Simple signing of PDFs in node.
npm install kuara-signpdfnpm i -S kuara-signpdf kuara-forge.
Buffer) your file, you need to a add a signature placeholder to it. We have a helper for that. This is demonstrated in the signs input PDF test.
signs a ready pdf test.
javascript
import signer from 'node-signpdf';
...
const signedPdf = signer.sign(
fs.readFileSync(PATH_TO_PDF_FILE),
fs.readFileSync(PATH_TO_P12_CERTIFICATE),
);
`
Notes
- The process of signing a document is described in the Digital Signatures in PDF document. As Adobe's files are deprecated, here is the standard as defined by ETSI.
- This lib:
- requires the signature placeholder to already be in the document (There are helpers included that can try to add it);
- requires the Contents descriptor in the Sig be placed after the ByteRange one;
- takes Buffers of the PDF and a P12 certificate to use when signing;
- does cover only basic scenarios of signing a PDF. If you have suggestions, ideas or anything, please CONTRIBUTE;
- Feel free to copy and paste any part of this code. See its defined Purpose.
Signing PDF in simple steps
$3
See the unit-testing code. PDFKit is used there for generating the document. This also allows easy addition of the signature placeholder.
$3
What's needed is a Sig element and a Widget that is also linked in a Form. The form needs to be referenced in the root descriptor of the PDF as well. A (hopefully) readable sample is available in the helpers. Note the Contents descriptor of the Sig where zeros are placed that will later be replaced with the actual signature.
This package provides two helpers for adding the signature placeholder:
- pdfkitAddPlaceholder
- plainAddPlaceholder
Note: Signing in detached mode makes the signature length independent of the PDF's content length, but it may still vary between different signing certificates. So every time you sign using the same P12 you will get the same length of the output signature, no matter the length of the signed content. It is safe to find out the actual signature length your certificate produces and use it to properly configure the placeholder length.
#### PAdES compliant signatures
To produce PAdES compliant signatures, the ETSI Signature Dictionary SubFilter value must be ETSI.CAdES.detached instead of the standard Adobe value.
This can be declared using the subFilter option argument passed to pdfkitAddPlaceholder and plainAddPlaceholder.
`js
import { SUBFILTER_ETSI_CADES_DETACHED, pdfkitAddPlaceholder } from 'node-signpdf';
const pdfToSign = pdfkitAddPlaceholder({
...,
subFilter: SUBFILTER_ETSI_CADES_DETACHED,
});
``