JSignPdf(1)

NAME
JSignPdf - digitally sign PDF files with X.509 certificates.

SYNOPSIS
jsignpdf [file1.pdf [file2.pdf …]] [OPTIONS]

DESCRIPTION
JSignPdf is an application designed to digitally sign PDF documents. If you start the program without any command line argument, the GUI will be started, otherwise you can use JSignPdf in command line batch mode.

The main application is bundled with some command line tools to ease the workflow: InstallCert, Verifier and SignatureCounter.

Note that by default, the official "Adobe Acrobat Reader DC" will only display certificates as being valid if the issuer is a trusted one as defined by AATL (Adobe Approved Trust List).

OPTIONS

-a, --append
    add signature to existing ones

    By default are existing signatures replaced by the new one.

--bg-path <file>
    background image path for visible signatures

--bg-scale <scale>
    background image scale for visible signatures

    Insert positive value to multiply image size with the value. Insert zero value to fill whole background with it (stretch). Insert negative value to best fit resize.

-c, --contact <contact>
    signer's contact details (a signature field)

-cl, --certification-level <level>
    level of certification

    Default value is NOT_CERTIFIED. Available values are

    NOT_CERTIFIED,

    CERTIFIED_NO_CHANGES_ALLOWED,

    CERTIFIED_FORM_FILLING,

    CERTIFIED_FORM_FILLING_AND_ANNOTATIONS.

--crl
    enable CRL certificate validation

-d, --out-directory <path>
    folder in which the signed documents will be stored

    Default value is current folder.

--disable-acrobat6-layer-mode
    disables the Acrobat 6 layer mode i.e. all signature layers will be created.

    Acrobat 6.0 and higher recommends that only layer n2 and n4 be present.

--disable-assembly
    deny assembly in encrypted documents

--disable-copy
    deny copy in encrypted documents

--disable-fill
    deny fill encrypted documents

--disable-modify-annotations
    deny modify annotations in encrypted documents

--disable-modify-content
    deny modify content in encrypted documents

--disable-screen-readers
    deny screen readers in encrypted documents

-e, --encrypted
    This property is deprecated, use --encryption PASSWORD instead!

-ec, --encryption-certificate <file>
    path to the certificate file, which is used to encrypt output PDF in case of --encryption CERTIFICATE

-fs, --font-size <size>
    font size for visible signature text, default value is 10.0

-h, --help
    prints this help screen

-ha, --hash-algorithm <algorithm>
    hash algorithm used for signature

    Default value is SHA1. Available values are

    SHA1,

    SHA256,

    SHA384,

    SHA512,

    RIPEMD160.

--img-path <file>
    image path for visible signature

-ka, --key-alias <alias>
    name (alias) of the key, which should be used for signing the document

    If this option is not given, the first key in the keystore is used. (List the key aliases using -lk)

-ki, --key-index <index>
    zero based index of the key, which should be used for signing the document

    If neither this option nor <alias> is given, the first key (index=0) in the keystore is used. (List the key aliases using -lk). This option has lower priority than alias.

-kp, --key-password <password>
    password of the key in keystore

    In most cases you don't need to set this option - only keystore is protected by a password, but just in case :)

-ksf, --keystore-file <file>
    sets KeyStore file - as the value use the path on which is file with private key(s) located (.p12, .pfx, .jks, …)

    Some keystores haven't keys stored in a file (e.g. windows keystore - WINDOWS-MY), then don't use this option.

-ksp, --keystore-password <password>
    password to KeyStore

-kst, --keystore-type <type>
    sets KeyStore type (you can list possible values for this option -lkt argument)

-l, --location <location>
    location of a signatue (e.g. Washington DC)

    Empty by default.

--l2-text <text>
    signature text, you can also use placeholders for signature properties:

    ${signer},

    ${timestamp},

    ${location},

    ${reason},

    ${contact}.

--l4-text <text>
    status text

-lk, --list-keys
    lists keys in choosen keystore

-lkt, --list-keystore-types
    lists keystore types, which can be used as values -kst option

-llx, <position>
    lower left corner postion on X-axe of a visible signature

-lly, <position>
    lower left corner postion on Y-axe of a visible signature

-lp, --load-properties
    Loads properties from a default file (created by GUI application).

-lpf, --load-properties-file <file>
    Loads properties from the given file

    The file can be create by copying the default property file JSignPdf created by the GUI in the user home directory.

--ocsp
    enable OCSP certificate validation

--ocsp-server-url
    default OCSP server URL, which will be used in case the signing certificate doesn't contain this information

-op, --out-prefix <prefix>
    prefix for signed file

    Default value is empty prefix.

-opwd, --owner-password <password>
    owner password for encrypted documents (used when --encryption PASSWORD option is given)

-os, --out-suffix <suffix>
    suffix for signed filename

    Default value is "_signed". (e.g. sign process on file mydocument.pdf will create new file mydocument_signed.pdf)

-pe, --encryption <mode>
    encryption mode for the output PDF

    Default value is NONE. Use togethter with -upwd and -opwd in case of PASSWORD mode, and -ec in case of CERTIFICATE. Possible values are:

    NONE,

    PASSWORD,

    CERTIFICATE.

-pg, --page <pageNumber>
    page with visible signature

    Default value is 1 (first page). If the provided page number is out of bounds, then the last page is used.

-pr, --print-right <right>
    printing rights

    Used for encrypted documents. Default value is ALLOW_PRINTING. Available values are:

    DISALLOW_PRINTING,

    ALLOW_DEGRADED_PRINTING,

    ALLOW_PRINTING.

--proxy-host <hostname>
    hostname or IP address of proxy server

--proxy-port <port>
    port of proxy server, default value is 80

--proxy-type <type>
    proxy type for internet connections

    Default value is DIRECT. Possible values are:

    DIRECT,

    HTTP,

    SOCKS.

-q, --quiet
    quiet mode - without info messages during process

-r, --reason <reason>
    reason of signature

    Empty by default.

--render-mode <mode>
    render mode for visible signatures

    Default value is DESCRIPTION_ONLY. Possible values are:

    DESCRIPTION_ONLY,

    GRAPHIC_AND_DESCRIPTION,

    SIGNAME_AND_DESCRIPTION.

-ta, --tsa-authentication <method>
    authentication method used when contacting TSA server

    Default value is NONE. Possible values are:

    NONE,

    PASSWORD,

    CERTIFICATE.

-ts, --tsa-server-url <URL>
    address of timestamping server (TSA)

    If you use this argument, the timestamp will be included to signature. (For testing purposes you can try following URL http://dse200.ncipher.com/TSS/HttpTspServer)

--tsa-policy-oid <policyOID>
    TSA policy OID which should be set to timestamp request

-tscf, --tsa-cert-file <file>
    path to keystore file, which contains private key used to authentication against TSA server, when CERTIFICATE authentication method is used

-tscp, --tsa-cert-password <password>
    password used to open PKCS#12 file (see -tscf option) with a private key

-tsct, --tsa-cert-file-type <ks-type>
    keystore type for TSA CERTIFICATE authentication - the default is PKCS12

-tsh, --tsa-hash-algorithme <algorithm>
    hash algorithm used to in query to time-stamping server (TSA)

    The default is SHA-1

-tsp, --tsa-password <password>
    TSA user password

    Use this switch if you use timestamping (-ts) and TSA server requires authentication.

-tsu, --tsa-user <username>
    TSA user name

    Use this switch if you use timestamping (-ts) and TSA server requires authentication.

-upwd, --user-password <password>
    user password for encrypted documents (used when --encryption PASSWORD option is given)

-urx <position>
    upper right corner postion on X-axe of a visible signature

-ury <position>
    upper right corner postion on Y-axe of a visible signature

-V, --visible-signature
    enables visible signature

-v, --version
    shows the application version

EXAMPLES

  Simplest signature on windows
Creates copy of mydocument.pdf with name mydocument_signed.pdf, which is digitally signed with the first certificate found in default windows certificate store.

  $ jsignpdf -kst WINDOWS-MY mydocument.pdf

  PKCS12 signature with encryption
Creates signed and encrypted file mydocument_signed.pdf, printing of the new file is not allowed. For signature is used key with alias cert23 from the file my_certificate.pfx.

  $ jsignpdf -kst PKCS12 -ksf my_certificate.pfx -ksp myPrivateKeystorePassword -ka cert23 \
      -pe PASSWORD -opwd xxx123 -upwd 123xxx -pr DISALLOW_PRINTING mydocument.pdf

  Listing KeyStore types
Lists keystore types.

  $ jsignpdf -lkt

FILES
Some advanced options are not controlled from GUI or command line. They can be only set directly in the appropriate configuration file.

  conf.properties
The file $INSTALLDIR/conf/conf.properties, where $INSTALLDIR is most likely /usr/share/java/jsignpdf/, contains several option groups:

•   visible signature font settings

•   control the certificate checks

•   PKCS#11 support

•   enable more strict SSL handling

  Java VM options
If the Java VM properties has to be changed (e.g. maximum memory allowed) you can edit the appropriate launch script file (e.g. /usr/bin/jsignpdf) and add properties with -D switch. See java(1) for some possible properties. For example:

  #!/bin/sh
  java -Dswing.aatext=true -jar jsignpdf.jar "$@"

EXIT STATUS

0   program finished without errors

1   command line is in a wrong format

2   no operation requested - e.g. no file for signing provided

3   signing of some, but not all, files failed

4   signing of all files failed

REPORTING BUGS AND GETTING HELP
Although JSignPdf is officially no longer actively developed since 2012, new versions came out since then on a regular basis. Released by the original developer, these versions contain bug fixes and contributions from the community.

Official project tracker is found here, but seems to be orphraned:

https://sourceforge.net/p/jsignpdf/bugs-change-requests

The Google Group on the other hand is quite responsive:

https://groups.google.com/forum/#!forum/jsignpdf

Last but not least, you can report bugs to the project site at Github:

https://github.com/intoolswetrust/jsignpdf

Your bug report should always include:

•   The error message you get (if any). If the error message is not from jsignpdf you need to show why you think jsignpdf caused these.

•   The complete output of jsignpdf --version. If you are not running the latest released version (see https://sourceforge.net/projects/jsignpdf/files/stable) you should specify why you believe the problem is not fixed in that version.

•   A minimal, complete, and verifiable example (See description on http://stackoverflow.com/help/mcve).

AUTHOR
JSignPdf is written and maintained by "Josef -kwart- Cacek" (http://javlog.cacek.cz/).

This manpage was created by "Jaja" (jaja@mailbox.org) with information from the "Quick Start Guide" and the "GNU Parallel" manpage as a template.

LICENSE
This Software is licenced under MPL-1.1 and LGPL-2.1.

A copy of these licenses and third-party licenses used by some library are distributed with this software. See /usr/share/licenses/jsignpdf.

SEE ALSO
A comprehensive "Quick Start Guide" can be found under /usr/share/doc/jsignpdf.

jsignpdf-installcert(1), java(1)