the signature includes en embedded timeStamp but it could not be verified

Question

I've just added timestamp to my pdf. signature is valid. timestamp token is correct too (I checked already). but adobe reader tells me that "signature includes an embedded timestamp but it could not be veridied".

AttributeTable unsigned = signerInformation.getUnsignedAttributes();
Hashtable<ASN1ObjectIdentifier, Attribute> unsignedAttrHash = null;
if (unsigned == null) {
    unsignedAttrHash = new Hashtable<ASN1ObjectIdentifier, Attribute>();
} else {
    unsignedAttrHash = signerInformation.getUnsignedAttributes().toHashtable();
}

unsignedAttrHash.put(PKCSObjectIdentifiers.id_aa_signatureTimeStampToken, signatureTimeStamp);

SignerInformation newSignertInformation = SignerInformation.replaceUnsignedAttributes(si, new AttributeTable(unsignedAttrHash));

I fount this code at stackowerflow. it works. it's really correct code. finally I have new SignerInformationStore and new CMS Signed Data like this

CMSSignedData.replaceSigners(oldCMSSignedData, newSignerStore);

but maybe something is missing in my PDF? certificate or something like that?

that's sample pdf

Answer 1

The message imprint in the signature-time-stamp seems to be not correct. It is expected to have the SHA256 of the signature value in this message imprint.

SHA256 of the signature value:

1b4532052d612ca32ae96b9a8e7aa6d64ae6c69dc00e1b7b31394ac3b54c4049

The message imprint in the time-stamp token:

E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855