Integration

Load Balance Policies

With version 3.0 is one load balance policy defined and it's called 'CallFirstNodeWithStatusOK' it calls the getStatus method on all the server nodes in the cluster simultaneously and the first node to respond OK it sends its process request to. This to ensure that only one node in the cluster actually performs the signing.

Other future load balance policies could be round robin or that all nodes are called with the requests simultaneously and the first response is used.

Sample Code

try {
    ISigningAndValidation signserver = new SigningAndValidationWS("localhost", 8080);

    // Document to sign
    byte[] unsigned = "<document><name>Some content</name></document>".getBytes();
    byte[] signed;

    // Signing
    GenericSignResponse signResp = signserver.sign("DemoXMLSigner", unsigned);
    signed = signResp.getProcessedData();
    System.out.println("Signed: " + new String(signed));

    // Validating
    GenericValidationResponse validateResp = signserver.validate("DemoXMLValidator", signed);
    System.out.println("Valid: " + validateResp.isValid());

    if(validateResp.getSignerCertificate() != null) {
        if(validateResp.getSignerCertificate() instanceof X509Certificate) {
            X509Certificate signerCert = (X509Certificate) validateResp.getSignerCertificate();
            System.out.println("Signed by: " + signerCert.getSubjectDN().getName());
        }
    }
} catch (Exception ex) {
    ex.printStackTrace();
}                                   

try {
    ISigningAndValidation signserver = new SigningAndValidationWS("localhost", 8080);

    // Bytes to sign
    ArrayList<byte[]> bytesToSign = new ArrayList<byte[]>();
    bytesToSign.add("Sample data 1".getBytes());
    bytesToSign.add("Sample data 2".getBytes());

    // Signing
    MRTDSignResponse signResp = (MRTDSignResponse) signserver.process("MRTDSigner", new MRTDSignRequest(1234, bytesToSign), new RequestContext());

    System.out.println("Certificate: " + signResp.getSignerCertificate());

    if(signResp.getProcessedData() instanceof Collection) {
        Collection<byte[]> signed = (Collection) signResp.getProcessedData();
        for(byte[] data : signed) {
            System.out.println("Signed: " + new String(Base64.encode(data)));
        }
    }
} catch (Exception ex) {
    ex.printStackTrace();
}                               

GenericProcessServlet

HTTP requests can be sent to the SignServer servlet GenericProcessServlet located at /signserver/process using either POST or GET.

^* if the request content-type in a POST is specified as something else than "x-www-form-urlencoded" or "multipart/form-data" the message body is not parsed but instead directly passed to the worker specified by workerName or workerId in the URI's query string.

SODProcessServlet

Servlet recieving HTTP POST requests containing data group hashes and creates a MRTDSODSignerRequest and passes it to the specified MRTDSODSigner. The response from the servlet is the signed security object in binary format.

signdocument

Request signing of a document using HTTP(s) or web services.

usage: signdocument <-workername WORKERNAME | -workerid WORKERID>
                    [options]
Request a document to be signed by SignServer
 -data             Data to send to the worker.
 -host             Server name or IP address. Default: localhost
 -infile           File to read data to send to the worker from.
 -keyalias         Alias of the key in the keystore to use for
                   authentication.
 -keystore         Keystore with private key and certificate for client
                   certificate authentication.
 -keystorepwd      Password for reading the keystore.
 -outfile          File to write the result to. If not specified the
                   result is written to stdout.
 -password         Password for authentication.
 -pdfpassword      Password for changing the PDF (if required).
 -port             Server port. Default: 8080 (for HTTP), 8442 for HTTPS
                   and 8443 for HTTPS with client authentication.
 -protocol         Method of interacting with SignServer. HTTP or
                   WEBSERVICES. Default: HTTP.
 -servlet          Servlet to call. Default /signserver/process
 -truststore       Keystore with trusted certificates to use with HTTPS.
 -truststorepwd    Password for the keystore with trusted certificates.
 -username         Username for authentication.
 -workerid         ID of worker which should perform the operation.
 -workername       Name of worker which should perform the operation.

Sample usages:
a) signdocument -workername XMLSigner -data "<root/>"
b) signdocument -workername XMLSigner -infile /tmp/document.xml
c) signdocument -workerid 2 -data "<root/>" -truststore truststore.jks
-truststorepwd changeit
d) signdocument -workerid 2 -data "<root/>" -keystore superadmin.jks
-truststorepwd foo123
                        

validatedocument

Request a document to be validated.

usage: validatedocument <-workername WORKERNAME | -workerid WORKERID>
                        [options]
Request a document to be validated by SignServer
 -data             Data to send to the worker.
 -host             Server name or IP address. Default: localhost
 -infile           File to read data to send to the worker from.
 -keyalias         Alias of the key in the keystore to use for
                   authentication.
 -keystore         Keystore with private key and certificate for client
                   certificate authentication.
 -keystorepwd      Password for reading the keystore.
 -password         Password for authentication.
 -port             Server port. Default: 8080 (for HTTP), 8442 for HTTPS
                   and 8443 for HTTPS with client authentication.
 -truststore       Keystore with trusted certificates to use with HTTPS.
 -truststorepwd    Password for the keystore with trusted certificates.
 -username         Username for authentication.
 -workerid         ID of worker which should perform the operation.
 -workername       Name of worker which should perform the operation.

Sample usages:
a) validatedocument -workername XMLValidator -data "<root><Signature...
b) validatedocument -workername XMLValidator -infile /tmp/signed.xml
c) validatedocument -workerid 2 -infile /tmp/signed.xml -truststore
truststore.jks -truststorepwd changeit
d) validatedocument -workerid 2 -infile /tmp/signed.xml -keystore
superadmin.jks -truststorepwd foo123
                        

timestamp

$ bin/client.sh timestamp
usage: java -jar timeStampClient.jar <options> <url>
 -instr <string>      String to be time stamped, if neither instr or
                      infile is given, the client works in test-mode generating it's own
                      message.
 -base64              Give this option if the stored request/reply should
                      be base64 encoded, default is not.
 -help                Print this message.
 -infile <file>       File containing message to time stamp.
 -inrep <file>        Input file containing an earlier stored base64
                      encoded response, to verify.You must specify the verify flag also.
 -inreq <file>        Input file containing an earlier stored request to
                      use instead of creating a new. You must specify the request flag also.
 -outrep <file>       Output file to store the recevied TSA reply, if not
                      given the reply is not stored.
 -outreq <file>       Output file to store the sent TSA request, if not
                      given the request is not stored.
 -signerfile <file>   Input file containing the PEM encoded certificate of
                      the TSA signer.Used to verify a stored response.
 -sleep <num>         Sleep a number of milliseconds after each request.
                      Default 1000 ms.
 -url <url>           Url of TSA, e.g.
                      http://127.0.0.1:8080/signserver/process?workerId=1.
 -verify              Give this option if verification of a stored reply
                      should be done, work together with inrep and cafile. If given, no request
                      to the TSA will happen.

Sample usages:
a) timestamp -url http://localhost:8080/signserver/tsa?workerName=TimeStampSigner

                        

validatecertificate

Request a certificate to be validated by the specified service.

usage: Usage: java -jar validate.jar <options>

 -cert <cert-file>              Path to certificate file (DER or PEM)
                                (Required).
 -certpurposes <certpurposes>   A ',' separated string containing
                                requested certificate purposes.
 -der                           Certificate is in DER format.
 -help                          Display this info
 -hosts <hosts>                 A ',' separated string containing the
                                hostnames of the validation service nodes. Ex
                                'host1.someorg.org,host2.someorg.org' (Required).
 -pem                           Certificate is in PEM format (Default).
 -port <port>                   Remote port of service (Default is 8080 or
                                8442 for SSL).
 -service <service-name>        The name or id of the validation service
                                to process request. (Required)
 -silent                        Don't produce any output, only return
                                value.
 -truststore <jks-file>         Path to JKS truststore containing trusted
                                CA for SSL Server certificates.
 -truststorepwd <password>      Password to unlock the truststore.

The following values is returned by the program that can be used when scripting.
  -2   : Error happened during execution
  -1   : Bad arguments
   0   : Certificate is valid
   1   : Certificate is revoked
   2   : Certificate is not yet valid
   3   : Certificate have expired
   4   : Certificate doesn't verify
   5   : CA Certificate have been revoked
   6   : CA Certificate is not yet valid
   7   : CA Certificate have expired.
   8   : Certificate have no valid certificate purpose.

Sample usages:
a) validatecertificate -service CertValidationWorker -hosts localhost -cert
    certificate.pem
b) validatecertificate -service 5806 -hosts localhost -cert certificate.pem
    -truststore p12/truststore.jks -truststorepwd changeit
                        

signdatagroups

Sign the specified data groups and produce an SOd (MRTD).

$ bin/client.sh signdatagroups
usage: signdatagroups <options>
 -data             Data to send to the worker.
 -encoding         Encoding of the data option. None or base64. Default:
                   none.
 -host             Server name or IP address. Default: localhost
 -keyalias         Alias of the key in the keystore to use for
                   authentication.
 -keystore         Keystore with private key and certificate for client
                   certificate authentication.
 -keystorepwd      Password for reading the keystore.
 -password         Password for authentication.
 -port             Server port. Default: 8080 (for HTTP), 8442 for HTTPS
                   and 8443 for HTTPS with client authentication.
 -repeat           Run the operation this number of times. Default: 1
 -servlet          Servlet to call. Default /signserver/sod
 -truststore       Keystore with trusted certificates to use with HTTPS.
 -truststorepwd    Password for the keystore with trusted certificates.
 -username         Username for authentication.
 -workerid         ID of worker which should perform the operation.
 -workername       Name of worker which should perform the operation.

Sample usages:
a) signdatagroups -workername MRTDSODSigner -data "1=value1&2=value2&3=value3"