TPDFlibEUTSLTrustSource

Security and signatures

Description

Loads an EU list of trusted lists and its referenced national trusted service lists, verifies their XML signatures, and supplies time-aware trust anchors to TPDFlibSignatureVerifier

The source also evaluates qualified-certificate statements, trusted-service qualifiers, qualification criteria, service scope extensions, and service history to classify qualified electronic signatures and seals under eIDAS

Unit

PDFlibEUTSL

Trust bootstrap

Function AddLOTLSigningCertificateDER(
  Const CertificateDER: AnsiString): Boolean;
Function AddLOTLSigningCertificateFromFile(
  Const CertificateFile: WideString): Boolean;
Procedure ClearLOTLSigningCertificates;
Procedure Clear;

An application must pin at least one independently trusted LOTL signing certificate before loading a LOTL

Clear discards the loaded LOTL and every national TSL snapshot, their pointers, services and diagnostic state, without touching the pinned LOTL signing certificates; the instance is then ready to load a fresh snapshot

The signing certificate embedded in XML KeyInfo must match a pinned certificate byte for byte, so a self-declared signer cannot establish its own trust

Each national TSL must in turn be signed by a certificate carried in the matching, already verified LOTL pointer

Loading trusted lists

Function LoadLOTLFromString(Const XMLData: AnsiString): Boolean;
Function LoadLOTLFromFile(Const FileName: WideString): Boolean;
Function LoadLOTLFromURL(Const URL: WideString): Boolean;
Function LoadTSLFromString(PointerIndex: Integer;
  Const XMLData: AnsiString): Boolean;
Function LoadTSLFromFile(PointerIndex: Integer;
  Const FileName: WideString): Boolean;
Function LoadTSLFromURL(PointerIndex: Integer): Boolean;
Function RefreshAllTSLs: Integer;

XML loading disables DTDs and external entities, applies a configurable size limit, requires one enveloped signature over the document root, and rejects detached references, duplicate signatures, digest failures, signer mismatches, and territory mismatches

LoadLOTLFromURL and LoadTSLFromURL require HTTPS by default and apply NetworkTimeoutMS and MaxXMLBytes to each request; the RequireHTTPS property (default True) controls the scheme check, and turning it off is intended only for controlled test environments

RefreshAllTSLs downloads and validates every current pointer before replacing the active service set, so a partial network or signature failure preserves the previous verified snapshot

Expired LOTL and TSL snapshots fail closed by default and remain unusable after their NextUpdate time; AllowExpiredLists is available only for controlled archival or diagnostic workflows

Inspection

Function GetPointerCount: Integer;
Function GetPointerInfo(Index: Integer;
  Out Info: TPDFlibEUTSLPointerInfo): Boolean;
Function GetPointerSigningCertificateDER(PointerIndex,
  CertificateIndex: Integer; Out CertificateDER: AnsiString): Boolean;
Function GetServiceCount: Integer;
Function GetServiceInfo(Index: Integer;
  Out Info: TPDFlibEUTSLServiceInfo): Boolean;
Function GetServiceCertificateDER(ServiceIndex, CertificateIndex: Integer;
  VerificationTime: TDateTime;
  Out CertificateDER: AnsiString): Boolean;

Pointer information exposes territory, location, MIME type, and permitted TSL signer count

Service information exposes the current service name, type, status, status start time, certificate count, and history count

GetLOTLLocation, GetLOTLNextUpdate, GetRevision, and GetLastError expose snapshot and diagnostic state

Signature verification

var
  TrustSource: TPDFlibEUTSLTrustSource;
  ChainReport: TPDFlibSignatureChainReport;
begin
  TrustSource:= TPDFlibEUTSLTrustSource.Create;
  try
    TrustSource.AddLOTLSigningCertificateFromFile('EU-LOTL-Signer.cer');
    if not TrustSource.LoadLOTLFromURL(LOTLURL) then
      raise Exception.Create(String(TrustSource.GetLastError));
    if TrustSource.RefreshAllTSLs<> TrustSource.GetPointerCount then
      raise Exception.Create(String(TrustSource.GetLastError));

    Verifier.SetTrustSource(TrustSource);
    try
      Result:= Verifier.VerifySignerCertificateChainEx(
        0, 0, srmOnline, 0, ChainReport);
    finally
      Verifier.SetTrustSource(nil);
    end;
  finally
    TrustSource.Free;
  end;
end;

SetTrustSource stores a non-owning reference, so the source must remain alive until it is detached or the verifier is destroyed

GetTrustAnchors(VerificationTime, Certificates) and EvaluateCertificateChain(Certificates, VerificationTime, Report) are the two hooks the verifier invokes on the source: the first returns the DER-encoded anchors of services trusted at the requested time, the second classifies a validated chain into a TPDFlibSignatureQualificationReport using the service set current at that time; applications normally call them indirectly through the verifier instead of directly

The verifier combines source anchors with any manual custom anchors in one exclusive chain engine and caches that engine by source revision and verification time

When a source is assigned and neither it nor the manual set supplies an anchor, verification fails closed instead of falling back to Windows system roots

Qualification report

TPDFlibSignatureChainReport.QualificationReport returns TPDFlibSignatureQualificationReport after a valid chain is evaluated

The report identifies the service territory, name, type, status, status start time, applied qualifiers, certificate purpose, qualified status, and qualified signature-creation device status

Status values distinguish not evaluated, not applicable, not qualified, qualified certificate, qualified electronic signature, and qualified electronic seal results, with separate QSCD variants

See also

TPDFlibSignatureVerifier