days I was thinking the same thing.

Thank you very much.

Vassilis Boutsikas

Do you know if anyone has already tested the use of web services to sign documents, CSC or others?

Regards

Paulo Oliveira

Unfortunately No!

Regards

Vassilis Boutsikas

Hi Pao,

I contacted multicert.com and ask for CSC-Api (as you told me)
But I think thats not the api because they have a "Remote Certificate Manager application", perhaps a own webservice.
MY hope was that I can it use in a server-service without UI.

Here is the answer:
-------
Good morinig,

This kind of certificates, which are compatible with our Remote Certificate Manager application, with which you can sign your digital documents.

With these two components (remote certificate + Remote Certificate Manager application), you do not need to use any kind of hardware, such as tokens or smartcards, to authenticate and digitally sign.

This system brings you all the benefits associated with the legal and probative value, as well as the security, of the qualified certificates, bringing the processes of strong authentication and electronic signature to a new level of dematerialization and mobility.


To start using your remote test certificate you need:

# activate customer account (....); we resent the email again minutes ago;
# follow the instructions given in [www.multicert.com]


If you have any questions please feel free to contact us.

Best regards,
MULTICERT's Customer Care

regards Michael

Hi Paulo,

I'm playing with digital signature of PDF, which is obtained from USB Token.
The Authentication is by SafeNet.
Here is the code I'm trying:

PROCEDURE SignDocumentDigital(DocumentFile is string)

IF Lower(fExtractPath(DocumentFile, fExtension)) <> EXT_PDF THEN
	Warning("Το Έγγραφο δεν είναι μορφής PDF.")
	RESULT False
END

LOCAL
	MySignature	is pdfSignature
	MyCert		is Certificate	= CertificateSelect()
	OldFileName	is pdfDocument	= DocumentFile
	NewFileName	is string		= fExtractPath(DocumentFile, fDirectory) + fExtractPath(DocumentFile, fFileName) + "_Signed" + EXT_PDF

IF MyCert..Name = "" THEN
	Warning("Πρέπει να επιλέξετε ένα Πιστοποιητικό Υπογραφής.")
	RESULT False
END
// Έλεγχος καταλληλότητας για Υπογραφή του επιλεγμένου Πιστοποιητικού
IF NOT MyCert..ValidForSignature THEN
	Warning("Το επιλεγμένο Πιστοποιητικό δεν μπορεί να χρησιμοποιηθεί για Υπογραφή.")
	RESULT False
END
OldFileName.Save(NewFileName)
MySignature..Certificate	= MyCert
MySignature..Caption		= MyCert..Name + ", " + DateToString(MyCert..StartValidityDate..Date, "YYYY.MM.DD")
MySignature..X				= 5
MySignature..Y				= 5
MySignature..Width			= 110
MySignature..Height			= 20
// Στο σημείο αυτό, το Λειτουγικό Σύστημα ζητάει το PIN του USB Token
IF NOT PDFSign(NewFileName, MySignature, iSignature_CAdES_T) THEN
	Error("Σφάλμα στην Υπογραφή PDF.", ErrorInfo())
	RESULT False
END
RESULT True

The result is unpredictable:
1. when signing the PDF, the system ask me 2 times for the Password.
2. after sign, the resulting PDF consists of only 1 blank page with signature text. The certificate is correct, but why the content of file is dissapeared?
I suspect the PDFSign() function but I'm not sure. I use WX 27.

Can you help with this truble?

P.S.
Everyone who knows how to solve this problem is wellcome!

Regards

Vassilis Boutsikas



Edited 1 time(s). Last edit at 05/26/2022 09:23AM by Vassilis.

Hi Paulo, Vassilis, all,

1. when signing the PDF, the system ask me 2 times for the Password. Is this resolved?
I have the same issue with the Belgian Root CA signature certificate, but not when I use Belgian Root CA authentication certificate.

2. After signing the PDF, I want to secure and lock the PDF file. I tried all possibilities (I think) with Windev functions, but no success. When secure the PDF with PDFPASS function, the 2 signatures become invalid.
I there a solution for this?

Hi Tonny, Paulo,

1. The problem is not resolved yet.
2. After signing the PDF, the result is horrible! Im getting an EMPTY file, with only the caption of signature (Name, date, etc). The rest of content is gone. I use WX27, but the same with version 26.

Any idea to resolve this?

Best Regadrs

Vassilis Boutsikas

I don't don't know we stop testing this, we have moved to cloud certificates.
We need to sign PDF files in batch with no user interaction, the only solution we have found was using cloud certificates and REST webservices to sign the PDF files.

Regards

Paulo Oliveira