I am writing a Java program which will need to validate CMS digital signatures on files in a variety of different formats:

  • ZIP
  • docx/xlsx
  • PDF
  • Any file with a detached signature

I'd like a universal library which I could hand the certificate I expect to be used, the file, and it would extract the signature and verify it.

The best process I can find seems to be to extract the signature with specialist libraries per-format (Apache POI for docx/xlsx, PDFBox for PDF, ...) and then use something like BouncyCastle to validate the signature.

This is fine, but I'd gladly pay money for a higher level library which removed the need for a two-step process.

  • 1
    For validating you first need to configure what signatures you can trust (-> e.g. PGP), therefore a library which just validates signatures is only of little use. Additionally the application specific signatures are not standardized, so you first have to understand the file at least partially for being able to verify the signature. because of those reasons I don't think what you want exists. BTW: I never heard of a ZIP signature...
    – Robert
    Mar 2, 2022 at 14:27
  • File signatures are always format-specific. The best you can do is to get libraries for all foreseable formats you need to support (or a few that can know a lot of formats) but ultimately you can't validate any file format without its specifics.
    – Alejandro
    Mar 2, 2022 at 14:41


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.