PAdES LT and LTA doesn't work in JSignPdf_3_1_0-RC-2

[JohnPlanetary]

Windows 11 Home 64 bits.
jsignpdf-3.1.0-RC-2-windows-x64.zip

I've attempted to sign with PAdES in "LT" and in "LTA" options and in both cases it didn't work.
The "Engine DSS" was activated to receive the online revocation (OCSP/ CRL, AIA).
And the Signature Engine was selected to EU DSS (PAdES).

The "B" and the "T" options produce valid signed PDF files. But the with "LT" and "LTA" options I always receive a error.
I've used both my own made signing certificate, and the hardware one with the valid EU signing certificate, and failed in both, in the "LT" and "LTA" options.

When I switch to the "OpenPDF" engine both my own made signing certificate, and the hardware with the valid EU signing certificate work fine, and produce valid signing pdf's.

In LT:

Verificando caminhos de entrada e saída do PDF.
Obtendo o apelido da chave
Apelido de chave usado: {redacted hardware EU certificate}
Carregando chave privada
Obtendo cadeia de certificados
Definindo o nível de certificação
Configurando assinatura visível
Configurando texto da camada 2 (descrição)
Criando cliente TSA.
Configurando o algoritmo de hash TSA: SHA-512
Processando (pode demorar um pouco) ...
Criando assinatura
SEVERE Problema ocorrido
eu.europa.esig.dss.alert.exception.AlertException: Revocation data is missing for one or more certificate(s). [C-31A4591C0A3AB1375CA7B9306F76D357F90B6A91F5E2D015BF51EDA63CF2A2C0: Revocation data is skipped for untrusted certificate chain!; C-A574F9FEEB813AB7A1950DD22FFE415F79C9DAF0E315A33B729CEAE63B851C8E: Revocation data is skipped for untrusted certificate chain!; C-28CAD66D2C81D77B177A021561F0E34D7899F4331D61336F435107CA220D0AA7: Revocation data is skipped for untrusted certificate chain!; C-4FFC3BCB2DA5C1623A5E98714DF0C4E9CA622DB07CB0EB6B2083388A0602029D: Revocation data is skipped for untrusted certificate chain!; C-CD0A3E00A1BDAE3A159FA9E3D70F8E664F560FDCE16357CBE440ED0B0D88244F: Revocation data is skipped for untrusted certificate chain!; C-1EAF840188B14F9DD12C07ACA343E196C38D8F5256B1E36FFF519A442BDA53EE: Revocation data is skipped for untrusted certificate chain!]
	at eu.europa.esig.dss.alert.handler.ThrowAlertExceptionHandler.process(ThrowAlertExceptionHandler.java:41)
	at eu.europa.esig.dss.alert.AbstractAlert.alert(AbstractAlert.java:62)
	at eu.europa.esig.dss.spi.validation.SignatureValidationAlerter.assertAllRequiredRevocationDataPresent(SignatureValidationAlerter.java:81)
	at eu.europa.esig.dss.spi.validation.executor.CompleteValidationContextExecutor.assertSignaturesValid(CompleteValidationContextExecutor.java:57)
	at eu.europa.esig.dss.spi.validation.executor.CompleteValidationContextExecutor.validate(CompleteValidationContextExecutor.java:51)
	at eu.europa.esig.dss.spi.validation.analyzer.DefaultDocumentAnalyzer.validateContext(DefaultDocumentAnalyzer.java:501)
	at eu.europa.esig.dss.spi.validation.analyzer.DefaultDocumentAnalyzer.getValidationData(DefaultDocumentAnalyzer.java:377)
	at eu.europa.esig.dss.pades.validation.PDFDocumentAnalyzer.getValidationData(PDFDocumentAnalyzer.java:341)
	at eu.europa.esig.dss.pades.signature.PAdESLevelBaselineLT.extendSignatures(PAdESLevelBaselineLT.java:75)
	at eu.europa.esig.dss.pades.signature.PAdESLevelBaselineT.extendSignatures(PAdESLevelBaselineT.java:82)
	at eu.europa.esig.dss.pades.signature.PAdESLevelBaselineT.extendSignatures(PAdESLevelBaselineT.java:49)
	at eu.europa.esig.dss.pades.signature.PAdESService.signDocument(PAdESService.java:217)
	at net.sf.jsignpdf.engine.dss.DssSigningEngine.signWithContentSize(DssSigningEngine.java:386)
	at net.sf.jsignpdf.engine.dss.DssSigningEngine.sign(DssSigningEngine.java:315)
	at net.sf.jsignpdf.SignerLogic.signFile(SignerLogic.java:86)
	at net.sf.jsignpdf.fx.service.SigningService$1.call(SigningService.java:26)
	at net.sf.jsignpdf.fx.service.SigningService$1.call(SigningService.java:22)
	at javafx.graphics/javafx.concurrent.Task$TaskCallable.call(Unknown Source)
	at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
	at javafx.graphics/javafx.concurrent.Service.lambda$executeTask$6(Unknown Source)
	at java.base/java.security.AccessController.doPrivileged(Unknown Source)
	at javafx.graphics/javafx.concurrent.Service.lambda$executeTask$7(Unknown Source)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
	at java.base/java.lang.Thread.run(Unknown Source)

Concluído: Falha na criação da assinatura.

In LTA seems the same error:

Verificando caminhos de entrada e saída do PDF.
Obtendo o apelido da chave
Apelido de chave usado: {redacted hardware EU certificate}
Carregando chave privada
Obtendo cadeia de certificados
Definindo o nível de certificação
Configurando assinatura visível
Configurando texto da camada 2 (descrição)
Criando cliente TSA.
Configurando o algoritmo de hash TSA: SHA-512
Processando (pode demorar um pouco) ...
Criando assinatura
SEVERE Problema ocorrido
eu.europa.esig.dss.alert.exception.AlertException: Revocation data is missing for one or more certificate(s). [C-31A4591C0A3AB1375CA7B9306F76D357F90B6A91F5E2D015BF51EDA63CF2A2C0: Revocation data is skipped for untrusted certificate chain!; C-A574F9FEEB813AB7A1950DD22FFE415F79C9DAF0E315A33B729CEAE63B851C8E: Revocation data is skipped for untrusted certificate chain!; C-28CAD66D2C81D77B177A021561F0E34D7899F4331D61336F435107CA220D0AA7: Revocation data is skipped for untrusted certificate chain!; C-4FFC3BCB2DA5C1623A5E98714DF0C4E9CA622DB07CB0EB6B2083388A0602029D: Revocation data is skipped for untrusted certificate chain!; C-CD0A3E00A1BDAE3A159FA9E3D70F8E664F560FDCE16357CBE440ED0B0D88244F: Revocation data is skipped for untrusted certificate chain!; C-1EAF840188B14F9DD12C07ACA343E196C38D8F5256B1E36FFF519A442BDA53EE: Revocation data is skipped for untrusted certificate chain!]
	at eu.europa.esig.dss.alert.handler.ThrowAlertExceptionHandler.process(ThrowAlertExceptionHandler.java:41)
	at eu.europa.esig.dss.alert.AbstractAlert.alert(AbstractAlert.java:62)
	at eu.europa.esig.dss.spi.validation.SignatureValidationAlerter.assertAllRequiredRevocationDataPresent(SignatureValidationAlerter.java:81)
	at eu.europa.esig.dss.spi.validation.executor.CompleteValidationContextExecutor.assertSignaturesValid(CompleteValidationContextExecutor.java:57)
	at eu.europa.esig.dss.spi.validation.executor.CompleteValidationContextExecutor.validate(CompleteValidationContextExecutor.java:51)
	at eu.europa.esig.dss.spi.validation.analyzer.DefaultDocumentAnalyzer.validateContext(DefaultDocumentAnalyzer.java:501)
	at eu.europa.esig.dss.spi.validation.analyzer.DefaultDocumentAnalyzer.getValidationData(DefaultDocumentAnalyzer.java:377)
	at eu.europa.esig.dss.pades.validation.PDFDocumentAnalyzer.getValidationData(PDFDocumentAnalyzer.java:341)
	at eu.europa.esig.dss.pades.signature.PAdESLevelBaselineLT.extendSignatures(PAdESLevelBaselineLT.java:75)
	at eu.europa.esig.dss.pades.signature.PAdESLevelBaselineT.extendSignatures(PAdESLevelBaselineT.java:82)
	at eu.europa.esig.dss.pades.signature.PAdESLevelBaselineLTA.extendSignatures(PAdESLevelBaselineLTA.java:50)
	at eu.europa.esig.dss.pades.signature.PAdESLevelBaselineLTA.extendSignatures(PAdESLevelBaselineLTA.java:34)
	at eu.europa.esig.dss.pades.signature.PAdESService.signDocument(PAdESService.java:217)
	at net.sf.jsignpdf.engine.dss.DssSigningEngine.signWithContentSize(DssSigningEngine.java:386)
	at net.sf.jsignpdf.engine.dss.DssSigningEngine.sign(DssSigningEngine.java:315)
	at net.sf.jsignpdf.SignerLogic.signFile(SignerLogic.java:86)
	at net.sf.jsignpdf.fx.service.SigningService$1.call(SigningService.java:26)
	at net.sf.jsignpdf.fx.service.SigningService$1.call(SigningService.java:22)
	at javafx.graphics/javafx.concurrent.Task$TaskCallable.call(Unknown Source)
	at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
	at javafx.graphics/javafx.concurrent.Service.lambda$executeTask$6(Unknown Source)
	at java.base/java.security.AccessController.doPrivileged(Unknown Source)
	at javafx.graphics/javafx.concurrent.Service.lambda$executeTask$7(Unknown Source)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
	at java.base/java.lang.Thread.run(Unknown Source)

Concluído: Falha na criação da assinatura.

[kwart]

Thanks a lot for testing and reporting the findings, @JohnPlanetary
I will look into it.
BTW Do you have a recommendation for a testing environment/setup, I could use locally for the LT & LTA testing?

[kwart]

@JohnPlanetary Could you retry the RC-2, but with these DSS engine options enabled?

I hope it'll work for you then. It's also described in the guide - https://jsignpdf.eu/docs/#pades-the-dss-engine

I will think about changing the defaults there. Probably if users switch to DSS engine, they expect online behavior + EU LOTL handling by default. 🤔

[JohnPlanetary]

Hello again!

I've tried again LT and LTA with both options enabled and it still presents a error and doesn't work:

Obtendo instância do tipo armazenamento de chages: WINDOWS-MY-CURRENTUSER
Obtendo o apelido da chave
Verificando caminhos de entrada e saída do PDF.
Obtendo o apelido da chave
Apelido de chave usado: {redacted hardware EU certificate}
Carregando chave privada
Obtendo cadeia de certificados
Definindo o nível de certificação
Configurando assinatura visível
Configurando texto da camada 2 (descrição)
SEVERE Falha ao carregar o material de confiança DSS configurado (truststore / ficheiro de certificado / URL de certificado / LOTL). Verifique as definições engine.dss.trust.*. Assinatura cancelada.
java.lang.NullPointerException: URL cannot be null.
	at java.base/java.util.Objects.requireNonNull(Unknown Source)
	at eu.europa.esig.dss.tsl.cache.CacheKey.<init>(CacheKey.java:44)
	at eu.europa.esig.dss.tsl.source.TLSource.getCacheKey(TLSource.java:213)
	at java.base/java.util.stream.Collectors.lambda$uniqKeysMapAccumulator$1(Unknown Source)
	at java.base/java.util.stream.ReduceOps$3ReducingSink.accept(Unknown Source)
	at java.base/java.util.Spliterators$ArraySpliterator.forEachRemaining(Unknown Source)
	at java.base/java.util.stream.AbstractPipeline.copyInto(Unknown Source)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source)
	at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(Unknown Source)
	at java.base/java.util.stream.AbstractPipeline.evaluate(Unknown Source)
	at java.base/java.util.stream.ReferencePipeline.collect(Unknown Source)
	at eu.europa.esig.dss.tsl.job.TLValidationJob.extractParsingCache(TLValidationJob.java:365)
	at eu.europa.esig.dss.tsl.job.TLValidationJob.executeLOTLSourcesAnalysis(TLValidationJob.java:331)
	at eu.europa.esig.dss.tsl.job.TLValidationJob.refresh(TLValidationJob.java:290)
	at eu.europa.esig.dss.tsl.job.TLValidationJob.onlineRefresh(TLValidationJob.java:275)
	at net.sf.jsignpdf.engine.dss.DssTrustConfigurer.createTrustedCertSources(DssTrustConfigurer.java:128)
	at net.sf.jsignpdf.engine.dss.DssTrustConfigurer.buildVerifier(DssTrustConfigurer.java:99)
	at net.sf.jsignpdf.engine.dss.DssSigningEngine.sign(DssSigningEngine.java:293)
	at net.sf.jsignpdf.SignerLogic.signFile(SignerLogic.java:86)
	at net.sf.jsignpdf.fx.service.SigningService$1.call(SigningService.java:26)
	at net.sf.jsignpdf.fx.service.SigningService$1.call(SigningService.java:22)
	at javafx.graphics/javafx.concurrent.Task$TaskCallable.call(Unknown Source)
	at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
	at javafx.graphics/javafx.concurrent.Service.lambda$executeTask$6(Unknown Source)
	at java.base/java.security.AccessController.doPrivileged(Unknown Source)
	at javafx.graphics/javafx.concurrent.Service.lambda$executeTask$7(Unknown Source)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
	at java.base/java.lang.Thread.run(Unknown Source)

Concluído: Falha na criação da assinatura.

I use Windows 11 Home x64.

I'm not totally sure I understand what thou means with a "testing environment/setup" for testing "LT & LTA", but if thou uses Microsoft Windows and can install the free XolidoSign ( https://en.xolido.com/lang/xolidosign/xolidosigndesktop/ https://www.xolido.com/instaladores/SetupXolidoSign.exe ) and do some changes to the settings thou can produce valid "LT" and "LTA" files, both using self made certificates, and official recognized EU certificates.
"LT" signed files are sort of direct after changing the settings, but LTA it is needed to send the initial produced signed file to a different folder from where the program sends it, back into the program in the TimeStamp part to add just the TimeStamping signature... then the file becomes "LTA", it is not user friendly, but is possible to do.

After installing it, go to "Sign" (lateral menu) > "Options" (on the top).

Certificates > "Certificates restrictions". "Check Online Revocation Status for selected Certificates". The "Set the validity period for the revocation cache:" for example: "120" min.

Electronic Signature > "Signature format". Select: "Electronic Signatures with certificate and revocation values. ( Profile -XL; e.g. CAdES-XL )".

Electronic Signature > "Signature preferences": select all except maybe "Cancel signature if selected certificate has access methods for revocation info but fails obtaining data", I don't have that selected.

Electronic Signature > "Advanced options": I selected SHA-512 and always works in here, if it doesn't work with the hardware try SHA-256.

TimeStamp > "Timestamp server list" > "manage timestamp server list" > "Add new" and enter for example, description "Sectigo EU" in the URL: https://timestamp.sectigo.com/qualified in the has algorithm: "SHA-256" and then click "Accept".

There are other configurations that thou may want to check, but the above should be enough to produce those PDF files.

In the "Sign" then can send a PDF file into the list to sign.
Click on "certificate selection" to select a option to use to sign the file.
Select "Sign With TimeStamp" and select "Sectigo EU".
"Apply native signatures" (it has the PDF icon)
and click "start process".

The file will display in the result bar above a green "v" if it successfully signs it.
If it all went well it should be sign to "PAdES: B-LT" level.

Then move the file from the output folder, to a different folder, these is mandatory since the program refuses to sign pdf files that are in the output folder.

Select the "Timestamp" option in the menu, and send the previous file sign up to "PAdES: B-LT" level, and click "start process" again. If it all goes correctly the new file at the output folder should be sign up to the "PAdES: B-LTA" level.

With that program I can sign up to the "PAdES: B-LTA" level any certificate even if it isn't a EU recognized certificate and is just a self made one, since it should work for any certificate as long there is a CRL and/ or OCSP server providing the validation file.