@GetMapping("/doc-sign/sign")
public ResponseEntity<Resource> getHashForSign() throws IOException {
    log.debug("start to generate merged PDF in java web start program");
    synchronized (eventPublisher) {
        eventPublisher.publishEvent(new OnDocMergeEvent(getUserId(), getXxxFormMaster().getXxxFormMasterId(), getXxxFormMaster().getFormType()));
    }
    Integer xxxFormMasterId = getXxxFormMaster().getXxxFormMasterId();
    String userId = getUserId();

    List<SuppDoc> suppDocs = suppDocMapper.selectSuppDocByXxxFormMasterIdAndDocTypeAndUserId(xxxFormMasterId, userId, Constants.SUPP_DOC_TYPE_SYS_GEN_MERGE);
    if (suppDocs == null || suppDocs.isEmpty()) {
        suppDocs = suppDocMapper.selectSuppDocByXxxFormMasterIdAndDocTypeAndUserId(xxxFormMasterId, userId, Constants.SUPP_DOC_TYPE_SYS_SIGN);
        if (suppDocs != null && !suppDocs.isEmpty()) {
            log.info("signed doc exists !!");
            return ResponseEntity.status(HttpStatus.NOT_ACCEPTABLE).body(null);
        }
        return ResponseEntity.status(HttpStatus.NOT_FOUND).body(null);
    }

    SuppDoc suppDoc = suppDocs.get(0);
    Integer suppDocId = suppDoc.getSuppDocId();

    Resource pdfFile = storageService.loadAsResource(xxxFormMasterId, suppDocId);

    File tempPdfFile = File.createTempFile("tmp", ".pdf");
    log.debug("Prepare pdf file for sign: {}", tempPdfFile.getPath());

    log.info("get hash for sign, userId {} form master id {}", userId, xxxFormMasterId);

    InputStream is = null;
    try {
        is = emptySignature(pdfFile.getInputStream(), tempPdfFile);
    } catch (DocumentException | GeneralSecurityException e) {
        log.error("error occurrs on calculate signature", e);
    }

    byte[] encryptedEmptySig = encrypt(StreamUtils.copyToByteArray(is));
    //byte[] emptySig = StreamUtils.copyToByteArray(is);
    String emptySig = Base64.getEncoder().encodeToString(encryptedEmptySig);

    ByteArrayResource resource = new ByteArrayResource(emptySig.getBytes(StandardCharsets.ISO_8859_1));

    HttpHeaders headers = new HttpHeaders();
    headers.add("Cache-Control", "no-cache, no-store, must-revalidate");
    headers.add("Pragma", "no-cache");
    headers.add("Expires", "0");

    request.getSession(false).setAttribute(TEMP_SIGN_PATH, tempPdfFile.getPath());

    return ResponseEntity.ok()
            .headers(headers)
            .contentLength(resource.contentLength())
            .contentType(MediaType.TEXT_PLAIN)
            .body(resource);
}

private byte[] encrypt(byte[] emptySig) {
    /*try {
        log.debug("js debugging for signing with forge")
        log.debug("HexBin.encode(emptySig) " + HexBin.encode(emptySig).substring(0, 500));
        MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
        byte hash[] = messageDigest.digest(emptySig);
        System.out.println("server emptySig sha256 hash = " + Hex.toHexString(hash));
    } catch (NoSuchAlgorithmException e1) {
    }*/

    String type = "X.509";

    String encodedCertificate = request.getParameter("certificate");
    try {
        CertificateFactory certificateFactory = CertificateFactory.getInstance(type);
        Certificate certificate = certificateFactory.generateCertificate(
                new ByteArrayInputStream(HashUtils.base64Decode(encodedCertificate)));
        PublicKey publicKey = certificate.getPublicKey();

        Cipher rsaCipher;
        try {
            rsaCipher = Cipher.getInstance(RSA_ALGORITHM);
            rsaCipher.init(Cipher.ENCRYPT_MODE, publicKey);

            // reference from https://stackoverflow.com/questions/24338108/java-encrypt-string-with-existing-public-key-file
            // Now create a new 256 bit Rijndael key to encrypt the file itself.
            // This will be the session key.
            /*KeyGenerator rijndaelKeyGenerator = KeyGenerator.getInstance("Rijndael");
            rijndaelKeyGenerator.init(256);
            log.debug("Generating session key...");
            Key rijndaelKey = rijndaelKeyGenerator.generateKey();
            log.debug("Done generating key.");
            
            byte[] encodedKeyBytes = rsaCipher.doFinal(rijndaelKey.getEncoded());
            ByteArrayOutputStream output = new ByteArrayOutputStream();
            output.write(encodedKeyBytes.length);
            output.write(encodedKeyBytes);
            
            // Now we need an Initialization Vector for the symmetric cipher in CBC mode
            SecureRandom random = new SecureRandom();
            byte[] iv = new byte[16];
            random.nextBytes(iv);
            
            output.write(iv);
            
            IvParameterSpec spec = new IvParameterSpec(iv);
            // Create the cipher for encrypting the file itself.
            Cipher symmetricCipher = Cipher.getInstance(RIJNDAEL_ALGORITHM);
            symmetricCipher.init(Cipher.ENCRYPT_MODE, rijndaelKey, spec);
            */

            ByteArrayOutputStream baos = new ByteArrayOutputStream();
            DataOutputStream output = new DataOutputStream(baos);

            KeyGenerator generator = KeyGenerator.getInstance("AES");
            generator.init(128);
            log.debug("Generating session key...");
            SecretKey aesKey = generator.generateKey();
            log.debug("Done generating key.");

            log.debug("aesKey.getEncoded() = " + Base64.getEncoder().encodeToString(aesKey.getEncoded()));
            byte[] encodedKeyBytes = rsaCipher.doFinal(aesKey.getEncoded());

            // output = encrypted AES key length + encrypted AES key + empty signature encrypted by AES key
            log.debug("encrypted AES key length = " + encodedKeyBytes.length);
            output.writeInt(encodedKeyBytes.length);
            output.write(encodedKeyBytes);

            Cipher symmetricCipher = Cipher.getInstance(AES_ALGORITHM);
            symmetricCipher.init(Cipher.ENCRYPT_MODE, aesKey);

            output.write(symmetricCipher.doFinal(emptySig));
            output.flush();

            log.debug("length of encrypted data = " + baos.toByteArray().length);
            return baos.toByteArray();
        } catch (NoSuchAlgorithmException | NoSuchPaddingException | InvalidKeyException
                | IllegalBlockSizeException | BadPaddingException | IOException e) {
            log.error("encrypt empty signature", e);
        }
    } catch (CertificateException e) {
        log.error("encrypt", e);
    }

    return null;
}

private InputStream emptySignature(InputStream src, File dest)
        throws IOException, DocumentException, GeneralSecurityException {
    PdfReader reader = new PdfReader(src);
    FileOutputStream os = new FileOutputStream(dest);
    PdfStamper stamper = PdfStamper.createSignature(reader, os, '\0');
    PdfSignatureAppearance appearance = stamper.getSignatureAppearance();

    //appearance.setVisibleSignature(new Rectangle(0, 0, 0, 0), 1, FIELD_NAME);
    log.info("create empty signature");
    String position = (String) WebUtils.getSession().getAttribute(WebAttributeNames.SESSION_PSCT_DOC_SIGNATURE_POSITION);
    String[] p = position.split("\\|");
    appearance.setVisibleSignature(new Rectangle(Float.valueOf(p[0]), Float.valueOf(p[1]), Float.valueOf(p[2]), Float.valueOf(p[3])), Integer.valueOf(p[4]), Constants.SIG_FIELD_NAME);

    // set signature text
    Font font = new Font(FontFamily.TIMES_ROMAN, 10, Font.BOLD);
    appearance.setLayer2Font(font);
    appearance.setRunDirection(PdfWriter.RUN_DIRECTION_RTL);

    appearance.setLayer2Text("Signed By Digital Certificate");

    ClassPathResource pinImage = new ClassPathResource("static/images/Cert-sign.png");
    appearance.setImage(Image.getInstance(pinImage.getURL()));

    //appearance.setCertificate(chain[0]);
    ExternalSignatureContainer external = new ExternalBlankSignatureContainer(PdfName.ADOBE_PPKLITE,
            PdfName.ADBE_PKCS7_DETACHED);
    MakeSignature.signExternalContainer(appearance, external, 8192);
    os.close();
    return appearance.getRangeStream();
}

@PostMapping(value = "/doc-sign/sign", produces = MediaType.APPLICATION_JSON_VALUE)
@ResponseBody
public CertSignResult attachSignedHash() {
    CertSignResult certSignResult = new CertSignResult();
    certSignResult.setStatus(CertSignResult.STATUS_NOT_SIGNED);

    try {
        if (!WebUtils.validateCert(pkiClient)) {
            return certSignResult;
        }
    } catch (Exception e) {
        log.error("signHash", e);
        return certSignResult;
    }

    String tempPath = (String) request.getSession(false).getAttribute(TEMP_SIGN_PATH);

    Integer xxxFormMasterId = getXxxFormMaster().getXxxFormMasterId();
    String userId = getUserId();

    log.info("sign hash, userId {} form master id {}", userId, xxxFormMasterId);

    //		tryToDeleteSignedDoc();

    File tempSignedFile = null;

    try {
        tempSignedFile = File.createTempFile("signed-" + xxxFormMasterId + "-", ".pdf");

        String hash = request.getParameter("signed");
        //log.debug("hash {}", hash);
        // Save the hash to file pkcs7-hash.pem
        // View p7 file content by: openssl asn1parse -inform pem -in pkcs7-hash.pem

        byte[] signedhash = Base64.getDecoder().decode(hash);

        createSignature(tempPath, tempSignedFile, signedhash);
    } catch (DocumentException | GeneralSecurityException | IOException e) {
        log.error("Fail to sign document " + e);
        return certSignResult;
    }

    SimpleSuppDoc doc = new SimpleSuppDoc();
    doc.setXxxFormMasterId(xxxFormMasterId);
    doc.setLocalFile(tempSignedFile);
    doc.setSuppDocType(Constants.SUPP_DOC_TYPE_SYS_SIGN);

    try {
        Integer suppDocId = storageService.store(doc, userId);

        if (doc.isUploadSucess()) {
            insertSigningLog(userId, xxxFormMasterId, suppDocId);

            // no need to keep the merged doc
            storageService.deleteDocByUserIdAndType(xxxFormMasterId, userId, Constants.SUPP_DOC_TYPE_SYS_GEN_MERGE);

            certSignResult.setStatus(CertSignResult.STATUS_SIGNED);
            request.getSession(false).setAttribute(WebAttributeNames.SESSION_PSCT_DOC_SIGN_STATUS, certSignResult);

            createZipFileForSignedDoc(userId, tempSignedFile);
            return certSignResult;
        }
    } catch (IOException e) {
        log.error("sign pdf file", e);
    } finally {
        if (tempSignedFile != null)
            tempSignedFile.delete();
    }

    return certSignResult;
}

private void createSignature(String src, File dest, byte[] signedHash)
        throws IOException, DocumentException, GeneralSecurityException {
    PdfReader reader = new PdfReader(src);
    FileOutputStream os = new FileOutputStream(dest);
    ExternalSignatureContainer external = new MyExternalSignatureContainer(signedHash);
    MakeSignature.signDeferred(reader, Constants.SIG_FIELD_NAME, os, external);
    os.close();
}

class MyExternalSignatureContainer implements ExternalSignatureContainer {
    protected byte[] sig;

    public MyExternalSignatureContainer(byte[] sig) {
        this.sig = sig;
    }

    @Override
    public void modifySigningDictionary(PdfDictionary signDic) {
    }

    @Override
    public byte[] sign(InputStream arg0) throws GeneralSecurityException {
        return sig;
    }
}