pdf-as-5 (#82)

- JDK 17
- PDFBox 3
- PDF-AS Web moved to Spring Boot
- MOA Integration tests w/ new error code

---------

Co-authored-by: Gerald Palfinger <gerald.palfinger@a-sit.at>
Co-authored-by: kathrin.resek <kathrin.resek@a-sit.at>

42 files changed, 722 insertions, 335 deletions

diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/PdfAsWeb.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/PdfAsWeb.java
new file mode 100644
index 00000000..9d1cd7fe
--- /dev/null
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/PdfAsWeb.java
@@ -0,0 +1,11 @@
+package at.gv.egiz.pdfas.web;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class PdfAsWeb {
+  public static void main(String[] args) {
+    SpringApplication.run(PdfAsWeb.class, args);
+  }
+}
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/config/WebConfiguration.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/config/WebConfiguration.java
index 7177541c..c7d36d9a 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/config/WebConfiguration.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/config/WebConfiguration.java
@@ -25,6 +25,7 @@ package at.gv.egiz.pdfas.web.config;
 
 import java.io.File;
 import java.io.FileInputStream;
+import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.Iterator;
 import java.util.List;
@@ -131,15 +132,23 @@ public class WebConfiguration implements IConfigurationConstants {
 
 	private static List<String> whiteListregEx = new ArrayList<String>();
 	private static List<String> overwritewhiteListregEx = new ArrayList<String>();
+
+	public static void configure(String configFile) {
+		try (InputStream is = new FileInputStream(configFile)) {
+			configure(is);
+		} catch (Exception e) {
+			logger.error("Failed to load configuration {}", configFile, e);
+		}
+	}
 	
-	public static void configure(String config) {
+	public static void configure(InputStream config) {
 
 		properties.clear();
 		whiteListregEx.clear();
 		overwritewhiteListregEx.clear();
 
 		try {
-			properties.load(new FileInputStream(config));
+			properties.load(config);
 		} catch (Exception e) {
 			logger.error("Failed to load configuration: " + e.getMessage());
 			throw new RuntimeException(e);
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/filter/ExceptionCatchFilter.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/filter/ExceptionCatchFilter.java
index 5d1abc15..15b8f61b 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/filter/ExceptionCatchFilter.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/filter/ExceptionCatchFilter.java
@@ -28,15 +28,15 @@ import java.util.Collections;
 import java.util.Enumeration;
 import java.util.List;
 
-import javax.servlet.Filter;
-import javax.servlet.FilterChain;
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.FilterConfig;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
 
 import org.apache.commons.lang3.StringUtils;
 import org.slf4j.MDC;
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/filter/UserAgentFilter.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/filter/UserAgentFilter.java
index ef7d391d..15cadb48 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/filter/UserAgentFilter.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/filter/UserAgentFilter.java
@@ -2,13 +2,13 @@ package at.gv.egiz.pdfas.web.filter;
 
 import java.io.IOException;
 
-import javax.servlet.Filter;
-import javax.servlet.FilterChain;
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.FilterConfig;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
 
 import lombok.extern.slf4j.Slf4j;
 
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/PdfAsHelper.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/PdfAsHelper.java
index 9900dda4..841acca9 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/PdfAsHelper.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/PdfAsHelper.java
@@ -32,6 +32,7 @@ import java.io.StringWriter;
 import java.io.UnsupportedEncodingException;
 import java.net.URL;
 import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
 import java.security.cert.CertificateException;
 import java.util.ArrayList;
 import java.util.Iterator;
@@ -40,20 +41,21 @@ import java.util.Map;
 import java.util.UUID;
 
 import javax.imageio.ImageIO;
-import javax.servlet.RequestDispatcher;
-import javax.servlet.ServletContext;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
-import javax.xml.bind.JAXBElement;
-import javax.xml.ws.WebServiceException;
-
+import jakarta.servlet.RequestDispatcher;
+import jakarta.servlet.ServletContext;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
+import jakarta.xml.bind.JAXBElement;
+import jakarta.xml.ws.WebServiceException;
+
+import lombok.val;
 import org.apache.commons.codec.binary.Base64;
 import org.apache.commons.io.FileUtils;
 import org.apache.commons.io.IOUtils;
-import org.apache.commons.lang3.StringEscapeUtils;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.text.StringEscapeUtils;
 import org.apache.http.entity.ContentType;
 
 import com.google.gson.JsonArray;
@@ -594,7 +596,7 @@ public class PdfAsHelper {
             
   }
 	
-  private static StatusRequest initializeSigningContextForNewDocument(HttpServletRequest request, String connector, PdfasSignRequest pdfAsRequest) 
+  private static StatusRequest.Stage1 initializeSigningContextForNewDocument(HttpServletRequest request, String connector, PdfasSignRequest pdfAsRequest)
       throws PdfAsWebException, WriterException, IOException, PdfAsException, PDFASError {   
     HttpSession session = request.getSession();
     
@@ -619,7 +621,7 @@ public class PdfAsHelper {
         
   }
 
-  private static StatusRequest buildPdfasStatusRequestToSignSingleDocument(DocumentToSign pdfToSign, HttpSession session, IPlainSigner signer, 
+  private static StatusRequest.Stage1 buildPdfasStatusRequestToSignSingleDocument(DocumentToSign pdfToSign, HttpSession session, IPlainSigner signer,
       CoreSignParams coreSignParams, String qrCodeContent, Configuration config) throws WriterException, IOException, PdfAsException, PDFASError {
     ByteArrayOutputStream baos = new ByteArrayOutputStream();
     session.setAttribute(PDF_OUTPUT, baos);
@@ -738,7 +740,7 @@ public class PdfAsHelper {
 					.getAttribute(PDF_STATUS);
 			if(statusObject != null && statusObject instanceof StatusRequest) {
 				StatusRequest statusRequest = (StatusRequest)statusObject;
-				if(statusRequest.needCertificate() || statusRequest.needSignature()) {
+				if (statusRequest instanceof StatusRequest.Stage1 || statusRequest instanceof StatusRequest.Stage2) {
 					return true;
 				}
 			}
@@ -756,21 +758,19 @@ public class PdfAsHelper {
 		StatusRequest statusRequest = (StatusRequest) session
 				.getAttribute(PDF_STATUS);
 
-		if (statusRequest == null) {
+		if (!(statusRequest instanceof StatusRequest.Stage1 statusRequest1)) {
 			throw new PdfAsWebException("No Signature running in session:"
 					+ session.getId());
 		}
-
-		statusRequest.setCertificate(certificate);
-		statusRequest = pdfAs.process(statusRequest);
-		session.setAttribute(PDF_STATUS, statusRequest);
+		val statusRequest2 = statusRequest1.setCertificate(certificate);
+		session.setAttribute(PDF_STATUS, statusRequest2);
 
 		PdfAsHelper.process(request, response, context);
 	}
 
 	public static void injectSignature(HttpServletRequest request,
 			HttpServletResponse response,
-			byte[] cmsSginature,
+			byte[] cmsSignature,
 			ServletContext context) throws Exception {
 
 		log.debug("Got CMS Signature Response");
@@ -779,14 +779,13 @@ public class PdfAsHelper {
 		StatusRequest statusRequest = (StatusRequest) session
 				.getAttribute(PDF_STATUS);
 
-		if (statusRequest == null) {
+		if (!(statusRequest instanceof StatusRequest.Stage2 statusRequest2)) {
 			throw new PdfAsWebException("No Signature running in session:"
 					+ session.getId());
 		}
 
-		statusRequest.setSigature(cmsSginature);
-		statusRequest = pdfAs.process(statusRequest);
-		session.setAttribute(PDF_STATUS, statusRequest);
+		val statusRequest3 = statusRequest2.setSignature(cmsSignature);
+		session.setAttribute(PDF_STATUS, statusRequest3);
 
 		PdfAsHelper.process(request, response, context);
 	}
@@ -807,7 +806,7 @@ public class PdfAsHelper {
 			BKUSLConnector bkuSLConnector = (BKUSLConnector) session
 					.getAttribute(PDF_SL_CONNECTOR);
 
-			if (statusRequest.needCertificate()) {
+			if (statusRequest instanceof StatusRequest.Stage1) {
 				log.debug("Needing Certificate from BKU");
 				// build SL Request to read certificate
 				InfoboxReadRequestType readCertificateRequest = bkuSLConnector
@@ -833,7 +832,7 @@ public class PdfAsHelper {
 			throws Exception {
 
 		HttpSession session = request.getSession();
-		StatusRequest statusRequest = (StatusRequest) session.getAttribute(PDF_STATUS);
+		StatusRequest statusRequestGeneric = (StatusRequest) session.getAttribute(PDF_STATUS);
 		PdfasSignRequest pdfAsRequest = (PdfasSignRequest) session.getAttribute(PDF_PROCESSING_REQUEST);
 		
 		
@@ -849,7 +848,7 @@ public class PdfAsHelper {
 		if (!joseTools.isInitialized())
 			joseTools = null;
 		
-		if (statusRequest.needCertificate()) {
+		if (statusRequestGeneric instanceof StatusRequest.Stage1 statusRequest) {
 			log.debug("Needing Certificate from BKU");
 			// build SL Request to read certificate
 			InfoboxReadRequestType readCertificateRequest = slConnector
@@ -888,11 +887,10 @@ public class PdfAsHelper {
 				response.setContentType("text/html");
 				response.getWriter().close();
 				
-			} else if (slConnector instanceof SL20Connector) {
-				//generate request for getCertificate command 
-				SL20Connector sl20Connector = (SL20Connector)slConnector;
-				
-				//use 'SecureSigningKeypair' per default
+			} else if (slConnector instanceof SL20Connector sl20Connector) {
+				//generate request for getCertificate command
+
+                //use 'SecureSigningKeypair' per default
 				String keyId = SL20Connector.SecureSignatureKeypair;
 				
 				java.security.cert.X509Certificate x5cEnc = null;
@@ -976,7 +974,7 @@ public class PdfAsHelper {
 			} else
 				throw new PdfAsWebException("Invalid connector: " + slConnector.getClass().getName());
 			
-		} else if (statusRequest.needSignature()) {
+		} else if (statusRequestGeneric instanceof StatusRequest.Stage2 statusRequest) {
 			log.debug("Needing Signature from BKU");
 			// build SL Request for cms signature
 			RequestPackage pack = slConnector.createCMSRequest(
@@ -1077,7 +1075,7 @@ public class PdfAsHelper {
 				log.trace("Write 'createCAdES' command to VDA: " + sl20CreateCAdES.toString());
 				StringWriter writer = new StringWriter();
 				writer.write(sl20CreateCAdES.toString());						
-				final byte[] content = writer.toString().getBytes("UTF-8");
+				final byte[] content = writer.toString().getBytes(StandardCharsets.UTF_8);
 				response.setStatus(HttpServletResponse.SC_OK);
 				response.setContentLength(content.length);
 				response.setContentType(ContentType.APPLICATION_JSON.toString());						
@@ -1088,9 +1086,9 @@ public class PdfAsHelper {
 				
 			}
 								
-		} else if (statusRequest.isReady()) {
+		} else if (statusRequestGeneric instanceof StatusRequest.Stage3 statusRequest) {
 			log.debug("Single document is ready. Perform post-processing ... ");
-			SignResult result = pdfAs.finishSign(statusRequest);
+			SignResult result = statusRequest.finishSign();
 
 			ByteArrayOutputStream baos = (ByteArrayOutputStream) session.getAttribute(PDF_OUTPUT);
 			baos.close();
@@ -1112,7 +1110,7 @@ public class PdfAsHelper {
 					.getCode());
 					
 			SignedDocument signPdfDoc = SignedDocument.builder()
-			    .signingTimestamp(Long.valueOf(System.currentTimeMillis()))
+			    .signingTimestamp(System.currentTimeMillis())
 			    .outputData(baos.toByteArray())
 			    .fileName(PdfAsHelper.getPDFFileName(request))
 			    .verificationResponse(verResponse)
@@ -1125,28 +1123,28 @@ public class PdfAsHelper {
 			// check if more files are available
 			if (pdfAsRequest.hasNext()) {
 			  log.debug("Find additional file, restarting signing process again ... ");			  
-			  StatusRequestImpl nextStatusRequest = (StatusRequestImpl)initializeSigningContextForNewDocument(request, connector, pdfAsRequest);			  
-			  nextStatusRequest.setCertificate(((StatusRequestImpl)statusRequest).getCertificate().getEncoded());
-			  nextStatusRequest.setNeedCertificate(true);
-		    
-			  statusRequest = pdfAs.process(nextStatusRequest);
-			  session.setAttribute(PDF_STATUS, nextStatusRequest);
-
-			  PdfAsHelper.process(request, response, context);			  			 
-			  session.setAttribute(PDF_STATUS, nextStatusRequest);
+			  StatusRequest.Stage1 nextStatusRequest1 = initializeSigningContextForNewDocument(request, connector, pdfAsRequest);
+			  StatusRequest.Stage2 nextStatusRequest2 = nextStatusRequest1.setCertificate(
+                  statusRequest.getRequestedSignature().getCertificate().getEncoded());
+
+			  session.setAttribute(PDF_STATUS, nextStatusRequest2);
+
+              // recurse
+			  PdfAsHelper.process(request, response, context);
 			  		    			  			  
 			} else {
-	      if (slConnector instanceof BKUSLConnector) {
-	        PdfAsHelper.gotoProvidePdf(context, request, response);
-	        
-	      } else if (slConnector instanceof SL20Connector) {
-	        //TODO: add code to send SL20 redirect command to redirect the user from DataURL connection to App Front-End connection
-	        String callUrl = generateProvideURL(request, response);
-	        String transactionId = (String) request.getAttribute(PdfAsHelper.PDF_SESSION_PREFIX + SL20Constants.SL20_TRANSACTIONID);
-	        buildSL20RedirectResponse(request, response, transactionId, callUrl);
-	        
-	      } else
-	        throw new PdfAsWebException("Invalid connector: " + slConnector.getClass().getName());
+              if (slConnector instanceof BKUSLConnector) {
+                PdfAsHelper.gotoProvidePdf(context, request, response);
+
+              } else if (slConnector instanceof SL20Connector) {
+                //TODO: add code to send SL20 redirect command to redirect the user from DataURL connection to App Front-End connection
+                String callUrl = generateProvideURL(request, response);
+                String transactionId = (String) request.getAttribute(PdfAsHelper.PDF_SESSION_PREFIX + SL20Constants.SL20_TRANSACTIONID);
+                buildSL20RedirectResponse(request, response, transactionId, callUrl);
+
+              } else {
+                throw new PdfAsWebException("Invalid connector: " + slConnector.getClass().getName());
+              }
 	     			  
 			}
 			
@@ -1154,52 +1152,54 @@ public class PdfAsHelper {
       throw new PdfAsWebException("Invalid state!");
       
     }
-	}
+  }
 
   private static String getTemplateSL() throws IOException {
 		String xml = FileUtils.readFileToString(
-		    FileUtils.toFile(PdfAsHelper.class.getResource("/template_sl.html")));
+		    FileUtils.toFile(PdfAsHelper.class.getResource("/template_sl.html")),
+                StandardCharsets.UTF_8);
 		return xml;
 	}
 
 	public static String getErrorRedirectTemplateSL() throws IOException {
-		String xml = FileUtils.readFileToString(FileUtils
-				.toFile(PdfAsHelper.class
-						.getResource("/template_error_redirect.html")));
+		String xml = FileUtils.readFileToString(
+            FileUtils.toFile(PdfAsHelper.class.getResource("/template_error_redirect.html")),
+                StandardCharsets.UTF_8);
 		return xml;
 	}
 
 	public static String getProvideTemplate() throws IOException {
-		String xml = FileUtils
-				.readFileToString(FileUtils.toFile(PdfAsHelper.class
-						.getResource("/template_provide.html")));
+		String xml = FileUtils.readFileToString(
+            FileUtils.toFile(PdfAsHelper.class.getResource("/template_provide.html")),
+                StandardCharsets.UTF_8);
 		return xml;
 	}
 
 	public static String getErrorTemplate() throws IOException {
-		String xml = FileUtils.readFileToString(FileUtils
-				.toFile(PdfAsHelper.class.getResource("/template_error.html")));
+		String xml = FileUtils.readFileToString(
+            FileUtils.toFile(PdfAsHelper.class.getResource("/template_error.html")),
+                StandardCharsets.UTF_8);
 		return xml;
 	}
 
 	public static String getGenericTemplate() throws IOException {
-		String xml = FileUtils.readFileToString(FileUtils
-				.toFile(PdfAsHelper.class
-						.getResource("/template_generic_param.html")));
+		String xml = FileUtils.readFileToString(
+            FileUtils.toFile(PdfAsHelper.class.getResource("/template_generic_param.html")),
+                StandardCharsets.UTF_8);
 		return xml;
 	}
 
 	public static String getInvokeRedirectTemplateSL() throws IOException {
-		String xml = FileUtils.readFileToString(FileUtils
-				.toFile(PdfAsHelper.class
-						.getResource("/template_invoke_redirect.html")));
+		String xml = FileUtils.readFileToString(
+            FileUtils.toFile(PdfAsHelper.class.getResource("/template_invoke_redirect.html")),
+                StandardCharsets.UTF_8);
 		return xml;
 	}
 
   public static String getInvokeRedirectTemplateMoreFiles() throws IOException {
-    String xml = FileUtils.readFileToString(FileUtils
-        .toFile(PdfAsHelper.class
-            .getResource("/template_invoke_redirect_more_files.html")));
+    String xml = FileUtils.readFileToString(
+            FileUtils.toFile(PdfAsHelper.class.getResource("/template_invoke_redirect_more_files.html")),
+                StandardCharsets.UTF_8);
     return xml;
   }
 	
@@ -1602,7 +1602,7 @@ public class PdfAsHelper {
 	public static void setSignatureActive(HttpServletRequest request,
 			boolean value) {
 		HttpSession session = request.getSession();
-		session.setAttribute(SIGNATURE_ACTIVE, new Boolean(value));
+		session.setAttribute(SIGNATURE_ACTIVE, Boolean.valueOf(value));
 	}
 
 	public static boolean isSignatureActive(HttpServletRequest request) {
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/PdfAsParameterExtractor.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/PdfAsParameterExtractor.java
index 1ed85e98..0791e37e 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/PdfAsParameterExtractor.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/PdfAsParameterExtractor.java
@@ -28,7 +28,7 @@ import java.util.Enumeration;
 import java.util.HashMap;
 import java.util.Map;
 
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
 
 import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/RemotePDFFetcher.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/RemotePDFFetcher.java
index 696a3dc1..d904030f 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/RemotePDFFetcher.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/RemotePDFFetcher.java
@@ -108,7 +108,7 @@ public class RemotePDFFetcher {
 					
 					if(fetchInfos.length == 3) {
 					    String userpass = fetchInfos[1] + ":" + fetchInfos[2];
-					    String basicAuth = "Basic " + javax.xml.bind.DatatypeConverter.printBase64Binary(userpass.getBytes("UTF-8"));
+					    String basicAuth = "Basic " + jakarta.xml.bind.DatatypeConverter.printBase64Binary(userpass.getBytes("UTF-8"));
 					    uc.setRequestProperty("Authorization", basicAuth);
 					}
 					
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/VerifyResultEncoder.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/VerifyResultEncoder.java
index 42a4068a..8b477c2e 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/VerifyResultEncoder.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/VerifyResultEncoder.java
@@ -3,8 +3,8 @@ package at.gv.egiz.pdfas.web.helper;
 import java.io.IOException;
 import java.util.List;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import at.gv.egiz.pdfas.lib.api.verify.VerifyResult;
 
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/VerifyResultHTMLEncoder.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/VerifyResultHTMLEncoder.java
index 590e93a1..3db45370 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/VerifyResultHTMLEncoder.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/VerifyResultHTMLEncoder.java
@@ -6,8 +6,8 @@ import java.io.IOException;
 import java.io.OutputStream;
 import java.util.List;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import at.gv.egiz.pdfas.lib.api.verify.VerifyResult;
 
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/VerifyResultJSONEncoder.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/VerifyResultJSONEncoder.java
index 43ad3581..b6eac5bc 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/VerifyResultJSONEncoder.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/helper/VerifyResultJSONEncoder.java
@@ -7,8 +7,8 @@ import java.io.OutputStream;
 import java.security.cert.CertificateEncodingException;
 import java.util.List;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/json_api/ExceptionFormatter.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/json_api/ExceptionFormatter.java
new file mode 100644
index 00000000..8d5f1cea
--- /dev/null
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/json_api/ExceptionFormatter.java
@@ -0,0 +1,17 @@
+package at.gv.egiz.pdfas.web.json_api;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.ResponseStatus;
+import org.springframework.web.bind.annotation.RestControllerAdvice;
+
+import java.util.Map;
+
+@RestControllerAdvice(basePackages = "at.gv.egiz.pdfas.web.json_api")
+public class ExceptionFormatter {
+  @ExceptionHandler(jakarta.xml.ws.WebServiceException.class)
+  @ResponseStatus(HttpStatus.BAD_REQUEST)
+  public Map<String, Object> mapError(jakarta.xml.ws.WebServiceException e) {
+    return Map.of("error", e.getMessage());
+  }
+}
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/json_api/JacksonConfig.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/json_api/JacksonConfig.java
new file mode 100644
index 00000000..bd82f8ed
--- /dev/null
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/json_api/JacksonConfig.java
@@ -0,0 +1,19 @@
+package at.gv.egiz.pdfas.web.json_api;
+
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import org.springframework.boot.autoconfigure.jackson.Jackson2ObjectMapperBuilderCustomizer;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+/** To match how SOAP serializes enum values */
+@Configuration
+public class JacksonConfig {
+  @Bean
+  public Jackson2ObjectMapperBuilderCustomizer enumsShouldUseToStringToMatchXML() {
+    return b -> b.featuresToEnable(
+        SerializationFeature.WRITE_ENUMS_USING_TO_STRING,
+        DeserializationFeature.READ_ENUMS_USING_TO_STRING
+    );
+  }
+}
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/json_api/SignController.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/json_api/SignController.java
new file mode 100644
index 00000000..e20e7ad0
--- /dev/null
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/json_api/SignController.java
@@ -0,0 +1,37 @@
+package at.gv.egiz.pdfas.web.json_api;
+
+import at.gv.egiz.pdfas.api.ws.*;
+import at.gv.egiz.pdfas.web.ws.PDFASSigningImpl;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import lombok.AllArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/api/v2/sign")
+@AllArgsConstructor
+public class SignController {
+  private final PDFASSigningImpl signingImpl;
+
+  @PostMapping(value = "/single", consumes = "application/json", produces = "application/json")
+  public PDFASSignResponse signSingle(@RequestBody PDFASSignRequest request) {
+    return signingImpl.signPDFDokument(request);
+  }
+
+  @PostMapping(value = "/bulk", consumes = "application/json", produces = "application/json")
+  public PDFASBulkSignResponse signBulk(@RequestBody PDFASBulkSignRequest request) {
+    return signingImpl.signPDFDokument(request);
+  }
+
+  @PostMapping(value = "/multiple", consumes = "application/json", produces = "application/json")
+  public PdfasSignMultipleResponse signMultiple(@RequestBody PdfasSignMultipleRequest request) {
+    return signingImpl.signPDFDokument(request);
+  }
+
+  @PostMapping(value = "/multiple/get-result", consumes = "application/json", produces = "application/json")
+  public PdfasSignMultipleResponse getMultiple(@RequestBody PdfasGetMultipleRequest request) {
+    return signingImpl.getSignedDokument(request);
+  }
+}
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/json_api/SoapLogicBridgeBean.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/json_api/SoapLogicBridgeBean.java
new file mode 100644
index 00000000..b35abfd1
--- /dev/null
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/json_api/SoapLogicBridgeBean.java
@@ -0,0 +1,15 @@
+package at.gv.egiz.pdfas.web.json_api;
+
+import at.gv.egiz.pdfas.web.ws.PDFASSigningImpl;
+import at.gv.egiz.pdfas.web.ws.PDFASVerificationImpl;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+/** Exposes the SOAP service implementations as Spring beans to new code */
+@Configuration
+public class SoapLogicBridgeBean {
+  @Bean
+  public PDFASSigningImpl signingImplBridge() { return new PDFASSigningImpl(); }
+  @Bean
+  public PDFASVerificationImpl verificationImplBridge() { return new PDFASVerificationImpl(); }
+}
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/json_api/VerifyController.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/json_api/VerifyController.java
new file mode 100644
index 00000000..83e287a9
--- /dev/null
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/json_api/VerifyController.java
@@ -0,0 +1,22 @@
+package at.gv.egiz.pdfas.web.json_api;
+
+import at.gv.egiz.pdfas.api.ws.PDFASVerifyRequest;
+import at.gv.egiz.pdfas.api.ws.PDFASVerifyResponse;
+import at.gv.egiz.pdfas.web.ws.PDFASVerificationImpl;
+import lombok.AllArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/api/v2/verify")
+@AllArgsConstructor
+public class VerifyController {
+  private final PDFASVerificationImpl verifyImpl;
+
+  @PostMapping(consumes = "application/json", produces = "application/json")
+  public PDFASVerifyResponse verify(@RequestBody PDFASVerifyRequest request) {
+    return verifyImpl.verifyPDFDokument(request);
+  }
+}
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/DataURLServlet.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/DataURLServlet.java
index 18e14c97..f98e5a7b 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/DataURLServlet.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/DataURLServlet.java
@@ -25,12 +25,12 @@ package at.gv.egiz.pdfas.web.servlets;
 
 import java.io.IOException;
 
-import javax.servlet.ServletException;
-import javax.servlet.annotation.MultipartConfig;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.xml.bind.JAXBElement;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.MultipartConfig;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.xml.bind.JAXBElement;
 
 import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ErrorPage.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ErrorPage.java
index 42236f5e..38d883fa 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ErrorPage.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ErrorPage.java
@@ -26,13 +26,14 @@ package at.gv.egiz.pdfas.web.servlets;
 import java.io.IOException;
 import java.net.URL;
 import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
 
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
-import org.apache.commons.lang3.StringEscapeUtils;
+import org.apache.commons.text.StringEscapeUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -141,13 +142,13 @@ public class ErrorPage extends HttpServlet {
 
 				if (e != null && WebConfiguration.isShowErrorDetails()) {
 					template = template.replace("##CAUSE##",
-							URLEncoder.encode(e.getMessage(), "UTF-8"));
+							URLEncoder.encode(e.getMessage(), StandardCharsets.UTF_8));
 				} else {
 					template = template.replace("##CAUSE##", "");
 				}
 				if (message != null) {
 					template = template.replace("##ERROR##",
-							URLEncoder.encode(message, "UTF-8"));
+							URLEncoder.encode(message, StandardCharsets.UTF_8));
 				} else {
 					template = template.replace("##ERROR##",
 							"Unbekannter Fehler");
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ExternSignServlet.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ExternSignServlet.java
index 957614b1..6359eccb 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ExternSignServlet.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ExternSignServlet.java
@@ -28,14 +28,14 @@ import java.io.IOException;
 import java.util.List;
 import java.util.Map;
 
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
-import org.apache.commons.fileupload.FileItem;
-import org.apache.commons.fileupload.disk.DiskFileItemFactory;
-import org.apache.commons.fileupload.servlet.ServletFileUpload;
+import lombok.val;
+import org.apache.commons.fileupload2.core.DiskFileItem;
+import org.apache.commons.fileupload2.core.DiskFileItemFactory;
 
 import at.gv.egiz.pdfas.api.processing.CoreSignParams;
 import at.gv.egiz.pdfas.api.processing.DocumentToSign;
@@ -61,6 +61,8 @@ import at.gv.egiz.pdfas.web.stats.StatisticEvent.Source;
 import at.gv.egiz.pdfas.web.stats.StatisticEvent.Status;
 import at.gv.egiz.pdfas.web.stats.StatisticFrontend;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.fileupload2.jakarta.servlet6.JakartaServletDiskFileUpload;
+import org.apache.commons.fileupload2.jakarta.servlet6.JakartaServletFileUpload;
 
 /**
  * Servlet implementation class Sign
@@ -70,6 +72,7 @@ public class ExternSignServlet extends HttpServlet {
 
 	private static final long serialVersionUID = 1L;
 
+	// TODO: get this from spring instead of -D
 	public static final String PDF_AS_WEB_CONF = "pdf-as-web.conf";
 	
 	private static final String UPLOAD_PDF_DATA = "pdf-file";
@@ -176,7 +179,7 @@ public class ExternSignServlet extends HttpServlet {
 			byte[] filecontent = null;
 
 			// checks if the request actually contains upload file
-			if (!ServletFileUpload.isMultipartContent(request)) {
+			if (!JakartaServletFileUpload.isMultipartContent(request)) {
 				// No Uploaded data!
 				if (PdfAsParameterExtractor.getPdfUrl(request) != null) {
 					doGet(request, response);
@@ -187,14 +190,14 @@ public class ExternSignServlet extends HttpServlet {
 			} else {
 
 				// configures upload settings
-				DiskFileItemFactory factory = new DiskFileItemFactory();
-				factory.setSizeThreshold(WebConfiguration.getFilesizeThreshold());
-				factory.setRepository(new File(System
-						.getProperty("java.io.tmpdir")));
+				DiskFileItemFactory factory = DiskFileItemFactory.builder()
+					.setThreshold(WebConfiguration.getFilesizeThreshold())
+					.setPath(new File(System.getProperty("java.io.tmpdir")).toPath())
+					.get();
 
-				ServletFileUpload upload = new ServletFileUpload(factory);
-				upload.setFileSizeMax(WebConfiguration.getMaxFilesize());
-				upload.setSizeMax(WebConfiguration.getMaxRequestsize());
+				val upload = new JakartaServletDiskFileUpload(factory);
+				upload.setMaxFileSize(WebConfiguration.getMaxFilesize());
+				upload.setMaxSize(WebConfiguration.getMaxRequestsize());
 
 				// constructs the directory path to store upload file
 				String uploadPath = getServletContext().getRealPath("")
@@ -205,9 +208,9 @@ public class ExternSignServlet extends HttpServlet {
 					uploadDir.mkdir();
 				}
 
-				List<?> formItems = upload.parseRequest(request);
+				List<DiskFileItem> formItems = upload.parseRequest(request);
 				log.debug(formItems.size() + " Items in form data");
-				if (formItems.size() < 1) {
+				if (formItems.isEmpty()) {
 					// No Uploaded data!
 					// Try do get
 					// No Uploaded data!
@@ -219,41 +222,34 @@ public class ExternSignServlet extends HttpServlet {
 								"No Signature data defined!");
 					}
 				} else {
-					for(int i = 0; i < formItems.size(); i++) {
-						Object obj = formItems.get(i);
-						if(obj instanceof FileItem) {
-							FileItem item = (FileItem) obj;
-							if(item.getFieldName().equals(UPLOAD_PDF_DATA)) {
-								filecontent = item.get();
-								try {
-									File f = new File(item.getName());
-									String name = f.getName();
-									log.debug("Got upload: " + item.getName());
-									if(name != null) {
-										if(!(name.endsWith(".pdf") || name.endsWith(".PDF"))) {
-											name += ".pdf";
-										}
-										
-										log.debug("Setting Filename in session: " + name);
-										PdfAsHelper.setPDFFileName(request, name);
-									}
-								}
-								catch(Throwable e) {
-									log.warn("In resolving filename", e);
-								}
-								if(filecontent.length < 10) {
-									filecontent = null;
-								} else {
-									log.debug("Found pdf Data! Size: " + filecontent.length);
-								}
-							} else {
-								request.setAttribute(item.getFieldName(), item.getString());
-								log.debug("Setting " + item.getFieldName() + " = " + item.getString());
-							}
-						} else {
-							log.debug(obj.getClass().getName() +  " - " + obj.toString());
-						}
-					}
+                  for (DiskFileItem item : formItems) {
+                    if (item != null) {
+                      if (item.getFieldName().equals(UPLOAD_PDF_DATA)) {
+                        filecontent = item.getInputStream().readAllBytes();
+                        try {
+                          File f = new File(item.getName());
+                          String name = f.getName();
+                          log.debug("Got upload: " + item.getName());
+                          if (!(name.endsWith(".pdf") || name.endsWith(".PDF"))) {
+                            name += ".pdf";
+                          }
+
+                          log.debug("Setting Filename in session: " + name);
+                          PdfAsHelper.setPDFFileName(request, name);
+                        } catch (Throwable e) {
+                          log.warn("In resolving filename", e);
+                        }
+                        if (filecontent.length < 10) {
+                          filecontent = null;
+                        } else {
+                          log.debug("Found pdf Data! Size: " + filecontent.length);
+                        }
+                      } else {
+                        request.setAttribute(item.getFieldName(), item.getString());
+                        log.debug("Setting " + item.getFieldName() + " = " + item.getString());
+                      }
+                    }
+                  }
 				}
 			}
 			
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/JSONAPIServlet.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/JSONAPIServlet.java
index d5ef2079..b60fae06 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/JSONAPIServlet.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/JSONAPIServlet.java
@@ -5,10 +5,10 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.apache.commons.codec.binary.Base64;
 import org.apache.commons.io.IOUtils;
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFData.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFData.java
index 96d02f16..e7556569 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFData.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFData.java
@@ -34,10 +34,10 @@ import java.util.zip.Deflater;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
 
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import at.gv.egiz.pdfas.api.processing.PdfasSignResponse;
 import at.gv.egiz.pdfas.api.processing.SignedDocument;
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFSignatureCertificateData.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFSignatureCertificateData.java
index e4465e77..869dfdf4 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFSignatureCertificateData.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFSignatureCertificateData.java
@@ -28,10 +28,10 @@ import java.io.OutputStream;
 import java.security.cert.CertificateEncodingException;
 import java.util.List;
 
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFSignatureData.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFSignatureData.java
index e493f4ae..3d96784b 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFSignatureData.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFSignatureData.java
@@ -27,10 +27,10 @@ import java.io.IOException;
 import java.io.OutputStream;
 import java.util.List;
 
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -95,7 +95,7 @@ public class PDFSignatureData extends HttpServlet {
 						"inline;filename=signed_data_" + id + ".pdf");
 				response.setContentType("application/pdf");
 				OutputStream os = response.getOutputStream();
-				os.write(res.getSignatureData());
+				os.write(res.getSignatureData().getBaseData());
 				os.close();
 			} else {
 				logger.warn("Verification DATA not found! for id " + request.getParameter(SIGN_ID) + " in session " + request.getSession().getId());
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFURLData.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFURLData.java
index d4112cad..63172175 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFURLData.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PDFURLData.java
@@ -6,11 +6,11 @@ import at.gv.egiz.pdfas.lib.api.StatusRequest;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
 import java.io.IOException;
 import java.io.OutputStream;
 
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PlaceholderGeneratorServlet.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PlaceholderGeneratorServlet.java
index b07293b1..388c7e9d 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PlaceholderGeneratorServlet.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/PlaceholderGeneratorServlet.java
@@ -10,10 +10,10 @@ import java.io.IOException;
 import java.io.InputStream;
 
 import javax.imageio.ImageIO;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.apache.http.HttpStatus;
 import org.slf4j.Logger;
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ProvidePDFServlet.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ProvidePDFServlet.java
index 47469eb2..f6c3e646 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ProvidePDFServlet.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ProvidePDFServlet.java
@@ -28,13 +28,13 @@ import java.net.URL;
 import java.net.URLEncoder;
 import java.util.List;
 
-import javax.servlet.RequestDispatcher;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.RequestDispatcher;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
-import org.apache.commons.lang3.StringEscapeUtils;
+import org.apache.commons.text.StringEscapeUtils;
 
 import at.gv.egiz.pdfas.api.processing.SignedDocument;
 import at.gv.egiz.pdfas.common.exceptions.PdfAsException;
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ReloadServlet.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ReloadServlet.java
index 84e86634..c4db303f 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ReloadServlet.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/ReloadServlet.java
@@ -3,10 +3,10 @@ package at.gv.egiz.pdfas.web.servlets;
 import java.io.IOException;
 import java.io.OutputStream;
 
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/SLDataURLServlet.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/SLDataURLServlet.java
index 55946afb..d0c331e6 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/SLDataURLServlet.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/SLDataURLServlet.java
@@ -6,11 +6,11 @@ import java.util.ArrayList;
 import java.util.Base64;
 import java.util.List;
 
-import javax.servlet.ServletException;
-import javax.servlet.annotation.MultipartConfig;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.MultipartConfig;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.apache.commons.lang3.StringUtils;
 import org.jose4j.base64url.Base64Url;
@@ -97,8 +97,7 @@ public class SLDataURLServlet extends HttpServlet {
 			
 			//parse SL2.0 command/result into JSON				
 			try {
-				JsonParser jsonParser = new JsonParser();
-				JsonElement sl20Req = jsonParser.parse(Base64Url.decodeToUtf8String(sl20Result));
+				JsonElement sl20Req = JsonParser.parseString(Base64Url.decodeToUtf8String(sl20Result));
 				sl20ReqObj = sl20Req.getAsJsonObject();
 				
 			} catch (JsonSyntaxException e) {
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/SoapServiceServlet.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/SoapServiceServlet.java
index ca005abe..f79e5640 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/SoapServiceServlet.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/SoapServiceServlet.java
@@ -1,7 +1,7 @@
 package at.gv.egiz.pdfas.web.servlets;
 
-import javax.servlet.ServletConfig;
-import javax.xml.ws.Endpoint;
+import jakarta.servlet.ServletConfig;
+import jakarta.xml.ws.Endpoint;
 
 import org.apache.cxf.Bus;
 import org.apache.cxf.BusFactory;
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/UIEntryPointServlet.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/UIEntryPointServlet.java
index d7a3d3c6..2842c7e2 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/UIEntryPointServlet.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/UIEntryPointServlet.java
@@ -25,10 +25,10 @@ package at.gv.egiz.pdfas.web.servlets;
 
 import java.io.IOException;
 
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import at.gv.egiz.pdfas.api.processing.PdfasSignRequest;
 import at.gv.egiz.pdfas.api.ws.PDFASSignParameters.Connector;
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/VerifyServlet.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/VerifyServlet.java
index 003a4a73..a71a13f4 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/VerifyServlet.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/VerifyServlet.java
@@ -27,14 +27,17 @@ import java.io.File;
 import java.io.IOException;
 import java.util.List;
 
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
-import org.apache.commons.fileupload.FileItem;
-import org.apache.commons.fileupload.disk.DiskFileItemFactory;
-import org.apache.commons.fileupload.servlet.ServletFileUpload;
+import lombok.val;
+import org.apache.commons.fileupload2.core.DiskFileItem;
+import org.apache.commons.fileupload2.core.FileItem;
+import org.apache.commons.fileupload2.core.DiskFileItemFactory;
+import org.apache.commons.fileupload2.jakarta.servlet6.JakartaServletDiskFileUpload;
+import org.apache.commons.fileupload2.jakarta.servlet6.JakartaServletFileUpload;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -159,7 +162,7 @@ public class VerifyServlet extends HttpServlet {
 			byte[] filecontent = null;
 
 			// checks if the request actually contains upload file
-			if (!ServletFileUpload.isMultipartContent(request)) {
+			if (!JakartaServletFileUpload.isMultipartContent(request)) {
 				// No Uploaded data!
 				if (PdfAsParameterExtractor.getPdfUrl(request) != null) {
 					doGet(request, response);
@@ -169,14 +172,14 @@ public class VerifyServlet extends HttpServlet {
 				}
 			} else {
 				// configures upload settings
-				DiskFileItemFactory factory = new DiskFileItemFactory();
-				factory.setSizeThreshold(THRESHOLD_SIZE);
-				factory.setRepository(new File(System
-						.getProperty("java.io.tmpdir")));
+				DiskFileItemFactory factory = DiskFileItemFactory.builder()
+					.setThreshold(THRESHOLD_SIZE)
+					.setPath(new File(System.getProperty("java.io.tmpdir")).toPath())
+					.get();
 
-				ServletFileUpload upload = new ServletFileUpload(factory);
-				upload.setFileSizeMax(MAX_FILE_SIZE);
-				upload.setSizeMax(MAX_REQUEST_SIZE);
+				val upload = new JakartaServletDiskFileUpload(factory);
+				upload.setMaxFileSize(MAX_FILE_SIZE);
+				upload.setMaxSize(MAX_REQUEST_SIZE);
 
 				// constructs the directory path to store upload file
 				String uploadPath = getServletContext().getRealPath("")
@@ -187,9 +190,9 @@ public class VerifyServlet extends HttpServlet {
 					uploadDir.mkdir();
 				}
 
-				List<?> formItems = upload.parseRequest(request);
+				List<DiskFileItem> formItems = upload.parseRequest(request);
 				logger.debug(formItems.size() + " Items in form data");
-				if (formItems.size() < 1) {
+				if (formItems.isEmpty()) {
 					// No Uploaded data!
 					// Try do get
 					// No Uploaded data!
@@ -201,48 +204,41 @@ public class VerifyServlet extends HttpServlet {
 								"No Signature data defined!");
 					}
 				} else {
-					for (int i = 0; i < formItems.size(); i++) {
-						Object obj = formItems.get(i);
-						if (obj instanceof FileItem) {
-							FileItem item = (FileItem) obj;
-							if (item.getFieldName().equals(UPLOAD_PDF_DATA)) {
-								filecontent = item.get();
-								try {
-									File f = new File(item.getName());
-									String name = f.getName();
-									logger.debug("Got upload: "
-											+ item.getName());
-									if (name != null) {
-										if (!(name.endsWith(".pdf") || name
-												.endsWith(".PDF"))) {
-											name += ".pdf";
-										}
+                  for (DiskFileItem item : formItems) {
+                    if (item != null) {
+                      if (item.getFieldName().equals(UPLOAD_PDF_DATA)) {
+                        filecontent = item.getInputStream().readAllBytes();
+                        try {
+                          File f = new File(item.getName());
+                          String name = f.getName();
+                          logger.debug("Got upload: "
+                              + item.getName());
+                          if (!(name.endsWith(".pdf") || name
+                              .endsWith(".PDF"))) {
+                            name += ".pdf";
+                          }
 
-										logger.debug("Setting Filename in session: "
-												+ name);
-										PdfAsHelper.setPDFFileName(request,
-												name);
-									}
-								} catch (Throwable e) {
-									logger.warn("In resolving filename", e);
-								}
-								if (filecontent.length < 10) {
-									filecontent = null;
-								} else {
-									logger.debug("Found pdf Data! Size: "
-											+ filecontent.length);
-								}
-							} else {
-								request.setAttribute(item.getFieldName(),
-										item.getString());
-								logger.debug("Setting " + item.getFieldName()
-										+ " = " + item.getString());
-							}
-						} else {
-							logger.debug(obj.getClass().getName() + " - "
-									+ obj.toString());
-						}
-					}
+                          logger.debug("Setting Filename in session: "
+                              + name);
+                          PdfAsHelper.setPDFFileName(request,
+                              name);
+                        } catch (Throwable e) {
+                          logger.warn("In resolving filename", e);
+                        }
+                        if (filecontent.length < 10) {
+                          filecontent = null;
+                        } else {
+                          logger.debug("Found pdf Data! Size: "
+                              + filecontent.length);
+                        }
+                      } else {
+                        request.setAttribute(item.getFieldName(),
+                            item.getString());
+                        logger.debug("Setting " + item.getFieldName()
+                            + " = " + item.getString());
+                      }
+                    }
+                  }
 				}
 			}
 
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/VisBlockServlet.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/VisBlockServlet.java
index b49264f7..d67a88c1 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/VisBlockServlet.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/servlets/VisBlockServlet.java
@@ -4,10 +4,10 @@ import java.io.IOException;
 import java.io.OutputStream;
 import java.security.cert.CertificateException;
 
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/sl20/JsonSecurityUtils.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/sl20/JsonSecurityUtils.java
index bf37b290..7a4d24ae 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/sl20/JsonSecurityUtils.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/sl20/JsonSecurityUtils.java
@@ -181,10 +181,10 @@ public class JsonSecurityUtils implements IJOSETools{
 			jws.setCompactSerialization(serializedContent);
 				
 			//set security constrains
-			jws.setAlgorithmConstraints(new AlgorithmConstraints(ConstraintType.WHITELIST,   
-					SL20Constants.SL20_ALGORITHM_WHITELIST_SIGNING.toArray(new String[SL20Constants.SL20_ALGORITHM_WHITELIST_SIGNING.size()])));
+			jws.setAlgorithmConstraints(new AlgorithmConstraints(ConstraintType.PERMIT,
+					SL20Constants.SL20_ALGORITHM_WHITELIST_SIGNING.toArray(new String[0])));
 			
-			//load signinc certs
+			//load signing certs
 			Key selectedKey = null;
 			List<X509Certificate> x5cCerts = jws.getCertificateChainHeaderValue();
 			String x5t256 = jws.getX509CertSha256ThumbprintHeaderValue();
@@ -232,7 +232,7 @@ public class JsonSecurityUtils implements IJOSETools{
 			
 			//load payLoad
 			logger.debug("SL2.0 commando signature validation sucessfull");
-			JsonElement sl20Req = new JsonParser().parse(jws.getPayload());
+			JsonElement sl20Req = JsonParser.parseString(jws.getPayload());
 			
 			return new VerificationResult(sl20Req.getAsJsonObject(), null, valid) ;
 			
@@ -252,11 +252,11 @@ public class JsonSecurityUtils implements IJOSETools{
 					
 			//set security constrains
 			receiverJwe.setAlgorithmConstraints(
-					new AlgorithmConstraints(ConstraintType.WHITELIST,
-							SL20Constants.SL20_ALGORITHM_WHITELIST_KEYENCRYPTION.toArray(new String[SL20Constants.SL20_ALGORITHM_WHITELIST_KEYENCRYPTION.size()])));
+					new AlgorithmConstraints(ConstraintType.PERMIT,
+							SL20Constants.SL20_ALGORITHM_WHITELIST_KEYENCRYPTION.toArray(new String[0])));
 			receiverJwe.setContentEncryptionAlgorithmConstraints(
-					new AlgorithmConstraints(ConstraintType.WHITELIST,
-							SL20Constants.SL20_ALGORITHM_WHITELIST_ENCRYPTION.toArray(new String[SL20Constants.SL20_ALGORITHM_WHITELIST_ENCRYPTION.size()])));
+					new AlgorithmConstraints(ConstraintType.PERMIT,
+							SL20Constants.SL20_ALGORITHM_WHITELIST_ENCRYPTION.toArray(new String[0])));
 		
 			//set payload
 			receiverJwe.setCompactSerialization(compactSerialization);
@@ -295,7 +295,7 @@ public class JsonSecurityUtils implements IJOSETools{
 			
 						
 			//decrypt payload			
-			return new JsonParser().parse(receiverJwe.getPlaintextString());
+			return JsonParser.parseString(receiverJwe.getPlaintextString());
 			
 		} catch (JoseException e) {
 			logger.warn("SL2.0 result decryption FAILED", e);
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/sl20/SL20HttpBindingUtils.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/sl20/SL20HttpBindingUtils.java
index e43ebfcf..8d049030 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/sl20/SL20HttpBindingUtils.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/sl20/SL20HttpBindingUtils.java
@@ -4,8 +4,8 @@ import java.io.IOException;
 import java.io.StringWriter;
 import java.net.URISyntaxException;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.apache.http.client.utils.URIBuilder;
 import org.apache.http.entity.ContentType;
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/stats/StatisticFrontend.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/stats/StatisticFrontend.java
index f006be54..e78e63ab 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/stats/StatisticFrontend.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/stats/StatisticFrontend.java
@@ -23,23 +23,16 @@ public class StatisticFrontend implements StatisticBackend {
 	private List<StatisticBackend> statisticBackends = new ArrayList<StatisticBackend>();
 
 	private StatisticFrontend() {
-		Iterator<StatisticBackend> statisticIterator = backendLoader.iterator();
 		List<String> enabledBackends = WebConfiguration.getStatisticBackends();
 
 		if (enabledBackends == null) {
-			logger.info("No statitistic backends configured using all available.");
+			logger.info("No statistic backends configured, using all available.");
 		} else {
-			Iterator<String> enabledBackendsIterator = enabledBackends
-					.iterator();
 			logger.info("Allowing the following statistic backends:");
-			while (enabledBackendsIterator.hasNext()) {
-				logger.info(" - {}", enabledBackendsIterator.next());
-			}
+			enabledBackends.forEach(it -> logger.info(" - {}", it));
 		}
 
-		while (statisticIterator.hasNext()) {
-			StatisticBackend statisticBackend = statisticIterator.next();
-
+		for (StatisticBackend statisticBackend : backendLoader) {
 			if (enabledBackends == null
 					|| enabledBackends.contains(statisticBackend.getName())) {
 				logger.info("adding Statistic Logger {} [{}]", statisticBackend
@@ -54,22 +47,8 @@ public class StatisticFrontend implements StatisticBackend {
 		}
 
 		if (enabledBackends != null) {
-			Iterator<String> enabledBackendsIterator = enabledBackends
-					.iterator();
-			while (enabledBackendsIterator.hasNext()) {
-				String enabledBackend = enabledBackendsIterator.next();
-				statisticIterator = statisticBackends.iterator();
-				boolean found = false;
-				while (statisticIterator.hasNext()) {
-					StatisticBackend statisticBackend = statisticIterator
-							.next();
-					if (statisticBackend.getName().equals(enabledBackend)) {
-						found = true;
-						break;
-					}
-				}
-
-				if (!found) {
+			for (String enabledBackend : enabledBackends) {
+				if (statisticBackends.stream().noneMatch(it -> it.getName().equals(enabledBackend))) {
 					logger.warn(
 							"Failed to load statistic backend {}. Not in classpath?",
 							enabledBackend);
@@ -103,13 +82,7 @@ public class StatisticFrontend implements StatisticBackend {
 			return;
 		}
 
-		Iterator<StatisticBackend> statisticBackendIterator = statisticBackends
-				.iterator();
-
-		while (statisticBackendIterator.hasNext()) {
-			StatisticBackend statisticBackend = statisticBackendIterator.next();
-			statisticBackend.storeEvent(statisticEvent);
-		}
+		statisticBackends.forEach(statisticBackend -> statisticBackend.storeEvent(statisticEvent));
 	}
 
 }
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/stats/impl/StatisticMicrometerBackend.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/stats/impl/StatisticMicrometerBackend.java
new file mode 100644
index 00000000..89127e6a
--- /dev/null
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/stats/impl/StatisticMicrometerBackend.java
@@ -0,0 +1,77 @@
+package at.gv.egiz.pdfas.web.stats.impl;
+
+import at.gv.egiz.pdfas.web.stats.StatisticBackend;
+import at.gv.egiz.pdfas.web.stats.StatisticEvent;
+import io.micrometer.core.instrument.Counter;
+import io.micrometer.core.instrument.MeterRegistry;
+import io.micrometer.core.instrument.Tags;
+import io.micrometer.core.instrument.Timer;
+import lombok.extern.slf4j.Slf4j;
+import org.jspecify.annotations.NonNull;
+import org.springframework.beans.BeansException;
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.ApplicationContextAware;
+import org.springframework.stereotype.Component;
+
+import java.util.concurrent.TimeUnit;
+import java.util.function.Function;
+
+@Slf4j
+public class StatisticMicrometerBackend implements StatisticBackend {
+  /** bridge between ServiceLoader component and Boot's beans */
+  @Component
+  public static class SpringContextProxy implements ApplicationContextAware {
+    private static volatile ApplicationContext applicationContext;
+    @Override public void setApplicationContext(@NonNull ApplicationContext ctx) { applicationContext = ctx; }
+    public static <T> T getBean(Class<T> type) {
+      try {
+        return (applicationContext != null) ? applicationContext.getBean(type) : null;
+      } catch (BeansException ex) {
+        log.warn("Spring MeterRegistry not available, skipped micrometer metric logging", ex);
+        return null;
+      }
+    }
+  }
+  public static final String NAME = "StatisticMicrometerBackend";
+  @Override public String getName() { return NAME; }
+
+  @Override
+  public void storeEvent(StatisticEvent e) {
+    if (e == null) return;
+
+    MeterRegistry registry = SpringContextProxy.getBean(MeterRegistry.class);
+    if (registry == null) return;
+
+    Tags baseTags = Tags.of(
+        "operation", safeName(e.getOperation(), v -> v.getName()),
+        "status", safeName(e.getStatus(), v -> v.getName()),
+        "source", safeName(e.getSource(), v -> v.getName()),
+        "device", safeString(e.getDevice()),
+        "profile", safeString(e.getProfileId())
+    );
+
+    Timer.builder("pdfas_requests")
+        .description("Duration of PDF-AS operations")
+        .tags(baseTags)
+        .publishPercentileHistogram()
+        .register(registry)
+        .record(Math.max(0, e.getDuration()), TimeUnit.MILLISECONDS);
+
+    if (e.getStatus() == StatisticEvent.Status.ERROR) {
+      String whichException = safeName(e.getException(), it -> it.getClass().getSimpleName());
+      Counter.builder("pdfas_errors")
+          .description("Failed PDF-AS operations")
+          .tags(baseTags.and("exception", whichException))
+          .register(registry)
+          .increment();
+    }
+  }
+
+  private static @NonNull String safeString(String str) {
+    return ((str == null) || str.isBlank()) ? "unknown" : str;
+  }
+
+  private static <T> @NonNull String safeName(T v, @NonNull Function<T, String> op) {
+    return safeString((v != null) ? op.apply(v) : null);
+  }
+}
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/store/RequestStore.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/store/RequestStore.java
index a5e961ef..5ed2bef0 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/store/RequestStore.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/store/RequestStore.java
@@ -42,15 +42,15 @@ public class RequestStore {
 				logger.info("Using Request Store: " + storeClass);
 
 				Class<?> clazz = Class.forName(storeClass);
-				Object store = clazz.newInstance();
+				Object store = clazz.getDeclaredConstructor().newInstance();
 				if(store instanceof IRequestStore) {
 					instance = (IRequestStore)store;
 				} else {
-					throw new PdfAsStoreException("Failed to instanciate Request Store from " + storeClass);
+					throw new PdfAsStoreException("Failed to instantiate Request Store from " + storeClass);
 				}
 			} catch (Throwable e) {
 				e.printStackTrace();
-				throw new PdfAsStoreException("Failed to instanciate Request Store", e);
+				throw new PdfAsStoreException("Failed to instantiate Request Store", e);
 			}
 		}
 		return instance;
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/web_xml_bridges/ContextXmlBridge.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/web_xml_bridges/ContextXmlBridge.java
new file mode 100644
index 00000000..17e86c94
--- /dev/null
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/web_xml_bridges/ContextXmlBridge.java
@@ -0,0 +1,20 @@
+package at.gv.egiz.pdfas.web.web_xml_bridges;
+
+import lombok.val;
+import org.apache.tomcat.util.http.Rfc6265CookieProcessor;
+import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+/** translates the tomcat context.xml file */
+@Configuration
+public class ContextXmlBridge {
+  @Bean
+  public TomcatContextCustomizer sameSiteNone() {
+    return ctx -> {
+      val processor = new Rfc6265CookieProcessor();
+      processor.setSameSiteCookies("none");
+      ctx.setCookieProcessor(processor);
+    };
+  }
+}
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/web_xml_bridges/FilterBridge.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/web_xml_bridges/FilterBridge.java
new file mode 100644
index 00000000..2c4d8c8a
--- /dev/null
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/web_xml_bridges/FilterBridge.java
@@ -0,0 +1,50 @@
+package at.gv.egiz.pdfas.web.web_xml_bridges;
+
+import at.gv.egiz.pdfas.web.filter.ExceptionCatchFilter;
+import at.gv.egiz.pdfas.web.filter.UserAgentFilter;
+import com.thetransactioncompany.cors.CORSFilter;
+import jakarta.servlet.Filter;
+import lombok.val;
+import org.apache.catalina.filters.SetCharacterEncodingFilter;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+/** Takes the old web.xml filter mappings and exposes them to Spring Boot */
+@Configuration
+public class FilterBridge {
+  @Bean
+  public FilterRegistrationBean<Filter> setCharacterEncodingFilter() {
+    val reg = new FilterRegistrationBean<Filter>(new SetCharacterEncodingFilter());
+    reg.addUrlPatterns("/*");
+    reg.addInitParameter("encoding", "UTF-8");
+    reg.setOrder(1);
+    return reg;
+  }
+
+  @Bean
+  public FilterRegistrationBean<Filter> exceptionCatchFilter() {
+    val reg = new FilterRegistrationBean<Filter>(new ExceptionCatchFilter());
+    reg.addUrlPatterns("/*");
+    reg.addInitParameter("statelessServlets", "/placeholder,/visblock");
+    reg.setOrder(2);
+    return reg;
+  }
+
+  @Bean
+  public FilterRegistrationBean<Filter> userAgentFilter() {
+    val reg = new FilterRegistrationBean<Filter>(new UserAgentFilter());
+    reg.addUrlPatterns("/*");
+    reg.setOrder(3);
+    return reg;
+  }
+
+  @Bean
+  public FilterRegistrationBean<Filter> cors() {
+    val reg = new FilterRegistrationBean<Filter>(new CORSFilter());
+    reg.addUrlPatterns("/*");
+    reg.addInitParameter("cors.allowOrigin", "*");
+    reg.setOrder(4);
+    return reg;
+  }
+}
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/web_xml_bridges/ServletBridge.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/web_xml_bridges/ServletBridge.java
new file mode 100644
index 00000000..af59a7d6
--- /dev/null
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/web_xml_bridges/ServletBridge.java
@@ -0,0 +1,131 @@
+package at.gv.egiz.pdfas.web.web_xml_bridges;
+
+import at.gv.egiz.pdfas.web.servlets.*;
+import jakarta.servlet.Servlet;
+import org.springframework.boot.web.servlet.ServletRegistrationBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+/** Takes the old web.xml servlet mappings and exposes them to Spring Boot */
+@Configuration
+public class ServletBridge {
+  @Bean
+  public ServletRegistrationBean<Servlet> cxfServlet() {
+    return new ServletRegistrationBean<>(
+        /** from <servlet> */         new SoapServiceServlet(),
+        /** from <servlet-mapping> */ "/services/*"
+    );
+  }
+
+  @Bean
+  public ServletRegistrationBean<Servlet> signServlet() {
+    return new ServletRegistrationBean<>(
+        new ExternSignServlet(),
+        "/Sign"
+    );
+  }
+
+  @Bean
+  public ServletRegistrationBean<Servlet> visBlockServlet() {
+    return new ServletRegistrationBean<>(
+        new VisBlockServlet(),
+        "/visblock"
+    );
+  }
+
+  @Bean
+  public ServletRegistrationBean<Servlet> providePDF() {
+    return new ServletRegistrationBean<>(
+        new ProvidePDFServlet(),
+        "/ProvidePDF"
+    );
+  }
+
+  @Bean
+  public ServletRegistrationBean<Servlet> reloadServlet() {
+    return new ServletRegistrationBean<>(
+      new ReloadServlet(),
+        "/Reload"
+    );
+  }
+
+  @Bean
+  public ServletRegistrationBean<Servlet> dataURLServlet() {
+    return new ServletRegistrationBean<>(
+        new DataURLServlet(),
+        "/DataURL"
+    );
+  }
+
+  @Bean
+  public ServletRegistrationBean<Servlet> slDataURLServlet() {
+    return new ServletRegistrationBean<>(
+        new SLDataURLServlet(),
+        "/DataURLSL20"
+    );
+  }
+
+  @Bean
+  public ServletRegistrationBean<Servlet> verifyServlet() {
+    return new ServletRegistrationBean<>(
+        new VerifyServlet(),
+        "/Verify"
+    );
+  }
+
+  @Bean
+  public ServletRegistrationBean<Servlet> pdfData() {
+    return new ServletRegistrationBean<>(
+        new PDFData(),
+        "/PDFData"
+    );
+  }
+
+  @Bean
+  public ServletRegistrationBean<Servlet> errorPage() {
+    return new ServletRegistrationBean<>(
+        new ErrorPage(),
+        "/ErrorPage"
+    );
+  }
+
+  @Bean
+  public ServletRegistrationBean<Servlet> pdfVerifyData() {
+    return new ServletRegistrationBean<>(
+        new PDFSignatureData(),
+        "/signData"
+    );
+  }
+
+  @Bean
+  public ServletRegistrationBean<Servlet> pdfVerifyCert() {
+    return new ServletRegistrationBean<>(
+        new PDFSignatureCertificateData(),
+        "/signCert"
+    );
+  }
+
+  @Bean
+  public ServletRegistrationBean<Servlet> uiEntryPointServlet() {
+    return new ServletRegistrationBean<>(
+        new UIEntryPointServlet(),
+        "/userentry"
+    );
+  }
+
+  @Bean
+  public ServletRegistrationBean<Servlet> qrPlaceholderGenerator() {
+    return new ServletRegistrationBean<>(
+        new PlaceholderGeneratorServlet(),
+        "/placeholder"
+    );
+  }
+
+  @Bean
+  public ServletRegistrationBean<Servlet> jsonAPIServlet() {
+    return new ServletRegistrationBean<>(
+        new JSONAPIServlet(),
+        "/api/v1/sign"
+    );
+  }
+}
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/web_xml_bridges/WelcomeFileBridge.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/web_xml_bridges/WelcomeFileBridge.java
new file mode 100644
index 00000000..6fcf47fa
--- /dev/null
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/web_xml_bridges/WelcomeFileBridge.java
@@ -0,0 +1,12 @@
+package at.gv.egiz.pdfas.web.web_xml_bridges;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+
+@Controller
+public class WelcomeFileBridge {
+  @GetMapping("/")
+  public String welcomeFile() {
+    return "forward:/index.jsp";
+  }
+}
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/ws/PDFASSigningImpl.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/ws/PDFASSigningImpl.java
index dce3e34c..667816e5 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/ws/PDFASSigningImpl.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/ws/PDFASSigningImpl.java
@@ -28,10 +28,12 @@ import java.util.List;
 import java.util.Map;
 import java.util.stream.Collectors;
 
-import javax.jws.WebService;
-import javax.xml.ws.WebServiceException;
-import javax.xml.ws.soap.MTOM;
+import at.gv.egiz.pdfas.lib.impl.ErrorExtractor;
+import jakarta.jws.WebService;
+import jakarta.xml.ws.WebServiceException;
+import jakarta.xml.ws.soap.MTOM;
 
+import lombok.val;
 import org.apache.commons.lang3.StringUtils;
 
 import at.gv.egiz.pdfas.api.processing.CoreSignParams;
@@ -142,20 +144,20 @@ public class PDFASSigningImpl implements PDFASSigning {
       }
     } catch (final Throwable e) {
 
+      val pdfAsError = ErrorExtractor.searchPdfAsError(e, null);
+
       statisticEvent.setStatus(Status.ERROR);
       statisticEvent.setException(e);
-      if (e instanceof PDFASError) {
-        statisticEvent.setErrorCode(((PDFASError) e).getCode());
-      }
+      statisticEvent.setErrorCode(pdfAsError.getCode());
       statisticEvent.setEndNow();
       statisticEvent.setTimestampNow();
       StatisticFrontend.getInstance().storeEvent(statisticEvent);
       statisticEvent.setLogged(true);
 
       log.warn("Error in Soap Service", e);
+      response.setErrorCode(pdfAsError.getCode());
       if (e.getCause() != null) {
         response.setError(e.getCause().getMessage());
-
       } else {
         response.setError(e.getMessage());
 
diff --git a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/ws/PDFASVerificationImpl.java b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/ws/PDFASVerificationImpl.java
index b1bca4ba..68c5d227 100644
--- a/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/ws/PDFASVerificationImpl.java
+++ b/pdf-as-web/src/main/java/at/gv/egiz/pdfas/web/ws/PDFASVerificationImpl.java
@@ -16,9 +16,9 @@ import iaik.x509.X509Certificate;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.jws.WebService;
-import javax.xml.ws.WebServiceException;
-import javax.xml.ws.soap.MTOM;
+import jakarta.jws.WebService;
+import jakarta.xml.ws.WebServiceException;
+import jakarta.xml.ws.soap.MTOM;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;