(Objective-C) Sign PDF for ICP-Brasil

See more PDF Signatures Examples

Sign a PDF to create a signed PDF compliant with the ICP-Brasil Digital Signature Standard Conformity Checker. (Verificador de Conformidade do Padrão de Assinatura Digital ICP-Brasil)

For more information, see https://verificador.iti.gov.br/verifier-2.6.2/

Chilkat Objective-C Library Downloads MAC OS X (Cocoa) Libs iOS Libs

#import <CkoPdf.h>
#import <CkoJsonObject.h>
#import <CkoCert.h>

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// The signed PDF produced by this example should be verifiable at https://validar.iti.gov.br/
CkoPdf *pdf = [[CkoPdf alloc] init];

// Load a PDF to be signed.
// The "hello.pdf" is available at https://chilkatsoft.com/hello.pdf
BOOL success = [pdf LoadFile: @"qa_data/pdf/hello.pdf"];
if (success == NO) {
    NSLog(@"%@",pdf.LastErrorText);
    return;
}

CkoJsonObject *json = [[CkoJsonObject alloc] init];

// Define the appearance and location of the signature.
[json UpdateInt: @"page" value: [NSNumber numberWithInt: 1]];
[json UpdateString: @"appearance.y" value: @"bottom"];
[json UpdateString: @"appearance.x" value: @"middle"];
[json UpdateString: @"appearance.fontScale" value: @"9.0"];
[json UpdateString: @"appearance.text[0]" value: @"Digitally signed by: cert_cn"];
[json UpdateString: @"appearance.text[1]" value: @"current_dt"];
[json UpdateString: @"appearance.image" value: @"document-accepted"];
[json UpdateString: @"appearance.imagePlacement" value: @"left"];
[json UpdateString: @"appearance.imageOpacity" value: @"100"];

// Add the CMS options required for ICP-Brasil
[json UpdateInt: @"contentType" value: [NSNumber numberWithInt: 1]];
[json UpdateInt: @"messageDigest" value: [NSNumber numberWithInt: 1]];
[json UpdateInt: @"signingCertificateV2" value: [NSNumber numberWithInt: 1]];
[json UpdateBool: @"ltvOcsp" value: YES];

// Listed here are the currently existing profiles. (Chilkat will add additional ICP Brasil policy profiles in future versions as new ones are created.)
// See https://www.gov.br/iti/pt-br/assuntos/repositorio/artefatos-de-assinatura-digital for more information.
// 
// PA_AD_RA_v1_1 --> 2.16.76.1.7.1.5.1.1
// PA_AD_RA_v1_2 --> 2.16.76.1.7.1.5.1.2
// PA_AD_RA_v2_0 --> 2.16.76.1.7.1.5.2
// PA_AD_RA_v2_1 --> 2.16.76.1.7.1.5.2.1
// PA_AD_RA_v2_2 --> 2.16.76.1.7.1.5.2.2
// PA_AD_RA_v2_3 --> 2.16.76.1.7.1.5.2.3
// PA_AD_RA_v2_4 --> 2.16.76.1.7.1.5.2.4

// PA_AD_RB_v1_1 --> 2.16.76.1.7.1.1.1.1
// PA_AD_RB_v2_0 --> 2.16.76.1.7.1.1.2
// PA_AD_RB_v2_1 --> 2.16.76.1.7.1.1.2.1
// PA_AD_RB_v2_2 --> 2.16.76.1.7.1.1.2.2
// PA_AD_RB_v2_3 --> 2.16.76.1.7.1.1.2.3

// PA_AD_RC_v1_1 --> 2.16.76.1.7.1.4.1.1
// PA_AD_RC_v2_0 --> 2.16.76.1.7.1.4.2
// PA_AD_RC_v2_1 --> 2.16.76.1.7.1.4.2.1
// PA_AD_RC_v2_2 --> 2.16.76.1.7.1.4.2.2
// PA_AD_RC_v2_3 --> 2.16.76.1.7.1.4.2.3

// PA_AD_RT_v1_1 --> 2.16.76.1.7.1.2.1.1
// PA_AD_RT_v2_0 --> 2.16.76.1.7.1.2.2
// PA_AD_RT_v2_1 --> 2.16.76.1.7.1.2.2.1
// PA_AD_RT_v2_2 --> 2.16.76.1.7.1.2.2.2
// PA_AD_RT_v2_3 --> 2.16.76.1.7.1.2.2.3

// PA_AD_RV_v1_1 --> 2.16.76.1.7.1.3.1.1
// PA_AD_RV_v2_0 --> 2.16.76.1.7.1.3.2
// PA_AD_RV_v2_1 --> 2.16.76.1.7.1.3.2.1
// PA_AD_RV_v2_2 --> 2.16.76.1.7.1.3.2.2
// PA_AD_RV_v2_3 --> 2.16.76.1.7.1.3.2.3

// PA_PAdES_AD_RA_v1_0 --> 2.16.76.1.7.1.14.1
// PA_PAdES_AD_RA_v1_1 --> 2.16.76.1.7.1.14.1.1
// PA_PAdES_AD_RA_v1_2 --> 2.16.76.1.7.1.14.1.2
// PA_PAdES_AD_RB_v1_0 --> 2.16.76.1.7.1.11.1
// PA_PAdES_AD_RB_v1_1 --> 2.16.76.1.7.1.11.1.1
// PA_PAdES_AD_RC_v1_0 --> 2.16.76.1.7.1.13.1
// PA_PAdES_AD_RC_v1_1 --> 2.16.76.1.7.1.13.1.1
// PA_PAdES_AD_RC_v1_2 --> 2.16.76.1.7.1.13.1.2
// PA_PAdES_AD_RT_v1_0 --> 2.16.76.1.7.1.12.1
// PA_PAdES_AD_RT_v1_1 --> 2.16.76.1.7.1.12.1.1

// Set the policy profile name
// ---------------------------------------------------
// Note: On 24-May-2024, I was informed that adding the "policyId.profile"
// causes the PDF signature to fail validation at https://validar.iti.gov.br/
// Perhaps something changed in the years since this example was originally written and tested to be working.
// You may need to omit the "policyId.profile".
// ---------------------------------------------------
[json UpdateString: @"policyId.profile" value: @"PA_PAdES_AD_RB_v1_1"];

// Load the signing certificate. (Use your own certificate.)
// Note: If loading from a smart card, call LoadFromSmartcard instead, and make sure to use Chilkat v9.5.0.88 or later.
CkoCert *cert = [[CkoCert alloc] init];
success = [cert LoadPfxFile: @"qa_data/pfx/myPdfSigningCert.pfx" password: @"pfx_password"];
if (success == NO) {
    NSLog(@"%@",cert.LastErrorText);
    return;
}

// Tell the pdf object to use the certificate for signing.
success = [pdf SetSigningCert: cert];
if (success == NO) {
    NSLog(@"%@",pdf.LastErrorText);
    return;
}

success = [pdf SignPdf: json outFilePath: @"qa_output/hello_signed.pdf"];
if (success == NO) {
    NSLog(@"%@",pdf.LastErrorText);
    return;
}

NSLog(@"%@",@"The PDF has been successfully cryptographically signed.");