保留现有的PDF签名

Question

给定带有证书的经过数字签名的PDF，我没有私钥，是否可以更改文档，使用我的证书对其进行签名并将以前的签名保留为“历史记录”，也就是说，旧签名不应验证文件的完整性，而用户应该只能够看到它曾经用其他证书签名过？

Answer 1

If it's your intention to remove the old signature (created with someone else's private key), alter the document, and add a new signature (using your own private key), then yes, that's possible.

If it's your intention to keep the old signature, and add a second (a so-called approval) signature (using your own private key), then it depends on the nature of the first signature (if that signature "locks" the document, it's not possible) whether or not you can alter the document in-between.

Moreover, altering the document will almost always invalidate the original signature. See Which operations are allowed on a digitally signed PDF? to find out which changes are possible (eg filling out a form field) and which changes are impossible (eg adding an extra page).

A not so elegant workaround that is used to tackle this by at least one of our customers, is to wrap the signed PDF in a PDF portfolio, and to add a cover page with additional info. A PDF portfolio is like a ZIP file that can be opened in Adobe Reader (and some other PDF viewers). That ZIP file can contain all kinds of other documents, including unaltered signed PDF's in which the signatures are kept intact.