Package com.pd4ml.pdf.sign

Signing PDF files: PdfSigner applies PAdES-compatible digital signatures, visible or invisible, with local or remote (RemoteSigner) keys.

Interface Summary

Interface	Description
RemoteSigner	The cloud-KMS signing seam: implement this against whichever key management service holds your signing key -- AWS KMS, Azure Key Vault, GCP Cloud KMS, a corporate signing service, anything reachable over the network -- and hand the result to CertificateUtils.forRemoteKey(java.security.cert.Certificate[], com.pd4ml.pdf.sign.RemoteSigner).

Class Summary

Class	Description
CertificateUtils	Loads the signing identity (private key + certificate chain) used by PdfSigner.sign(java.io.File, java.io.File, com.pd4ml.pdf.sign.CertificateUtils.SigningIdentity, com.pd4ml.pdf.sign.SigningOptions), from any of three sources: a PKCS#12 (.p12/.pfx) keystore file (the private key lives in this process, in the clear, for the duration of the JVM), a PKCS#11 token/HSM (the private key never leaves the token -- every RSA/EC operation is delegated to it via the JDK's SunPKCS11 security provider), or a remote key held by a cloud KMS (AWS KMS, Azure Key Vault, GCP Cloud KMS, ...) reached through a user-supplied RemoteSigner -- see CertificateUtils.forRemoteKey(java.security.cert.Certificate[], com.pd4ml.pdf.sign.RemoteSigner).
CertificateUtils.SigningIdentity	Holds the certificate chain to sign with, plus however this identity's private key operations actually get performed: an in-process PrivateKey (PKCS#12; CertificateUtils.SigningIdentity.getProvider() is null, any JCA provider -- normally BouncyCastle -- may perform the RSA/EC operation), an opaque PrivateKey handle tied to one specific Provider (PKCS#11; that exact provider instance must perform the operation, since the key material never leaves the token), or no local key at all, only a RemoteSigner (cloud KMS).
PdfSigner	Public entry point of the PD4ML PDF signing API.
SigningOptions	Configuration for a single PdfSigner.sign(java.io.File, java.io.File, com.pd4ml.pdf.sign.CertificateUtils.SigningIdentity, com.pd4ml.pdf.sign.SigningOptions) call: which key to sign with, the metadata written into the signature dictionary, and (optionally) where to place a visible signature widget or which TSA to timestamp against.
VisibleSignatureOptions	Optional configuration for rendering a visible signature widget on a page.

Enum Summary

Enum	Description
SigningOptions.CertificationLevel	Mirrors PDF's /DocMDP transform: how much further editing is permitted after this signature.
SigningOptions.DigestAlgorithm

Exception Summary

Exception	Description
PdfSigningException	Checked exception wrapping any failure that occurs while loading key material or applying a digital signature to a PDF document.