The seal

What this is about

The hash chain proves a document as long as you ask CRMS. But a PDF leaves CRMS and is sent on, printed, filed. The seal travels with it: it is an electronic signature inside the PDF itself. Every PDF program that shows signatures can see whether the file was changed since it was sealed.

A seal does not sign in the name of a person but in the name of the organization that issued the document. That is why it is called a seal and not a signature.

The seal modes

The mode is set in CODAMAI_CRMS_SEAL_MODE. Any value other than internal or none makes the start fail. With internal, the start also fails if CODAMAI_CRMS_SEAL_KEYSTORE is missing. How you set the mode in the hub is described in The CRMS module in the hub.

When it is sealed

If sealing fails, there is no document but 500 document-seal-failed.

How the seal is built

• Standard: PAdES, level B-T. PAdES is the European standard for signatures in PDF files. B-T means: the signature carries a timestamp.
• Key: from CODAMAI_CRMS_SEAL_KEYSTORE, PKCS#12 with the whole certificate chain, Base64 encoded, password in CODAMAI_CRMS_SEAL_KEYSTORE_PASSWORD. The certificate comes from a certificate authority of the installation itself.
• Timestamp: over the signature value, from the same timestamp authority that also anchors the journals. See Timestamps and anchors.
• No signing time of its own: PAdES forbids the attribute signing-time. The trusted time is the timestamp’s.
• After the PDF/A conversion: the seal is written as an incremental update at the end of the file. The bytes before it stay unchanged, and PDF/A-3a and PDF/UA stay valid.
• Invisible: the seal has no visible field on the page.

Because the seal is applied before storing, the revision’s content hash covers the sealed file.

What the seal check finds

Pitfalls

Next

• Timestamps and anchors
• Output types and formats
• Storage on WORM