pade | Yoruba word for Meet ) is a browser extension | Chat library

As you have declared, you have your own code for preparing a PDF for signing and for injecting the signature container into it. Thus, your question essentially burns down to

How to create a CAdES signature container with BouncyCastle that can be used to create a PAdES BASELINE B or T PDF signature?

As I do not have your existing code, I had to use a different framework for my tests. I used the iText 7 signing framework for that.

BouncyCastle does contain a CMSSignedDataGenerator to generate CMS signature containers.

The default implementation of the SignerInfo generation therein unfortunately is not CAdES/PAdES compatible as it does not create signed ESSCertID[v2] attributes. Fortunately, though, the implementation is designed to allow plugging in custom attributes sets.

Thus, you can create the CAdES containers required for PAdES BASELINE signatures with a customized CMSSignedDataGenerator.

So when you have prepared the PDF for signing, you can proceed like this:

Yes, it is possible to embed the timestamp into the signature after the signature is created so there is no need for your TSP to provide you with a DDS that includes a timestamp.

The timestamp is usually added at the same time when the signature is being created because PDF signing process requires that you first estimate the size of the signature and the estimated size might be lower than required for the additional embedding of the timestamp. So, timestamping is first done over some dummy data to find out the size of the timestamp and this size is included in the calculation of the estimated size of the signature.

Since you use the public GemBox.Pdf.Forms.PdfSignature GemBox.Pdf.Forms.PdfSignatureField.Sign(Func signer, PdfSignatureFormat signatureFormat, int estimatedSignatureContentsLength) method, it means that your TSP provider endpoint already returns a CMS-encoded signature and this CMS-encoded signature must be augmented with a timestamp before being inserted into a signed PDF file. GemBox.Pdf currently doesn't provide this timestamp augmentation, but I am sure this can be easily added if you ask GemBox for this over their official customer support channel.

On the other hand, if your TSP provider also provides an endpoint that returns just the private key signature value, then you can leave the creation of CMS-encoded signature (that includes private key signature value, signer certificate, embedded timestamp, optional validation info (certificate chain, OCSP responses and/or CRLs that make the signature "LTV enabled") and all other data required for a valid PAdES signature) to GemBox.Pdf. Combination of examples Digitally sign a PDF file with an external signature (shows how to interoperate between GemBox.Pdf and your TSP provider endpoint that returns the private key signature value) and PAdES B-LT level (shows how to make a PAdES signature that has an embedded timestamp and is "LTV enabled") show how this can be done.

As far as I know, Adobe Reader does not make use of the EU LOTL and EU MS TLs “directly” but rather use an Adobe-specific format (similar to the AATL) to configure trust anchors derived from the EU MS TLs.

So in general the content of the Adobe-specific EU TL can differ (desynchronization) from the latest published EU MS TLs.

Most probably, the timestamp has been generated by a "recently" qualified time-stamping service, which has not (yet ?) been included in the Adobe-specific EU TL.

This answer essentially is a more detailed version of the comments, essentially finding that what you want to do is not possible.

You ask for a way to

Certify Document when Approval Signature exist

According to the current PDF specification:

Thus, you cannot validly add a certification signature to a PDF which already has approval signatures.

(This does not automatically mean that all validators will detect the issue if you add a certification signature after approval signatures, let alone correctly display the cause. Many validators only do a subset of the checks that strictly speaking are necessary...)

More question if the certification signature come first then next is approval like 3 signature approval, can the last the certification setMDPPermission with 1 ? so at the end the document can't add more approval signature

setMDPPermission adds a DocMDP transform to the signature, and such a transform makes the signature a certification signature. Thus, using this method when signing a document that already has an approval signature, will create an invalid PDF or fail entirely.

You can lock a PDF document with an approval signature, though, if you add a Lock dictionary to the signature field with a P entry of 1. Beware, though, this is a ISO 32000-2 feature originally introduced as a feature of an Adobe Extension to ISO 32000-1. Not all PDF viewers support ISO 32000-2 yet, so some viewers may not respect this entry.

Besides using id for the IDs, as mentioned in the comments, you can do some refactoring to get SwiftUI to not re-render as much of the view hierarchy and instead reuse components. For example, you have an if condition and in each you have separate Section, ForEach, etc components. Instead, you could render the content of the ForEach based on the state of the search:

The problem is caused by an error in the original PDF. Your PDFBox code signs in append mode (i.e. in an incremental update), so that error is present in the signed version, too. Your iText code does not sign in append mode but instead re-writes the whole PDF; while doing so it does not make the same error as the producer of your original PDF, so the error is not in the signed version anymore. Adobe Acrobat is very sensitive to such issues when validating signatures with updates.

The cross reference table of the initial revision in a PDF must not be split into separate subsections but in case of your original PDF it has been split:

There are some issues in the signature container embedded in your PDF.

Your PDF is version 1.5 and the signature uses the subfilter ETSI.CAdES.detached. Thus, the embedded signature container should be conform to ETSI EN 319 142-1 (PAdES building blocks) which also refers to ETSI EN 319 122-1 (CAdES building blocks). But there are deviations:

First of all the CMSVersion shall be set to either 1 or 3 (CAdES 4.4). But in your case it is set to 5.

Then SignedData.crls contains entries, in particular one with type other. This field in case of PAdES should not be used anyways, in particular not with such entries. Actually this entry is the reason for the invalid CMSVersion mentioned above: If SignedData.crls contains an entry with a type of other, RFC 5652 requires version 5.

The SignerInfo of your signature container contains a signingTime signed attribute. This is explicitly forbidden for PAdES BASELINE signatures (PAdES 6.3).

It also contains a cmsAlgorithmProtection signed attribute. While not explicitly forbidden, this attribute is not on the list of attributes that may be used in PAdES (PAdES 5.2).

Also there is at least one issue in the embedded certificates: One of them has a long list of extended key usages, timeStamping being one of them. But that extended key usage may only be used alone.

This is where I stopped looking for further issues, so the list might be incomplete. You probably should start by using less complex signature containers and (when that works) try to add extra features one by one to check whether they mean trouble with Adobe Reader.

By the way, such an issue might actually be due to Adobe Reader not supported some algorithm used in your signature; the list of crypto algorithms supported by Adobe Reader is very short, a number of algorithms allowed in the EU for qualified signatures are not supported.

While analyzing the file document-with signingTime.pdf you provided in a comment, I recognized an issue in it. Being aware of that issue I re-checked your original document-17 21.08.14.pdf and also recognized that issue therein, so maybe this issue causes the validation problem you're here to solve. Thus, ...

Both your example files (document-17 21.08.14.pdf and document-with signingTime.pdf) contain each actually two concatenated copies of the same, multi-revision PDF with a single signature Signature1, merely the second copy has a changed ID entry. Added to them are incremental updates with a signature Signature2.

The problem is the following: