如何基于无私钥的API响应在Java中实现PDF数字签名

需要在Java中实现PDF数字签名，但检索到的参考资料多为C#相关内容。调用第三方API后，得到不含私钥的XML响应，需基于该响应完成PDF签名。

API响应示例 #

<?xml version="1.0" encoding="UTF-8"?>
<EsignResp errCode="NA" errMsg="NA" resCode="1233333333333312121" status="1" ts="2024-03-14T14:59:39" txn="reference-transaction">
    <UserX509Certificate>base64 value of eSign user certificate(.cer)</UserX509Certificate>
    <Signatures>
        <DocSignature error="" id="1" sigHashAlgorithm="SHA256">Signature data in raw (PKCS#1) or raw( ECDSA ) or PKCS7 (CMS) signature as requested
</DocSignature>
    </Signatures>
    <Signature
        xmlns="http://www.w3.org/2000/09/xmldsig#">
        <SignedInfo>
            <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"></CanonicalizationMethod>
            <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"></SignatureMethod>
            <Reference URI="">
                <Transforms>
                    <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></Transform>
                </Transforms>
                <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"></DigestMethod>
                <DigestValue>xxxxxxxx</DigestValue>
            </Reference>
        </SignedInfo>
        <SignatureValue>xxxxxxxxxxxxxxxxxxxx</SignatureValue>
        <KeyInfo>
            <KeyValue>
                <RSAKeyValue>
                    <Modulus>xxxxxxxxxxxx</Modulus>
                    <Exponent>xxxxx</Exponent>
                </RSAKeyValue>
            </KeyValue>
            <X509Data>
                <X509SubjectName>xxxxxxxxxxxxxxx</X509SubjectName>
                <X509Certificate>xxxxxxxxxx</X509Certificate>
            </X509Data>
        </KeyInfo>
    </Signature>
</EsignResp>

API文档说明 #

• UserX509Certificate：该元素包含证书的Base64值，不共享私钥信息，可保存为.cer文件手动验证
• Signatures：包含与InputHash对应的签名子元素
• DocSignature：包含按请求XML指定格式（原始PKCS#1、原始ECDSA或PKCS7(CMS)）的签名值，可与原始文档验证

内容的提问来源于stack exchange，提问作者Dhanasekaran Don