search

dealfonso / sapp

Simple and Agnostic PDF Document Parser in PHP - sign PDF docs using PHP
GNU Lesser General Public License v3.0
108 stars 28 forks source link

Signature not valid, error on format or information within the signature #57

Open Nujuron opened 11 months ago

Nujuron commented 11 months ago

Hello, I've been trying to digitally sign PDFs generated with the mPDF library , I can successfully generate the PDF and sign it with the pdfsign.php example, but when I check the document with different programs (one of them being Adove Reader) I get a "Signature not valid, Contents illegal data". I've checked the signature itself, using a program to sign a document with it and works correctly.

Not signed PDF Example of signed PDF

Thanks in advance.

Lucas-mendes19 commented 11 months ago

I also have this problem.

KJ2ME commented 11 months ago

I think that the problem is a bad generated .p12 file.

Try again generating the file with openssl:

openssl genrsa -out private.pem 2048
openssl req -new -sha256 -key private.pem -out csr.csr
openssl req -x509 -sha256 -days 365 -key private.pem -in csr.csr -out certificate.pem
openssl pkcs12 -export -out identity.p12 -inkey private.pem -in certificate.pem

Then use the file "identity.p12" for sign the PDF.

Lucas-mendes19 commented 11 months ago

I believe that the problem is not the certificate, because I use a certificate generated by an official issuer and this problem still happens, and I already used this certificate and it worked, but from some moment until now this problem has been happening.

felixble commented 5 months ago

I had a similar issue which could be solved with these changes: https://github.com/dealfonso/sapp/pull/61.

My certificate was also generated by an official issuer which came with a root and an intermediate certificate. Unfortunately, the intermediate certificate is currently not supported by this library (which will be changed by the PR https://github.com/dealfonso/sapp/pull/61). This results in not trusting the signed pdf because the trust chain can only be made via the intermediate certificate.