org.bouncycastle.asn1.ASN1ObjectIdentifier“的签名者信息与签名者信息不匹配

Question

I am facing above mentioned exception while I am calling PdfEncryptor.encrypt() from my code base. In SO I found that usually it happens because of wrong combination of itextpdf and bouncycastle jar. But I am having below mentioned dependencies and which is correct I think.

   <dependency>
      <groupId>com.itextpdf</groupId>
      <artifactId>itextpdf</artifactId>
      <version>5.1.3</version>
    </dependency>
    <dependency>
      <groupId>org.bouncycastle</groupId>
      <artifactId>bcprov-jdk16</artifactId>
      <version>1.46</version>
    </dependency> 
    <dependency>
      <groupId>com.test</groupId>
      <artifactId>test</artifactId>
      <version>1.0.0</version>
    </dependency> 

We are having dependency of itext indirectly through other project(test). "test" project is having following entry

<dependency>
    <groupId>com.lowagie</groupId>
    <artifactId>itext</artifactId>
    <version>2.0.4</version>
</dependency>

Stacktrace :

class "org.bouncycastle.asn1.ASN1ObjectIdentifier"'s signer information does not match signer information of other classes in the same package at java.lang.ClassLoader.checkCerts(ClassLoader.java:952) at java.lang.ClassLoader.preDefineClass(ClassLoader.java:666) at java.lang.ClassLoader.defineClass(ClassLoader.java:794) at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142) at org.apache.catalina.loader.WebappClassLoaderBase.findClassInternal(WebappClassLoaderBase.java:2494) at org.apache.catalina.loader.WebappClassLoaderBase.findClass(WebappClassLoaderBase.java:860) at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1302) at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1167) at com.itextpdf.text.pdf.PdfEncryption.(PdfEncryption.java:147) at com.itextpdf.text.pdf.PdfWriter.setEncryption(PdfWriter.java:2041) at com.itextpdf.text.pdf.PdfStamper.setEncryption(PdfStamper.java:295) at com.itex tpdf.text.pdf.PdfStamper.setEncryption(PdfStamper.java:330) at com.itextpdf.text.pdf.PdfEncryptor.encrypt(PdfEncryptor.java:206)

Please let me know if you have any solution. It will be very helpful

Answer 1

You are mixing two iText versions: an obsolete version referring to my name ( com.lowagie ) dating from June 2007 and a newer version ( com.itextpdf ) dating from November 2011. These two different iText versions require different versions of BouncyCastle. You should limit yourself to using one single version of iText (preferably one that dates from 2016) and use the corresponding BouncyCastle version. You will find the BouncyCastle version you need in the POM that is shipped with the iText version you're using. Note that you also have to be careful to check where you deploy your code. Some web servers ship with a version of BouncyCastle that is different from the version you need. That can lead to inconsistencies. Another example is Android. Android ships with an old version of BouncyCastle and software that requires a newer version clash with that old version. That's why iTextG (the Android port of iText) uses SpongyCastle instead of BouncyCastle. SpongyCastle is identical to BouncyCastle, except for the package names. This way SpongyCastle doesn't clash with the BouncyCastle version that is available on Android.

Long story short: you say I am having below mentioned dependencies , but your assumption which is correct I think is wrong, because you're mixing two different versions of iText.