Known limitations and restrictions

This document gathers the known limitations and restrictions of the component, organized by generator. These apply in addition to the general restrictions already described in the general conventions of the index (for example, that no functionality supports an already-protected source file).

.NET Framework

The .NET Framework generator relies on iTextSharp 4.1.6.0. This version was chosen for being the last one distributed under a free-software license for commercial use at no cost (see detail in the index); in exchange, it brings some technical limitations inherent to being an earlier version of the library.

Text extraction (GetText)

• Without the modern extraction features that reconstruct the layout from the exact position of each character; even with Detect layout enabled, table text is retrieved but without a guarantee of column alignment.

• No column (tab) heuristics, nor a placeholder for image content.

PDF generation from HTML (Html2PDF)

• Intentionally simple HTML engine: no external stylesheets nor complex layouts (advanced nested tables, flexbox). See the full detail of supported tags and behavior in the Html2PDF document.

• Does not support forcing page breaks via CSS (page-break-before/page-break-after); silently ignored.

• No chart/graphics engine.

• Only a subset of attributes/CSS is interpreted (see Html2PDF for the full detail); box properties such as background, padding, or margin via style on <div>/<span> have no effect.

Digital signature (AddSignature)

• "Self-contained" signing mechanism of this library version, without timestamping (TSA) from an external authority nor long-term certificate chain validation (LTV/PAdES).

• Supported certificate format: "classic" PKCS#12 (.pfx/.p12), with PBE-SHA1-3DES encryption and SHA-1 MAC. It does not support the modern algorithms that tools like OpenSSL 3.x use by default when exporting a certificate (AES-256-CBC + PBKDF2, SHA-256 MAC): a certificate exported with those modern algorithms fails to load, with the following error:

  Unable to cast object of type 'Org.BouncyCastle.Asn1.DerObjectIdentifier' to type
  'Org.BouncyCastle.Asn1.DerOctetString'.
  

A certificate in that modern format must be re-exported in the compatible "legacy" format before being used with this functionality, for example with OpenSSL 3.x:

  openssl pkcs12 -export -legacy -out certificate.pfx -inkey key.pem -in certificate.pem -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg sha1
  

If only the modern .pfx is available (without the original .pem files), the private key and certificate must first be extracted, and then re-exported as a legacy PKCS#12:

  openssl pkcs12 -in original.pfx -passin pass:CURRENT_PASSWORD -nocerts -nodes -out key.pem
  openssl pkcs12 -in original.pfx -passin pass:CURRENT_PASSWORD -clcerts -nokeys -out certificate.pem
  openssl pkcs12 -export -legacy -out certificate.pfx -inkey key.pem -in certificate.pem -passout pass:NEW_OR_SAME_PASSWORD -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg sha1
  

There is no need to install an older version of OpenSSL: OpenSSL 3.x still supports these legacy algorithms with the -legacy flag plus the algorithms explicitly indicated.

• No parameters to customize the text shown in the visible signature (it is generated automatically from the certificate's data and the signing date/time).

Document protection (ManagePermissions)

• 128-bit encryption (256-bit is not supported in this library version).

Cross-cutting restriction: no method supports opening an already-protected PDF as source

This restriction applies to all functionalities of the component (see also the general conventions):

• GetFields/GetField (read-only on the form) only work if the document is protected with an empty user password and restricted permissions; they fail if the user password is not empty.

• SetFields/SetField require owner access to modify the document; since the owner password generated by ManagePermissions is never exposed, there is no way to obtain that access, so these functionalities always fail on a protected document, even with an empty user password.

• AddText/AddWatermark rebuild the document by copying the content of each page; that copy is blocked on any encrypted PDF except with the owner password. It fails in any protection scenario (empty password + restricted permissions, or even protection with just a password without restricting anything).

• ConcatFiles stops at the first protected file in the list (with a non-empty user password); the error message identifies the file responsible.