Check if an Excel File is Digitally Signed and Verify Digital Signatures in Excel in Java

Introduction

When working with Excel files, developers may encounter situations where they need to separate signed files from non-signed files, so that they can send the signed ones to a method to perform further manipulations, for example, verifying the signatures or reading other signature properties like the time of signing and the certificates used to create the signatures.

For such cases, this article will demonstrate how to check if an Excel file is digitally signed and verify digital signatures in Excel in Java using Spire.XLS for Java library.

Add Dependencies

To begin with, you need to add needed dependencies for including Spire.XLS for Java library into your Java project. You can either download the library’s jar from the official website or install it from Maven by adding the following code to your maven-based project’s pom.xml file.

<repositories>    
    <repository>    
        <id>com.e-iceblue</id>    
        <name>e-iceblue</name>    
        <url>https://repo.e-iceblue.com/nexus/content/groups/public/</url>    
    </repository>    
</repositories>    
<dependencies>    
    <dependency>    
        <groupId>e-iceblue</groupId>    
        <artifactId>spire.xls</artifactId>    
        <version>4.11.3</version>    
    </dependency>    
</dependencies>

Check and Verify Digital Signatures

The following are the main steps to check and verify digital signatures in an Excel file:

• Create a Workbook instance.
• Load an Excel file using Workbook.loadFromFile() method.
• Check if the file is digitally signed using Workbook.isDigitallySigned() method.
• If the file is signed, then get the signatures using Workbook.getDigitalSignatures() method.
• Loop through the signatures.
• Verify if each signature is valid or not using IDigitalSignature.isValid() method. Then get the certificate of the signature using IDigitalSignature.getX509Certificate() method, after that verify the certificate using X509Certificate.checkValidity() method.

The following is a basic code sample:

import com.spire.xls.Workbook;
import com.spire.xls.core.interfaces.IDigitalSignature;
import com.spire.xls.core.interfaces.IDigitalSignatures;

import java.security.cert.CertificateExpiredException;
import java.security.cert.CertificateNotYetValidException;
import java.security.cert.X509Certificate;

public class CheckAndVerifySignature {
    public static void main(String []args){

        //Create a Workbook instance
        Workbook workbook = new Workbook();
        //Load an Excel file
        workbook.loadFromFile("Signature.xlsx");

        //Check if the file is digitally signed
        boolean isSigned = workbook.isDigitallySigned();
        System.out.println("Is the file digitally signed? " + isSigned);

        if(isSigned) {
            //Get the digital signatures
            IDigitalSignatures signatures = workbook.getDigitalSignatures();

            //Traverse through the signatures
            for (IDigitalSignature signature : (Iterable<IDigitalSignature>) signatures) {
                //Verify the current signature
                boolean signatureIsValid = signature.isValid();

                //Get the certificate of the signature
                X509Certificate certificate = signature.getX509Certificate();

                //Verify the certificate
                boolean certificateIsValid = true;
                try {
                    certificate.checkValidity();
                } catch (CertificateExpiredException e) {
                    certificateIsValid = false;
                } catch (CertificateNotYetValidException e) {
                    certificateIsValid = false;
                }

                System.out.println("Is the signature valid? " + signatureIsValid);
                System.out.println("Is the certificate valid? " + certificateIsValid);
            }
        }

        workbook.dispose();
    }
}

Output:

See Also:
Add and Delete Digital Signature in Excel in Java