From dd3da582f803f21abd4480413f2d288a22f102c5 Mon Sep 17 00:00:00 2001
From: Thomas <>
Date: Tue, 7 Nov 2023 15:20:49 +0100
Subject: feat(core): check validity of signer certificate before signing

---
 .../java/at/gv/egiz/pdfas/lib/impl/PdfAsImpl.java  | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

(limited to 'pdf-as-lib')

diff --git a/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/PdfAsImpl.java b/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/PdfAsImpl.java
index 1235e4e7..ebd8ec90 100644
--- a/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/PdfAsImpl.java
+++ b/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/PdfAsImpl.java
@@ -27,6 +27,7 @@ import java.awt.Image;
 import java.io.File;
 import java.io.IOException;
 import java.util.Calendar;
+import java.util.Date;
 import java.util.Iterator;
 import java.util.List;
 
@@ -165,8 +166,9 @@ public class PdfAsImpl implements PdfAs, IConfigurationConstants,
 
       status.setRequestedSignature(requestedSignature);
 
-      try {
-        requestedSignature.setCertificate(status.getSignParamter().getPlainSigner().getCertificate(parameter));
+      try {        
+        requestedSignature.setCertificate(getValidCertificate(
+            status.getSignParamter().getPlainSigner().getCertificate(parameter)));
 
       } finally {
         if (parameter instanceof BKUHeaderHolder) {
@@ -267,6 +269,22 @@ public class PdfAsImpl implements PdfAs, IConfigurationConstants,
     }
   }
 
+  private X509Certificate getValidCertificate(X509Certificate certificate) throws PDFASError {
+    Date notAfter = certificate.getNotAfter();
+    Date notBefore = certificate.getNotBefore();
+    Date now = new Date();
+    
+    if (now.after(notAfter) || now.before(notBefore)) {
+      logger.warn("Signer certificate is not valid. notBefore:{} | notAfter:{} | now:{}",
+          notBefore, notAfter, now);
+      throw new PDFASError(11021);
+      
+    } else {
+      return certificate;
+      
+    }
+  }
+
   @Override
   public List<VerifyResult> verify(VerifyParameter parameter)
       throws PDFASError {
-- 
cgit v1.2.3