Question: extendDocument for LTV and selecting specific signatures

[CristianAlboradaIT]

Hi,

We are using the LTV (extendDocument) functionality on our signed documents. Our specific case is that documents may contain third-party signatures (from other entities) that we do not validate or manage; we only need to validate and extend our own signatures.

    public Map<String, Object> extendDocument(byte[] documentBytes) throws Exception {
        try {
            DSSDocument document = new InMemoryDocument(documentBytes);

            PAdESSignatureParameters parameters = new PAdESSignatureParameters();
            parameters.setSignatureLevel(SignatureLevel.PAdES_BASELINE_LT);

            PAdESService service = new PAdESService(extensionCertificateVerifier);
            service.setTspSource(DUMMY_TSP_SOURCE);
            
            DSSDocument extendedDoc = service.extendDocument(document, parameters);

            return ApiResponse.download(extendedDoc.openStream().readAllBytes(), "extended_lt.pdf")
                .addData("format", "PAdES-BASELINE-LT")
                .toMap();
            
        } catch (Exception e) {
            return ApiResponse.error("Error extending the document", e).toMap();
        }
    }

Currently, extendDocument extends all signatures in the document, which causes issues when a third-party signature:

• Has an expired certificate,
• Cannot be verified, or
• Returns errors like Revocation data is missing for one or more certificate(s).

This makes the process fail even when our own signatures are perfectly valid.

To work around this, we have added the following lines in the CertificateVerifier so that these exceptions are not thrown, but we don’t think this is the proper approach:

verifier.setAlertOnMissingRevocationData(null);
verifier.setAlertOnInvalidSignature(null);
verifier.setCheckRevocationForUntrustedChains(false);

Question:
Is there a way to apply LTV only to the signatures we select, instead of all signatures in the document? Alternatively, is there any recommended approach for handling this scenario where both our signatures and third-party signatures coexist without causing extendDocument to fail?

Thank you in advance for any guidance.

[bsanchezb]

Hello,

You may try to configure a custom logic using the Alert's, please see Use of Alerts throughout the framework. With the current approach you disable the verification all together, but if you configure it, you may process a SignatureStatus object through your custom Alert, thus filtering out the signatures you do not want to fail for.

Best rerards,
Aleksandr