Hello,
The current version of
org.apache.pdfbox.examples.signature.validation.CertInformationCollector
supports a single certificate as the alternative issuer.
It could support chains also:
---------------------------
Current code (lines 300-308):
try (InputStream in = certUrl.openStream())
{
X509Certificate altIssuerCert = (X509Certificate) certFactory
.generateCertificate(in);
addCertToCertificatesMap(altIssuerCert);
certInfo.alternativeCertChain = new CertSignatureInformation();
traverseChain(altIssuerCert, certInfo.alternativeCertChain, maxDepth -
1);
}
------------------------------
Proposed update:
try (InputStream in = certUrl.openStream())
{
Collection<? extends java.security.cert.Certificate> altIssuerCerts =
certFactory.generateCertificates(in);
for (java.security.cert.Certificate c : altIssuerCerts) {
X509Certificate altIssuerCert = (X509Certificate) c;
addCertToCertificatesMap(altIssuerCert);
certInfo.alternativeCertChain = new CertSignatureInformation();
traverseChain(altIssuerCert, certInfo.alternativeCertChain,
maxDepth - 1);
}
}
--------------------------
