Java exception during signing with smart card

[Michail Pappas]

I have installed a number of cards (most of them Incard-made). Most systems where the card is installed to, has incard readers. The card themselves are a bunch provided from the same company.

We are using the same type of clients, Greek Windows XP SP3 mostly. For some reason, on a couple of systems the following error is displayed when signing:

INFO  Starting JSignPdf
INFO  Checking input and output PDF paths.
INFO  Used key alias: VASILEIOS MICHALITSIS-1
INFO  Loading private key
INFO  Getting certificate chain
INFO  Opening input PDF file: <filename>.pdf
INFO  Creating output PDF file: <filename>_signed.pdf
INFO  Creating signature
INFO  Setting certification level
INFO  Processing (it may take a while) …
ERROR Problem occured
ExceptionConverter: java.security.SignatureException: Ï ôýðïò ðïõ êáèïñßóôçêå äåí åßíáé Ýãêõñïò.

at sun.security.mscapi.RSASignature.signHash(Native Method)
at sun.security.mscapi.RSASignature.engineSign(RSASignature.java:390)
at java.security.Signature$Delegate.engineSign(Unknown Source)
at java.security.Signature.sign(Unknown Source)
at com.lowagie.text.pdf.PdfPKCS7.getEncodedPKCS7(Unknown Source)
at net.sf.jsignpdf.SignerLogic.signFile(SignerLogic.java:365)
at net.sf.jsignpdf.SignerLogic.run(SignerLogic.java:108)
at java.lang.Thread.run(Unknown Source)
INFO  Finished: Creating of signature failed.

It is the exact same error as encountered at https://sourceforge.net/p/jsignpdf/discussion/782217/thread/230be919

The unreadable characters above are most likely Greek characters, incorrectly changed for locale. Any chance this can be debugged?

[Josef Cacek]

Hello Michail,

I think, it could be a bug in SunMSCAPI implemetation. Could you try
following workarounds?

1) Try JSignPdf with the newest Java 1.7 (32bit) instead of the included one.
2) Configure SunPKCS11 security provider and use the PKCS#11 keystore
type instead of WINDOWS-MY (look at this topic:
https://groups.google.com/d/topic/jsignpdf/EqXaqqB7Lm4/discussion)

Let me know if it helps. Thanks,

-- jc

> --
> You received this message because you are subscribed to the Google Groups
> "JSignPdf" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to jsignpdf+u...@googlegroups.com.
> To post to this group, send email to jsig...@googlegroups.com.
> Visit this group at http://groups.google.com/group/jsignpdf.
> For more options, visit https://groups.google.com/groups/opt_out.

[Michail Pappas]

Hello Josef and thanks for your fast reply!

I've found the issue here: I noticed that after cleaning the user's certificates from Internet Explorer, trying to reload certificates in Jsignpdf from the user's smart card, did not display any certificates at all. On both problematic machines I did not install a CSP provider from the bit4id. After installing it, everything worked fine!

Thanks for an awesome program!

[Stratos Sarantavgas]

Dear Michail,

After a search I made on the internet regarding the same problem I have just saw your post. Could you please help? What exactly you have done?

[Michail Pappas]

Hi Stavros,

sorry for the late reply. I don't know what your specific configuration is, but what I did to solve my problem was outlined in a post above, ie:

On Tuesday, August 27, 2013 at 12:58:29 PM UTC+3, Michail Pappas wrote:

I've found the issue here: I noticed that after cleaning the user's certificates from Internet Explorer, trying to reload certificates in Jsignpdf from the user's smart card, did not display any certificates at all. On both problematic machines I did not install a CSP provider from the bit4id. After installing it, everything worked fine!

To clarify, I:

1) Deleted *personal* certificates found under control panel -> internet options -> tools -> options -> content -> certificates -> personal and

2) Installed http://www.ermis.gov.gr/portal/page/portal/ermis/items/downloads/carddriversizeuxis.exe

Hope that helps.

M.-