Some days ago a friend of mine asked me how to create PDF-Receipts. Background is that – at least in Germany – you can replace printed receipts with digitally signed PDF-Files. The signature has to comply to certain legal standards to be able to replace the printed copy but the way is the same whether it’s a self-signed certificate or an official one.
For the start I wanted to see how to sign a PDF-Document created with TCPDF. At a later time I will also have a look at how to sign a PDF-File using the libraries supported by PDFlib.com.
Signing PDF-files with TCPDF requires you to have the private key and the certificate available via a stream-ressource. That excludes certificates and keys on a signature-card as long as you can not export them.
Creating a signed PDF-File using TCPDF is rather simple as you can see in this code-snippet:
$pdf = new TCPDF(PDF_PAGE_ORIENTATION, PDF_UNIT, PDF_PAGE_FORMAT, true, 'UTF-8', false); // set certificate file $certificate = 'file://' . __DIR__ . '/cert/certificate.crt'; $privateKey = 'file://' . __DIR__ . '/cert/privateKey.crt'; // set document signature $pdf->setSignature($certificate, $privateKey, 'test1234', '', 1, array()); // Do some more stuff here like creating the actual PDF-File //Close and output PDF document $pdf->output('test.pdf', 'D');
The hard part now is for one thing creating the actual PDF-File.
And the more important one question was “Which certificate-key-thingy goes where”.
That was the one that took me most of the time. When using a self-signed certificate as described in the TCPDF-Example you can somehow use the given openSSL shell-lines to get somehow to a result. But I wanted to sign the document with a “qualified electonical signature” which takes some more steps.
What is a qualified electronical signature? It’S nothing else than any other digital signature from a certification authority. The only difference is, that it has been issued according to the german “Signaturgesetz” which means, that it is based on a qualified certificate and has been created using a certain approved PKI. As I am not a lawyer, this is simply my own description of a legal process which might be inaccurate or plain false. So do not take my word as legally authoritative. A list of issuers for qualified electronical signatures can be found at http://www.nrca-ds.de/ZDAliste.htm
As I do not posses such a qualified electronical signature (and there currently is no need for me to get one) I tried the whole stuff with a certificate I got myself from CA-Cert. As far as I know (but I will verify that one soon) you can export a qualified electronic signature into a format that can be used for these purposes.
The relevant parts are the following variables
- needs to point to a certificate file in PEM-Format. Thats a plaintext-file with —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—– and some base64 encoded stuff in between.
- needs to point to a private key file in binary PKCS7-Format. Those files normally end in something like ‘.p12’ or ‘.pfx’. To open this file you normally need a passphrase which you have to provide as third parameter to $pdf->setSignature.
Using that certificate and private key you can now sign your PDF-file.
3 thoughts on “Create signed PDF-Files”
I follow the process as you said but the CA authority is not shown in the chain of the sign valididy (Adobe READER) so the signature looks invalid. If I create my own certification it works ok bau as you said I need to use the certification issued from my CA Company. They gave me an p12 file and a der file. I convert the p12 to crt (openssl) but my pdf isn’t sign correctly as I mention above.
Thanks for the feedback. I’ll have a look into it and get back to you ASAP
Sorry for letting you down for so long. But I can not reproduce the issue. Would you mind sending meyou faulty PDF so I can have a look at it? Would be great!
Comments are closed.