ApplyPAdESLongTermValidation

Digital signatures

Description

Promotes an already-signed PDF to PAdES-B-LT in one call, writing the result to a file.

Syntax

Delphi

Function TPDFlib.ApplyPAdESLongTermValidation(Const InputFile, Password, OutputFile, FieldName: WideString; Options: Integer): Integer;

Parameters

InputFile	The signed PDF.
Password	The password to open it, or an empty string.
OutputFile	The augmented PDF to write.
FieldName	A signature field to process, or an empty string to process every signature into one revision.
Options	A `PADES_LTV_*` bit mask; 0 selects `PADES_LTV_DEFAULT`.

Options

`PADES_LTV_WRITE_VRI` (1)	Write a VRI entry for each signature.
`PADES_LTV_FETCH_OCSP` (2)	Ask each link's OCSP responder.
`PADES_LTV_FETCH_CRL` (4)	Fall back to the CRL when OCSP returned nothing.
`PADES_LTV_FOLLOW_AIA` (8)	Follow issuer addresses to complete the path.
`PADES_LTV_SKIP_EXISTING` (16)	Do not re-add material whose bytes are already staged.
`PADES_LTV_SKIP_ROOT_REVOCATION` (32)	Do not ask for a self-issued root's status.
`PADES_LTV_DEFAULT` (63)	All of the above; selected when Options is 0.

Return values

1	The promotion succeeded.
2	The input file could not be read.
3	The input PDF could not be parsed.
10	The output could not be written.
11	The document security store could not be added.
20	No such signature field.
21	No processed signature carried a readable certificate.

GetPAdESLTVError carries the reason for any value other than 1.

Remarks

The signer certificate path is built from the signature's own CMS, and the remaining issuers are followed through the caIssuers addresses the certificates name when PADES_LTV_FOLLOW_AIA is set. Revocation is gathered for each link - OCSP first, then a CRL - and, with the certificates, written into the document security store by a single incremental update.

Material identical to something already staged is written once and referenced by every signature that needs it, so a certificate authority shared across the path or across signatures does not appear twice. A VRI entry is written only when it has a certificate to point at, so an empty entry is never produced.

An unreachable responder does not fail the call: the promotion proceeds with whatever was gathered, and GetPAdESLTVCertificateCount, GetPAdESLTVCRLCount, GetPAdESLTVOCSPCount and GetPAdESLTVError report what was obtained and why anything was missed.

Example

PDF.SetTimeStampOptions(2, 1, 1, 15000, '');
if PDF.ApplyPAdESLongTermValidation('signed.pdf', '', 'signed-lt.pdf', '', 0)<> 1 then
  ShowMessage(PDF.GetPAdESLTVError);