Command-line utility (Java JAR) that lets you, quickly and without writing any cryptographic code:

• Add qualified timestamps to PDF documents.

• Sign PDF documents with your certificate (P12/PFX), adding a timestamp as well.

• Produce PAdES B-LTA documents (long-term signature with double timestamping: one inside the signature itself and one at document level), choosing the Timestamping Authority for each timestamp.

• Verify the signatures and timestamps present in a PDF.

It can be run by hand or integrated from any programming language through 'exec'-style calls. All output is a single JSON object, easy to process from code.

Download the utility: FirmaYSelloDePDFs.zip

• Java 1.8 or higher: the same JAR runs on Java 8, 11, 17, 21 and 25, on any computer or server.

• The fnmt.png logo file supplied in the ZIP must sit in the same directory as the executable JAR lofirmo_com.jar (only used when the informative box is drawn). If you place a mensatek.png file next to the JAR, it will be used as the box logo when the selected timestamp is the MENSATEK one.

• Username and password of the Timestamping service: you will find them in your user panel, Timestamping section.

java -jar lofirmo_com.jar -fe "input.pdf" -fs "output.pdf" -u "User" -p "Password" [options]

WARNING: if the input file already contains signatures or timestamps, the utility does not add the informative box (modifying the document would invalidate the previous signatures): the new signature or timestamp is added invisibly, preserving the existing signatures, and this is reported in the 'avisos' field of the response.

Two Timestamping Authorities are available with the same legal validity, both issuing eIDAS qualified timestamps:

Each timestamp issued is deducted from your credits: a normal operation performs one timestamp; an operation with -lta true performs two (the signature one and the document one, each charged according to the chosen Authority).

If you prefer to integrate timestamping directly into your applications (RFC-3161 protocol, no PDF involved), see the Timestamping service specification.

The output is a single JSON object on standard output. The 'resultado' field is OK or ERROR and the process exit code is 0 (OK) or 1 (ERROR).

Example of a successful operation (signature + timestamp):

{
  "resultado": "OK",
  "version": "4.0",
  "ficheroEntrada": "/path/input.pdf",
  "operacion": "firma+sello",
  "ficheroSalida": "/path/output.pdf",
  "sello": "FNMT",
  "lta": false,
  "firmasPrevias": 0,
  "recuadro": true,
  "certificado": false,
  "selloTiempo": {
    "fecha": "01-09-2026 17:00:06",
    "tsa": "C=ES,O=FÁBRICA NACIONAL DE MONEDA Y TIMBRE-REAL CASA DE LA MONEDA,OU=CERES,CN=AUTORIDAD DE SELLADO DE TIEMPO FNMT-RCM - TSU 2020"
  }
}

The 'operacion' field is sello (timestamp), firma+sello (signature + timestamp) or verificacion (verification). With -lta true the response also includes 'selloDocumento' (Authority of the document timestamp) and 'selloDocumentoTiempo' (date and TSA of that second timestamp). Non-fatal circumstances (previous signatures, unreachable revocation sources...) are reported in the 'avisos' array.

Example with an error (wrong certificate password):

{
  "resultado": "ERROR",
  "version": "4.0",
  "ficheroEntrada": "/path/input.pdf",
  "operacion": "firma+sello",
  "error": { "codigo": -1, "mensaje": "keystore password was incorrect" }
}

In general, if there is no 'error' object (and the exit code is 0), the operation finished correctly.

With -check true only the input file is needed; the program returns the number of signatures and a 'firmas' array with the details of each signature or timestamp:

java -jar lofirmo_com.jar -fe "signed.pdf" -check true

{
  "resultado": "OK",
  "version": "4.0",
  "operacion": "verificacion",
  "numeroFirmas": 2,
  "firmas": [
    {
      "nombre": "Signature1",
      "visible": true,
      "posicion": { "pagina": 9, "izquierda": 50.0, "abajo": 700.0, "derecha": 550.0, "arriba": 800.0 },
      "integridadCorrecta": true,
      "cubreTodoElDocumento": false,
      "revision": { "numero": 1, "total": 2 },
      "algoritmoResumen": "SHA256",
      "algoritmoCifrado": "RSA",
      "subFiltro": "/ETSI.CAdES.detached",
      "firmante": "SIGNER NAME",
      "fechaFirma": "01-09-2026 17:00:06.00",
      "conSelloTiempo": true,
      "fechaSelloTiempo": "01-09-2026 17:00:06.00",
      "servicioSellado": "C=ES,O=FÁBRICA NACIONAL DE MONEDA Y TIMBRE-REAL CASA DE LA MONEDA,...",
      "selloTiempoValido": true,
      "tipo": "Firma",
      "permiteRellenarCampos": true,
      "permiteAnotaciones": true,
      "bloqueos": 0
    },
    {
      "nombre": "Signature2",
      "visible": false,
      "integridadCorrecta": true,
      "cubreTodoElDocumento": true,
      "subFiltro": "/ETSI.RFC3161",
      "tipo": "Sello de Tiempo"
    }
  ]
}

The 'tipo' field of each element distinguishes Firma (signature), Certificación (certification) and Sello de Tiempo (document timestamp).

With -lta true the produced document embeds everything needed for the signature to remain verifiable in the long term, without depending on the validation sources still being available:

1. The electronic signature in PAdES format (ETSI.CAdES.detached subfilter) with a timestamp inside the signature itself, issued by the Authority chosen with -sello.

2. The validation information embedded in the document (DSS/VRI dictionary with the certificates and the OCSP/CRL revocation evidence of every chain, including the Timestamping Authority's own chain).

3. A document timestamp (ETSI.RFC3161) protecting all of the above, issued by the Authority chosen with -sellodoc.

You can combine the Authorities as you prefer; for example, signature timestamped by FNMT and document timestamp by MENSATEK:

java -jar lofirmo_com.jar -fe "input.pdf" -fs "output.pdf" -u "User" -p "Password" -cf "certificate.pfx" -pcf "1234" -lta true -sello fnmt -sellodoc mensatek

If the input file is not signed and no certificate is given (-cf), the -lta mode produces a long-term timestamping: first document timestamp + validation information + second document timestamp.

Timestamp of a file (MENSATEK timestamp, the default):

java -jar lofirmo_com.jar -fe "test.pdf" -fs "test_S.pdf" -u "User" -p "Password"

Certification (signature with your certificate) and FNMT timestamp, with your company logo in the box:

java -jar lofirmo_com.jar -fe "test.pdf" -fs "test_S.pdf" -u "User" -p "Password" -sello fnmt -i "logo.png" -cf "certificate.pfx" -pcf "1234"

Verification and check of the signatures and timestamps of a PDF:

java -jar lofirmo_com.jar -fe "test.pdf" -check true

Existing integrations keep working without changes: the 3.x parameters are unchanged and, with -formato texto, the output goes back to being exactly the classic one ("variable"="value" lines with "Estado"="Finalizado/Correcto" or "Resultado"="ERROR-..." and exit code 0). What is new in version 4 is the JSON output (default), the choice of Timestamping Authority (-sello/-sellodoc), the PAdES B-LTA profile (-lta) and compatibility with any Java from 1.8 to 25.