Can I create a PDF/A 1b compliant document while signing with a SHA256 digital certificate?

[paolor29682126]

The italian Public Administration requires signed PDF/A 1b compliant documents. I've upgraded my digital certificate to a SHA256 one. Can I still create a PDF/A 1b document (1.4 version) or the SHA256 certificate signature requires PDF/A 2b (1.7 version)?

[Test Screen Name]

A PDF/A-1 document must use features only found in PDF 1.4. Or rather, a viewer must ignore everything else. A signature is not actually part of viewing though. This may be undefined.

[ToM_1st]

I discussed the same question with Leonard a while ago:

SubFilter value algorithm support in PDF/A

This may give you some insight into the different aspects of this topic.

On a personal side note - after considering all points we decided that it is valid to use newer/stronger methods of encryption/hashing even if its PDF/A-1...

[paolor29682126]

Hi Guys,

thank you for your suggestions.

I tried to create a signed PDF/A document with a trial version of Acrobat DC starting from a simple txt file.

I can create a PDF, convert it to a PDF/A 1b, but once I've signed it (with a SHA256 certificate) I can't convert it again to PDF/A 1b.

I receive the following errors:

"PDF document is not compliant with PDF/A-1b (2005)"

"Compressed stream object used"

"PDF/A entry missing".

Am I doing something wrong?

Paolo Righi.

[ToM_1st]

Converting a signed file back to PDF/A is not possible since this most certainly would invalidate the signature.

I got it to work the following way:

1. Create a document which contains a signature field

2. Convert it to PDF/A-1b

3. Open it with Adobe Reader (DC) or Acrobat

4. Do not click on the "Enable Editing" Button

5. Right click on a signature field and a greyed out "Sign document" dialog will pop up

6. Create yourself a test certificate / use an existing if you already have one

7. Save the document and open it with Acrobat again and run the PDF/A-1b preflight check

8. Voilá a perfect valid PDF/A-1 document

It seems that Adobe Acrobat / Reader removes the PDF/A entry when clicking on "enable editing" - and since its not PDF/A anymore it can compress its streams ....

[paolor29682126]

Hi ToM_1st,

I don’t know how to create a signature field with Acrobat DC.

If I try to create a form then it is flattened during the PDF/A conversion.

While if I try to sign the document then an upload is requested (I would like to avoid that).

Thank you for your assistance.

[Private info removed. -Mod.]

[paolor29682126]

Hi ToM_1st,

I've found out how to do it: you should add a signature with a certificate and then clear the signature (very handy, isn't it?).

Do you know another way?

Paolo Righi.

[ToM_1st]

No no no.

Just add a form field of the type signature. (Like you would add a text field)

1. Go to the form field mode:

2. select signature field

3. Place empty signature field on your page

4. Convert document to PDF/A-1b

[paolor29682126]

Hi ToM_1st,

selecting Prepare Form I was asked to "Select a file or scan a document to begin" and to set or not the "This document requires signatures" flag. I set that flag so converting to PDF/A the created signature field was removed.

I successfully created a PDF/A signed document, but its version has always been, in all of its converting steps, 1.6 (not 1.4 as a PDF/A 1b document)!

Is it right?

Paolo Righi.

[ToM_1st]

Ok do the following:

1. In the beginning your PDF does not need to be PDF/A-1b, so you can click on "Enable Edit" if your PDF is already PDF/A

2. After pressing on "Prepare Form" you are asked "Select a file or scan a document to begin" just select your document which is the left option (so not "Scan a document). You may have to save the document again...

3. Then you should be in form field mode

4. add a signature field

5. Now go to preflight and chose the option "Convert to PDF/A-1b

6. Everything should be working now

Can you attach a screenshot of the option "This document requires signatures" - I have never seen this before.

And does your 1.6 PDF document complies to the PDF/A-1b check? A PDF document doesn not necessarily need to have 1.4 version in the header if it fully compplies to PDF/A-1b....

[paolor29682126]

Hi ToM_1st,

You can see the screenshot you requested attached.

About PDF/A 1b compliance, I’m sorry it isn’t. (screenshot attached).

Best Regards.

[Personal contact information removed by moderator]

Oggetto:  Can I create a PDF/A 1b compliant document while signing with a SHA256 digital certificate?

Can I create a PDF/A 1b compliant document while signing with a SHA256 digital certificate?

created by ToM_1st<https://forums.adobe.com/people/ToM_1st> in Security & Digital Signatures - View the full discussion<https://forums.adobe.com/message/9534360#9534360>

[ToM_1st]

There is no screenshot attached - please use the functionality provided by the forum editor....

I don't know who Oggetto is but as mentioned before: Yes you can (just follow the description) or can you post your PDF / is it downloadable somewhere? Then I can show you with your PDF...

[paolor29682126]

Hi ToM_1st,

I'm sorry the site was temporary OOS, so I sent an email with attachments as I was leaving my office.

Have a nice day.

Paolo Righi

[paolor29682126]

Hi ToM_1st,

my PDF is nothing special: it comes from the conversion of a txt file with no meaningful contents.

Paolo Righi.

[ToM_1st]

The "This document require signatures" I don't see in my version of acrobat. Maybe you have a slightly newer one. So you say that your (empty) signature is removed during PDF/A conversion? That would be really strange. See a screenshot of the document after PDF/A-1b conversion. As you can see the empty signatures fields are still in there. Did you really follow my guide step by step?

[paolor29682126]

Hi ToM_1st,

if I don't set the "This document require signatures" all goes right, never mind about this flag ...

What I'm interested in is whether Acrobat can create a PDF/A 1b document with a SHA256 signature.

Starting from a PDF/A 1b document with a blank signature field I can sign the document, but it seems that the added text is created with a not embedded font causing the document not be convertable to PDF/A. Can I avoid the addition of text whose font will not be embedded or can I instruct Acrobat to embed the font of the newly added text?

Thank you for your help.

Paolo Righi.

[ToM_1st · Accepted solution]

Ok now I am getting your point! I did the same and when using a textual appearance the font is not embedded into the document by adobe acrobat. Which is in my opinion a bug.

Ok since Adobe Acrobat doesn't include the font - just use an image as appearance. To do that use the following steps:

1. In the signing dialog use the option "Create new Appearance"

2. Define a title, import any graphic and unclick all texstual elements like name, location etc.

3. Et voilà - your perfect valid signature 🙂

4. If you look at the properties its a SHA256 signature

[paolor29682126]

Hi ToM_1st,

I successfully created a PDF/A 1b documents signed by a SHA256 certificate.

The PDF version is 1.6 (and not 1.4).

Thank you very much for your assistance.

Bye.

Paolo Righi.