AdobeR | R package to access Adobe Analytics Reporting API v2 | Runtime Evironment library

I have this bit that was setup years ago and has been working fine:

I am digitally signing a PDF with iText7 and GlobalSign DSS. I implemented the GlobalSing DSS API calls into the necessary iText classes. I get the proper server responses and I am able to call the pdfSigner.signDetached() method with all the needed arguments. Signing with the pdfSigner also succeeds and I get a signed PDF that looks good at first sight. But when I open the signed pdf in Adobe Reader it tells me that the trust chain of the signing certificate is broken and that it can not trace it back to the CA root. Which is strange because it is an AATL certificate and the AATL list of the Adobe Reader is up to date.
And I do not understand why this is happening.

This is what I do :

• call DSS for an identity : returns an id string, the signing certificate and an ocsp response

• call DSS for the trustchain : returns the chain of certificates used to
  sign the signing certicate, up to the GlobalSign root, together with
  their oscp responses (except for the root)

• I create an array of X509Certificate objects containing the signing
  certificate, 2 intermediates and the GlobalSign root certificate (in that order)

• I implement an IOcspClient that uses the ocsp response from the DSS call for the identity

• I implement an ITsaClient that calls the DSS API /timestamp/{digest}

• and finally I execute : pdfSigner.signDetached(externalDigest, externalSignature, chain.toArray(new X509Certificate[]{}), null, dssOcspClient, dssTSAClient, 0, PdfSigner.CryptoStandard.CMS);

• in which the externalSignature (an implementation of IExternalSignature) will call the DSS identity/{id}/sign/{digest} API

While debugging into the signDetached method and deeper into the pdfSigner code, I clearly see that all certificates are in the chain in the right order. I see them being processed in the PdfPKCS7 class (however I don't know/understand exactly what is going on there). I see the signing taking place, no exceptions are thrown and at the end the produced PDF looks like it is correctly signed. Which Adobe says is not.

What am I missing here ?

The trustchain response from de DSS API not only returns the certificates from the chain of trust of the signing certificate, but also the ocsp responses for the two intermediates between the signing certificate and the GlobalSign root. These are never used. And in fact I don't know what to do with them either.
Could these be the missing pieces for AdobeReader to reconstruct the trust chain up to the GlobalSign root ?
And if so : how do I put them into that PDF ?
And if not : then what am I doing wrong that breaks that trustchain ?

An answer to these questions would save my day :-)

Here is the link to a PDF that will show the problem :
test pdf signed with DSS
(after accepting the answer, I removed the example pdf on my client's request)

Below are some pieces of the code.

The center piece that gathers the DSS info and calls the signDetached method

I use the following code in NAV 2017:

I'm following the iText certificate verification example (it's the 3rd example found here: https://itextpdf.com/en/resources/examples/itext-7/digital-signatures-chapter-5).

I don't quite get the following piece of code (I'm using iTextsharp with C#, but code for java is similar):

I am trying to set up if-match header as following and making use of HttpClient available in System.Net.Http:

I need to create a PDF/A from a Folder of Tiff Files. Creating a PDF (1.5) is working with ImageMagick. But Converting this PDF to a PDF/A using Ghostscript is a problem.

My GhostScript cmd:

I am doing cmyk to rgb conversion but trying various way, unable to get it done. Kindly check my findings and please advice me,

1. i am getting the err and warning message when running through alfresco and conversion is incorrect

os: Linux
command: /opt/alfresco-one/common/bin/convert -density 300 /opt/alfresco-one/tomcat/temp/amicmyk.tif -profile /opt/alfresco-one/cit/rgbprofile/AdobeRGB1998.icc /opt/alfresco-one/Websites/amirgb.jpg
succeeded: true
exit code: 0
out:
err: .convert.bin: delegate library support not built-in `/opt/alfresco-one/tomcat/temp/amicmyk.tif' (LCMS) @ warning/profile.c/ProfileImage/814.

2. When run imagemagick command through terminal there is no error and conversion is perfect

[alfresco-one@ABC-STG-server alfresco-one]$ /opt/alfresco-one/common/bin/convert -density 300 /opt/alfresco-one/tomcat/temp/amicmyk.tif -profile /opt/alfresco-one/cit/rgbprofile/AdobeRGB1998.icc /opt/alfresco-one/Websites/amiRgb.jpg

3. I can see that lcms is present as in built delegate

[alfresco-one@ABC-STG-server alfresco-one]$ convert -version
Version: ImageMagick 7.0.7-5 Q16 x86_64 2017-10-01 http://www.imagemagick.org Copyright: © 1999-2017 ImageMagick Studio LLC
License: http://www.imagemagick.org/script/license.php
Features: Cipher DPC HDRI Modules OpenMP
Delegates (built-in): bzlib cairo djvu fftw fontconfig fpx freetype gslib jng jpeg lcms ltdl lzma pangocairo png ps tiff webp wmf x xml zlib

4. So i tried executing the imagemagick command using Runtime.exec() as below

If I run following program, it executed successfully and converted correctly

import java.io.File;
import java.io.IOException;

public class CmykToRgb {

I have created a PostScript file from a TIFF image using ImageMagick.

The command-line I am using is:

I'm reaching out to larger community of developers in seek of help to understand the real cause and possibly finding a fix. I have asked questions from Aspose, and they have also tracked the issue (PDFNET-42880) in their system. I think they are not going to investigate this anytime soon as it is very specific case. And now I am posting this here to ask more details about:

1. What is difference in Adobe 'save as' vs. Foxit Reader 'save as' vs. Windows Reader 'save as' feature?

2. Issues with Adobe product that are not so obvious to figure out. I don't even know what to ask :D

Link to their (Aspose) old forum: https://www.aspose.com/community/forums/thread/845549/removing-stamps-fails-after-saving-stamped-file-from-adobe-acrobat.aspx

Case: Created PDF with forms using OpenOffice (version 3.4.0), stamped with Aspose PDF, opened with Adobe Reader DC (or Adobe Acrobat XI), filled, saved as new file. Now this new file is fine, but when I try to remove stamps using Aspose (and replace with new stamp later), this is where things get interesting.

Files that I've tested with: https://1drv.ms/f/s!Auvpijam7a73iDzOqc6wZPuY9l81

• Stamp_Location.png
• OoPdfFormExample_WithStamp.pdf
• OoPdfFormExample_WithStamp_StampRemoved.pdf
• OoPdfFormExample_WithStamp_SavedFromFoxit.pdf
• OoPdfFormExample_WithStamp_SavedFromFoxit_StampRemoved.pdf
• OoPdfFormExample_WithStamp_SavedFromWindowsReader.pdf
• OoPdfFormExample_WithStamp_SavedFromWindowsReader_StampRemoved.pdf
• OoPdfFormExample_WithStamp_SavedFromAdobeReader.pdf
• OoPdfFormExample_WithStamp_SavedFromAcrobat_StampRemoved.pdf

C# code that is used to remove the stamp(s):