title: Sign pdf asynchronously using digest
body: <p>I'm trying to do the following setup for signing pdfs, broken down into asynchronous steps between a client and a server:</p>
  
  <ol>
  <li>A server receives a pdf and computes it's digest.</li>
  <li>Server sends the digest to a client.</li>
  <li>Client signs the hash at a later time.</li>
  <li>Client sends the signature to server.</li>
  <li>Server embeds the signature into the pdf.</li>
  </ol>
  
  <p>I'm basing myself mainly in <a href="https://stackoverflow.com/questions/29251895/pdf-signature-digest">PDF Signature digest</a> and <a href="https://stackoverflow.com/questions/41767351/create-pkcs7-signature-from-file-digest">Create pkcs7 signature from file digest</a></p>
  
  <p>The second question allowed me to write most of the code, however I'm getting that the integrity of the file has been compromised. I can't seem to serialize the intermediary pdf for embedding the signature later (to make sure no timestamps are altered, etc). But from the first SO question, it seems to be a harder problem than I thought. Can it actually be done? </p>
  
  <p>I'm using pdfbox.</p>
  
  <p>Server code:</p>
  
  <pre><code>        PDDocument document = PDDocument.load(documentFile);
          PDSignature signature = new PDSignature();
          signature.setFilter(PDSignature.FILTER_ADOBE_PPKLITE);
          signature.setSubFilter(PDSignature.SUBFILTER_ADBE_PKCS7_DETACHED);
          signature.setName("Example User");
          signature.setLocation("Los Angeles, CA");
          signature.setReason("Testing");
          Calendar date = Calendar.getInstance();
          signature.setSignDate(date);
          document.addSignature(signature);
  
          ExternalSigningSupport externalSigningSupport = document.saveIncrementalForExternalSigning(null);
  
          byte[] content = IOUtils.toByteArray(externalSigningSupport.getContent());
          MessageDigest md = MessageDigest.getInstance("SHA256", new BouncyCastleProvider());
          byte[] digest = md.digest(content); // this is sent to client
  </code></pre>
  
  <p>What I'm basically doing is sending that digest to the client to sign and then on the server redoing the above steps and setting the client signature:</p>
  
  <pre><code>        ExternalSigningSupport externalSigning = document.saveIncrementalForExternalSigning(fos);
          externalSigning.setSignature(encodedSignature); // encodedSignature is received from client and computed based on the digest sent by the server
  </code></pre>
  
  <p>This setup ends up with the integrity of the file being corrupted, since I'm creating a new PDSignature once I have the <code>encodedSignature</code> on the server to embed it. Is there a way to serialize the PDDocument created after calling addSignature, so I can later deserialize it on the server and add the client's  signature?</p>