title: PDF File size of 50kb increases dramatically up to 9mb after signing it with previously using Itext Java Application
body: <p>I was a using a custom build itext based java application for digitally signing pdf files.</p>
  
  <p>Every thing was working fine for last one year but recently the size of the output signed pdf file drastically increasing up to 10 MB for just a 50kb source pdf file.</p>
  
  <p>Earlier for a 50 kb file ,the output was  less than 300 kb.</p>
  
  <p>Kindly find the code snippets</p>
  
  <pre><code>public void sign(String src, String dest,
          Certificate[] chain, PrivateKey pk,
          String digestAlgorithm, String provider, MakeSignature.CryptoStandard subfilter,
          String reason, String location,
          Collection&lt;CrlClient&gt; crlList,
          OcspClient ocspClient,
          TSAClient tsaClient,
          int estimatedSize)
                  throws GeneralSecurityException, IOException, DocumentException {
      // Creating the reader and the stamper
      PdfReader reader = new PdfReader(src);
      FileOutputStream os = new FileOutputStream(dest);
      PdfStamper stamper = PdfStamper.createSignature(reader, os, '\0');
      // Creating the appearance
      PdfSignatureAppearance appearance = stamper.getSignatureAppearance();
  
      ExternalSignature pks = new PrivateKeySignature(pk, digestAlgorithm, provider);
      ExternalDigest digest = new BouncyCastleDigest();
      MakeSignature.signDetached(appearance, digest, pks, chain, crlList, ocspClient, tsaClient, estimatedSize, subfilter);
  }
  
  public PrivateKey getPrivateKey(String DLL,String PIN,String usage) throws GeneralSecurityException, IOException {
      LoggerFactory.getInstance().setLogger(new SysoLogger());
  
      String config = "name=eToken\n" + "library=" + DLL + "\n";
      ByteArrayInputStream bais = new ByteArrayInputStream(config.getBytes());
      Provider providerPKCS11 = new SunPKCS11(bais);
      Security.addProvider(providerPKCS11);
      //System.out.println(providerPKCS11.getName());
      BouncyCastleProvider providerBC = new BouncyCastleProvider();
      Security.addProvider(providerBC);
      PrivateKey pk = null;  
      KeyStore ks = KeyStore.getInstance("PKCS11");
  
      try{
          ks.load(null, PIN.toCharArray());
          String alias = (String)ks.aliases().nextElement();
  
          java.util.Enumeration&lt;String&gt; aliases = ks.aliases();
  
          while (aliases.hasMoreElements()) {
              alias = aliases.nextElement();
              //System.out.println(alias);
              X509Certificate c = (X509Certificate) ks.getCertificate(alias);
              final boolean[] keyUsage = c.getKeyUsage();
              if(usage=="0" &amp;&amp;(keyUsage[0] || keyUsage[1]))
              {
                  //System.out.println("Digital Signature");
                  pk = (PrivateKey)ks.getKey(alias, PIN.toCharArray());
                  this.providerPKCS11 = providerPKCS11.getName();
                  this.pub_key = c;
                  this.chain = ks.getCertificateChain(alias);
  
                  for (int i = 0; i &lt; this.chain.length; i++) {
                      // System.out.println(chain[i]);
                      X509Certificate cert = (X509Certificate)chain[i];
                      String tsaUrl = CertificateUtil.getTSAURL(cert);
                      if (tsaUrl != null) {
                          tsaClient = new TSAClientBouncyCastle(tsaUrl);
                          break;
                      }
                  }
  
                  crlList.add(new CrlClientOnline(chain));
              }
              else if(usage=="2" &amp;&amp;keyUsage[2])
              {
                  //System.out.println("Encryption");
                  pk = (PrivateKey)ks.getKey(alias, PIN.toCharArray());
                  this.pub_key = c;
              }
  
              //alias1=alias;
          }
      }
      catch(Exception e)
      {
          System.out.println("Key Store Not loaded .. PIN entered may be incorrect");
      }
  
      return pk;
  }
  </code></pre>
  
  <p>Main function is</p>
  
  <pre><code>token.sign("D:\\15 SAMPLE PDF FILES\\15 SAMPLE PDF FILES\\"+listOfFiles[i].getName(), "D:\\15 SAMPLE PDF FILES\\15 SAMPLE PDF FILES\\sign\\singn_"+listOfFiles[i].getName(), token.chain, PK_sign, DigestAlgorithms.SHA256, token.providerPKCS11, MakeSignature.CryptoStandard.CMS,
                  "Sign", "Kottayam", token.crlList, token.ocspClient, token.tsaClient, 0);
  </code></pre>
  
  <p>Last week our firewall changed. Is that the problem?</p>