Digital Signature is visible as blue box in Adobe Reader

[ratnamkamlesh]

Describe the bug:-
Digitally sign pdf file using pyHanko and when open this file to adobe reader showed a blue box of digital signature and I can not validate the digital signature.

To Reproduce
Sign any PDF file using pyHanko, and open it in adobe reader.

Screenshots.

Environment (please complete the following information):
OS: Ubuntu 20.04.6 LT
Version: Latest pyHanko with Python 3.7

Additional context
N/A
Amazing work of pyHanko, which is incredibly useful.

[MatthiasValvekens]

Sign any PDF file using pyHanko, and open it in adobe reader.

Well, you're going to have to give us more steps to reproduce than that, because it works for me ;). Share your code, or the exact CLI invocation you tried.

This looks like you're generating PDFs with an empty signature field instead of a filled one at first sight.

[ratnamkamlesh]

Hi Mattias
I am using the below code for digital signature. digital sign pdf working fine in another pdf reader, the problem is only with adobe reader.
screenshot of my digital sign with Document Viewer :-

            # Load signer key material from PKCS#12 file
            # This assumes that any relevant intermediate certs are also included
            # in the PKCS#12 file.
            signer = signers.SimpleSigner.load_pkcs12(
                pfx_file=pfx_file_path, passphrase=client_digital_sign_data.get('password').encode('utf-8'),
            )

            sv = fields.SigSeedValueSpec(
                reasons=['Invoice'],
                digest_methods=[],
                flags=fields.SigCertConstraintFlags.ISSUER,
            )
            sp = fields.SigFieldSpec(sig_field_name='Signature', seed_value_dict=sv, on_page=-1, box=(20, 15, 175, 78))
            vc = ValidationContext(trust_roots=[signer.signing_cert])
            # Settings for PAdES-LTA
            signature_meta = signers.PdfSignatureMetadata(
                field_name='Signature', md_algorithm='sha256',
                # Mark the signature as a PAdES signature
                subfilter=SigSeedSubFilter.PADES,
                # We'll also need a validation context
                # to fetch & embed revocation info.
                validation_context=vc,
                # Embed relevant OCSP responses / CRLs (PAdES-LT)
                embed_validation_info=True,
                # Tell pyHanko to put in an extra DocumentTimeStamp
                # to kick off the PAdES-LTA timestamp chain.
                use_pades_lta=True,
                reason="Invoice",
                signer_key_usage={'digital_signature'}
            )
            pdf_signer = signers.PdfSigner(signature_meta=signature_meta, signer=signer, stamp_style=stamp.
                                           TextStampStyle(stamp_text='Digitally Signed by %(signer)s\nTime:'
                                                                     ' %(ts)s\nReason: Invoice', border_width=0),
                                           new_field_spec=sp)
            with open(file_path, 'rb+') as inf:
                w = IncrementalPdfFileWriter(inf)
                digitally_signed_pdf = '{}/{}'.format(temp_path, 'output.pdf')
                with open(digitally_signed_pdf, 'wb+') as outf:
                    pdf_signer.sign_pdf(
                        w, output=outf,
                    )

[MatthiasValvekens]

Thanks for the extra details. Nothing immediately stands out to me, unfortunately. Long shot: there currently are no tests for outputting to a file with wb+. Can you try that with a "regular" wb? Writing to seekable vs. nonseekable descriptors is handled differently, so maybe it's some kind of wonky file corruption.

(FWIW, it should work with wb+, but if it doesn't and wb works fine, at least I know where to start looking)

[ratnamkamlesh]

Hi Mattias
I had missed adding the timestamps.HTTPTimeStamper.(tst_client = timestamps.HTTPTimeStamper('https://www.e-mudhra.com/trusted-time-stamping-service.html')) .
After applying this get this error:- TimestampRequestError( 'Error in communication with timestamp server')
and the reason is :- (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1091)')

[ratnamkamlesh]

Hi,
when I am using this cert. 'http://pki.aped.gov.gr/ca/APEDRoot.crt' and tst_client = timestamps.HTTPTimeStamper('https://timestamp.aped.gov.gr/qtss'), getting the error-The signer's certificate could not be validated

[MatthiasValvekens]

Hi @ratnamkamlesh,

If you want to take advantage of LTV features, you should set up your validation context to accept all the trust roots you need.

See e.g. this code sample from the validation section of the documentation. Pass all the roots you want into trust_roots. If you simply want to add roots but still use whatever's in the system trust as well, use extra_trust_roots.