Question

我添加了“Insert digital signature into existing pdf file”中提到的数字签名，并将该证书存储为本地的PEM文件。如何使用存储的证书验证签名？

这是source的示例代码：

open 'certificate.pem', 'w' do |io| io.write cert.to_pem end #Saving certificate
cert = OpenSSL::X509::Certificate.new(File::read('certificate.pem')) #Opening certificate to verify. This gives error. how to convert pem string to certificate.
pdf = PDF.read('test.pdf') #opening certified pdf to validate signature
pdf.verify(trusted_certs: [cert]) if pdf.signed? #This gives error.

编辑：添加cert.sign key, OpenSSL::Digest::SHA1.new上述作品后，验证失败。使用以下代码，我将数字签名添加到pdf中。

require 'openssl'
require 'origami'
include Origami
key = OpenSSL::PKey::RSA.new 2048
name = OpenSSL::X509::Name.parse 'CN=nobody/DC=example'
cert = OpenSSL::X509::Certificate.new
cert.version = 2
cert.serial = 0
cert.not_before = Time.now
cert.not_after = Time.now + 3600
cert.public_key = key.public_key
cert.subject = name
cert.sign key, OpenSSL::Digest::SHA1.new
open 'certificate.pem', 'w' do |io| io.write cert.to_pem end
OUTPUTFILE = "outfile.pdf"
pdf = PDF.read('testing.pdf')
pdf.sign(cert, key, 
  :method => 'adbe.pkcs7.sha1',
  #:annotation => sigannot, 
  :location => "Portugal", 
  :contact => "myemail@email.tt", 
  :reason => "Proof of Concept"
)
pdf.save(OUTPUTFILE)

之后，我使用以下代码验证使用存储证书的数字签名。但它给出了错误。

signed_cert = OpenSSL::X509::Certificate.new(File::read('certificate.pem'))
pdf = PDF.read("outfile.pdf")
if pdf.signed?
  pdf.verify(trusted_certs: [signed_cert]) #This gives false
end

我做错了什么？

如何在Ruby中验证PDF数字签名

0 个答案: