使用itext7从pdf中的数字签名中提取电子邮件地址

Question

给定pdf是使用DSC令牌证书签名的。 Adobe Reader向签名的用户提供电子邮件地址。如何使用itext7 c＃从数字签名中提取电子邮件地址？

我试图提取PdfPKCS7类中的数据。但是它不包含电子邮件地址。

使用ItextSharp，

PdfReader reader = new PdfReader(path);
AcroFields fields = reader.AcroFields;
List<String> names = fields.GetSignatureNames();
foreach (string name in names)
{
   VerifySignature(fields, name);
}

验证签名方法提供证书详细信息的位置

 virtual public PdfPKCS7 VerifySignature(AcroFields fields, String name)
 {
    Console.WriteLine("Signature covers whole document: " + fields.SignatureCoversWholeDocument(name));
    Console.WriteLine("Document revision: " + fields.GetRevision(name) + " of " + fields.TotalRevisions);
    PdfPKCS7 pkcs7 = fields.VerifySignature(name);
    Console.WriteLine("Integrity check OK? " + pkcs7.Verify());
    return pkcs7;
}

Answer 1

您的示例PDF在至少四个位置包含电子邮件地址：

• 签名值的名称条目。
• 签署者证书的主题备用名称。
• 签署者证书的主题DN的通用名称。
• 签署者证书的主题DN的电子邮件地址。

以下代码与您的iTextSharp代码以及四个电子邮件地址位置的输出相对应：

using (PdfReader pdfReader = new PdfReader(PDF))
using (PdfDocument pdfDocument = new PdfDocument(pdfReader))
{
    SignatureUtil signatureUtil = new SignatureUtil(pdfDocument);
    foreach (string signatureName in signatureUtil.GetSignatureNames())
    {
        Console.WriteLine("\n{0}\n**********", signatureName);
        Console.WriteLine("Name: " + signatureUtil.GetSignature(signatureName).GetName());
        Console.WriteLine("Signature covers whole document: " + signatureUtil.SignatureCoversWholeDocument(signatureName));
        Console.WriteLine("Document revision: " + signatureUtil.GetRevision(signatureName) + " of " + signatureUtil.GetTotalRevisions());
        PdfPKCS7 pkcs7 = signatureUtil.ReadSignatureData(signatureName);
        Console.WriteLine("Integrity check OK? " + pkcs7.VerifySignatureIntegrityAndAuthenticity());
        Org.BouncyCastle.X509.X509Certificate cert = pkcs7.GetSigningCertificate();
        Console.Write("Subject alternative names: ");
        foreach (var list in cert.GetSubjectAlternativeNames())
            foreach (var name in (IList)list)
                Console.Write(name + " ");
        Console.WriteLine();
        Org.BouncyCastle.Asn1.X509.X509Name subjectDn = cert.SubjectDN;
        Console.WriteLine("Subject DN: " + subjectDn);
        Console.Write("Subject DN common name: ");
        foreach (var name in subjectDn.GetValueList(Org.BouncyCastle.Asn1.X509.X509Name.CN))
            Console.Write(name + " ");
        Console.WriteLine();
        Console.Write("Subject DN email: ");
        foreach (var name in subjectDn.GetValueList(Org.BouncyCastle.Asn1.X509.X509Name.EmailAddress))
            Console.Write(name + " ");
        Console.WriteLine();
    }
}

您文件的输出：

Signature1
**********
Name: gerald.holmann@qoppa.com
Signature covers whole document: True
Document revision: 1 of 1
Integrity check OK? True
Subject alternative names: 1 gerald.holmann@qoppa.com 
Subject DN: CN=gerald.holmann@qoppa.com,E=gerald.holmann@qoppa.com
Subject DN common name: gerald.holmann@qoppa.com 
Subject DN email: gerald.holmann@qoppa.com

我显然无法确定您会遇到的其他证书将使用这些职位中的哪个职位。 因此，您必须找出是否在需求中指定了该字段，或者您可能必须简单地检查所有这些字段。

您所指出的位置的Adobe Reader最有可能显示签署者证书的主题DN的通用名称，但这不必是电子邮件地址，可以是用作证书所有者通用名称的任何内容。