TPDFlibSignatureVerifier

Security and Signatures

Description

Enumerates PDF signature fields and CMS signers, validates a selected signature without loading the complete PDF into memory, and reports the selected signature's own incremental revision separately from the current file The verifier accepts a file, caller-owned stream, or ANSI byte string through

OpenPDF, OpenPDFStream, or OpenPDFString

Selection

Count := Verifier.GetSignatureCount;
Verifier.GetSignatureFieldName(0, FieldName);
SignerCount := Verifier.GetSignerCount(0);
Result := Verifier.VerifySignatureByName(FieldName, 0, Report);

VerifySignatureByIndex selects a PDF field by zero-based index, while VerifySignatureByName uses the fully qualified AcroForm field name and both methods accept a zero-based CMS signer index

Signature verification report

Certification and field permissions

GetSignaturePermissionInfo and GetSignaturePermissionInfoByName return TPDFlibSignaturePermissionReport The report distinguishes a valid DocMDP transform from a matching catalog

/Perms /DocMDP reference and verifies that a field /Lock dictionary matches its FieldMDP transform, action, and field-name list

Certificate chain and revocation

VerifySignerCertificateChainByIndex and VerifySignerCertificateChainByName run the default chain validation for an explicitly selected signature and signer

VerifySignerCertificateChainEx and VerifySignerCertificateChainExByName accept srmNone, srmCacheOnly, or srmOnline, plus an optional verification time

TPDFlibSignatureChainReport separates TrustStatus, Windows chain and policy errors, DSS or VRI evidence counts, exact OCSP attribution, OCSP status, revocation reason, freshness, and native errors

Embedded certificates and validation material can complete a chain but do not convert an untrusted root into a trusted root

DSS or VRI OCSP evidence is accepted only when its responder signature, issuer or delegated responder usage, CertID, status, and freshness match the selected certificate

External trust sources

Verifier.AddTrustAnchorDER(RootCertificateDER);
Verifier.AddTrustAnchorFromFile('BusinessRoot.cer');
AnchorCount := Verifier.GetTrustAnchorCount;
Verifier.ClearTrustAnchors;

AddTrustAnchorDER and AddTrustAnchorFromFile add validated X.509 certificates to an in-memory, duplicate-free trust-anchor set

Root without weakening certificate-chain, usage, validity, signature, or revocation checks TrustedPeople implements this contract for signed EU LOTL and national TSL documents

The exclusive engine and parsed root store are cached by the verifier and reused until the anchor set changes

This isolation lets an application apply a private business trust policy without installing certificates or inheriting unrelated machine trust

Trust-anchor membership does not bypass certificate validity, key usage, signature, or requested revocation checks

ClearTrustAnchors releases the set and restores the default Windows system trust engine for subsequent checks

RFC 3161 timestamps

Verifier.SetTrustSource(TrustSource);
Source := Verifier.GetTrustSource;

SetTrustSource (signature index) and TPDFlibSignatureTrustSource (field name) validate a document timestamp against the signature ByteRange data

Source anchors are combined with manual custom anchors in the same exclusive chain engine, which is cached by source revision and verification time

Assigning a source disables fallback to Windows system roots when no source or manual anchor is available

A successful source evaluation populates TPDFlibSignatureChainReport.QualificationReport without weakening certificate-chain, usage, validity, signature, or revocation checks

TPDFlibEUTSLTrustSource implements this contract for signed EU LOTL and national TSL documents

RFC 3161 timestamps

VerifyDocumentTimeStamp and the VerifyDocumentTimeStampByName family enumerate and validate

GetSignatureTimeStampCount and VerifySignatureTimeStamp first validate signature integrity and the signer chain at the requested UTC time If the requested-time chain is invalid, the verifier validates every signature timestamp and every document timestamp whose signed revision covers the target signature, derives the earliest trusted signature time and the latest whole-document archive time, and retries the chain at those proof-of-existence control times A zero id-aa-signatureTimeStampToken selects the current UTC time, while a nonzero value is passed directly to the certificate-chain policy as UTC signatureValue permits a trusted signature timestamp or covering document timestamp to supply the historical control time VerifySignatureTimeStamp and VerifySignatureTimeStampByName require a trusted document timestamp that covers the complete current document before current DSS, VRI, CRL, or OCSP material can be treated as historical evidence; otherwise the report returns

Ex A timestamp supplies an upper bound on when the signed bytes existed, not an inferred signing time, so a signer certificate that was already invalid at the selected proof time remains invalid VerifyDocumentTimeStampEx returns requested and effective chain reports, the best signature and archive times, the selected proof source, timestamp counts, time-slide state, and a specific historical status VerifyDocumentTimeStampExByName post-processes one such report, filling VerifySignatureTimeStampExVerifySignatureTimeStampExByName

TPDFlibTimeStampVerificationReport

AdES historical validation

Result := Verifier.VerifyAdESHistoricalByName(
  FieldName, 0, srmCacheOnly, ValidationTime, HistoricalReport);

VerifyAdESHistorical and VerifyAdESHistoricalByName first validate signature integrity and the signer chain at the requested UTC time

If the requested-time chain is invalid, the verifier validates every signature timestamp and every document timestamp whose signed revision covers the target signature, derives the earliest trusted signature time and the latest whole-document archive time, and retries the chain at those proof-of-existence control times

A zero ValidationTime selects the current UTC time, while a nonzero value is passed directly to the certificate-chain policy as UTC

srmNone permits a trusted signature timestamp or covering document timestamp to supply the historical control time

srmCacheOnly and srmOnline require a trusted document timestamp that covers the complete current document before current DSS, VRI, CRL, or OCSP material can be treated as historical evidence; otherwise the report returns ahsEvidenceNotArchived

A timestamp supplies an upper bound on when the signed bytes existed, not an inferred signing time, so a signer certificate that was already invalid at the selected proof time remains invalid

TPDFlibAdESHistoricalValidationReport returns requested and effective chain reports, the best signature and archive times, the selected proof source, timestamp counts, time-slide state, and a specific historical status

DeriveBaselineProfile post-processes one such report, filling BaselineProfile from the signature subfilter together with the timestamp and DSS evidence already collected in the report

Compatibility methods

VerifySignatureGetSignatureMetadataGetSignerCertificateVerifySignerCertificateChain

ByIndex, ByName, GetSignatureMetadataByIndex, and GetSignatureMetadataByName remain available and select field 0 and signer 0 The corresponding GetSignerCertificateByIndex and GetSignerCertificateByName methods (

See also

TPDFlibEUTSLTrustSource, SetSignProcessDocMDP, SetSignProcessFieldLock, SetPAdESSignatureTimeStampToken