This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pdfbox-docs.git
The following commit(s) were added to refs/heads/master by this push:
new f504b4e9 PDFBOX-6244: add entry about checking signatures
f504b4e9 is described below
commit f504b4e9a88e934ceed472d6679a67b30815c4ef
Author: Tilman Hausherr <[email protected]>
AuthorDate: Wed Aug 26 12:36:41 2026 +0200
PDFBOX-6244: add entry about checking signatures
---
content/2.0/faq.md | 13 ++++++++++++-
content/3.0/faq.md | 13 ++++++++++++-
2 files changed, 24 insertions(+), 2 deletions(-)
diff --git a/content/2.0/faq.md b/content/2.0/faq.md
index 8945c987..2b58fe40 100644
--- a/content/2.0/faq.md
+++ b/content/2.0/faq.md
@@ -279,4 +279,15 @@ Try calling `PDAcroForm.refreshAppearances()` before
rendering. This isn't done
This happens since 1.85 of the Bouncy Castle cryptographic library and is
because PDF signatures
are written into a larger zero-allocated area.
The fix is to wrap the byte array retrieved from `PDSignature.getContents()`
-into a `ByteArrayInputStream` before passing it to the `CMSSignedData`
constructor.
\ No newline at end of file
+into a `ByteArrayInputStream` before passing it to the `CMSSignedData`
constructor.
+
+### How can I check signed PDFs?
+
+Parsing does not include the verification or the validation of electronic
signatures.
+This applies to certification constraints (DocMDP) and usage rights (UR3) as
well.
+The ShowSignature example does a partial verification and validation,
+but it can't detect allowed or forbidden changes, annd UR3 isn't supported at
all.
+Certificates are checked up to the root certificate,
+but it does not check the root certificate against AATL and EUTL.
+This is mostly a developer tool to create your own.
+The gold standard is Adobe Reader.
\ No newline at end of file
diff --git a/content/3.0/faq.md b/content/3.0/faq.md
index a4cf61d3..e4dd5669 100644
--- a/content/3.0/faq.md
+++ b/content/3.0/faq.md
@@ -305,4 +305,15 @@ Try calling `PDAcroForm.refreshAppearances()` before
rendering. This isn't done
This happens since 1.85 of the Bouncy Castle cryptographic library and is
because PDF signatures
are written into a larger zero-allocated area.
The fix is to wrap the byte array retrieved from `PDSignature.getContents()`
-into a `ByteArrayInputStream` before passing it to the `CMSSignedData`
constructor.
\ No newline at end of file
+into a `ByteArrayInputStream` before passing it to the `CMSSignedData`
constructor.
+
+### How can I check signed PDFs?
+
+Parsing does not include the verification or the validation of electronic
signatures.
+This applies to certification constraints (DocMDP) and usage rights (UR3) as
well.
+The ShowSignature example does a partial verification and validation,
+but it can't detect allowed or forbidden changes, annd UR3 isn't supported at
all.
+Certificates are checked up to the root certificate,
+but it does not check the root certificate against AATL and EUTL.
+This is mostly a developer tool to create your own.
+The gold standard is Adobe Reader.
\ No newline at end of file
