TPDFlibSignatureVerifier

Security and Signatures

Description

Enumerates PDF signature fields and CMS signers, validates a selected signature without loading the complete PDF into memory, and reports the selected signature's own incremental revision separately from the current file

The verifier accepts a file, caller-owned stream, or ANSI byte string through OpenPDF, OpenPDFStream, or OpenPDFString

Selection

Count := Verifier.GetSignatureCount;
Verifier.GetSignatureFieldName(0, FieldName);
SignerCount := Verifier.GetSignerCount(0);
Result := Verifier.VerifySignatureByName(FieldName, 0, Report);

VerifySignatureByIndex selects a PDF field by zero-based index, while VerifySignatureByName uses the fully qualified AcroForm field name and both methods accept a zero-based CMS signer index

Signature verification report

Certification and field permissions

GetSignaturePermissionInfo and GetSignaturePermissionInfoByName return TPDFlibSignaturePermissionReport

The report distinguishes a valid DocMDP transform from a matching catalog /Perms /DocMDP reference and verifies that a field /Lock dictionary matches its FieldMDP transform, action, and field-name list

Certificate chain and revocation

VerifySignerCertificateChainByIndex and VerifySignerCertificateChainByName run the default chain validation for an explicitly selected signature and signer

VerifySignerCertificateChainEx and VerifySignerCertificateChainExByName accept srmNone, srmCacheOnly, or srmOnline, plus an optional verification time

TPDFlibSignatureChainReport separates TrustStatus, Windows chain and policy errors, DSS or VRI evidence counts, exact OCSP attribution, OCSP status, revocation reason, freshness, and native errors

Embedded certificates and validation material can complete a chain but do not convert an untrusted root into a trusted root

DSS or VRI OCSP evidence is accepted only when its responder signature, issuer or delegated responder usage, CertID, status, and freshness match the selected certificate

Custom trust anchors

Verifier.AddTrustAnchorDER(RootCertificateDER);
Verifier.AddTrustAnchorFromFile('BusinessRoot.cer');
AnchorCount := Verifier.GetTrustAnchorCount;
Verifier.ClearTrustAnchors;

AddTrustAnchorDER and AddTrustAnchorFromFile add validated X.509 certificates to an in-memory, duplicate-free trust-anchor set

When the set is nonempty, every signer and timestamp chain is built with an exclusive trust engine that uses the set for CA roots and explicit certificate pins without consulting the Windows Root or TrustedPeople stores

The exclusive engine and parsed root store are cached by the verifier and reused until the anchor set changes

This isolation lets an application apply a private business trust policy without installing certificates or inheriting unrelated machine trust

Trust-anchor membership does not bypass certificate validity, key usage, signature, or requested revocation checks

ClearTrustAnchors releases the set and restores the default Windows system trust engine for subsequent checks

External trust sources

Verifier.SetTrustSource(TrustSource);
Source := Verifier.GetTrustSource;

SetTrustSource attaches a non-owning TPDFlibSignatureTrustSource that can supply time-specific anchors and evaluate a successfully built certificate chain

Source anchors are combined with manual custom anchors in the same exclusive chain engine, which is cached by source revision and verification time

Assigning a source disables fallback to Windows system roots when no source or manual anchor is available

A successful source evaluation populates TPDFlibSignatureChainReport.QualificationReport without weakening certificate-chain, usage, validity, signature, or revocation checks

TPDFlibEUTSLTrustSource implements this contract for signed EU LOTL and national TSL documents

RFC 3161 timestamps

VerifyDocumentTimeStamp (signature index) and VerifyDocumentTimeStampByName (field name) validate a document timestamp against the signature ByteRange data

GetSignatureTimeStampCount and the VerifySignatureTimeStamp family enumerate and validate id-aa-signatureTimeStampToken attributes against the selected CMS signer signatureValue; VerifySignatureTimeStamp selects the signature by index and VerifySignatureTimeStampByName by field name

The Ex variants (VerifyDocumentTimeStampEx, VerifyDocumentTimeStampExByName, VerifySignatureTimeStampEx, VerifySignatureTimeStampExByName) also accept revocation mode, expected policy OID, and expected nonce

TPDFlibTimeStampVerificationReport reports token-signature validity, message-imprint validity, TSA EKU and name binding, policy, nonce, generation time, chain result, and trust status independently

AdES historical validation

Result := Verifier.VerifyAdESHistoricalByName(
  FieldName, 0, srmCacheOnly, ValidationTime, HistoricalReport);

VerifyAdESHistorical and VerifyAdESHistoricalByName first validate signature integrity and the signer chain at the requested UTC time

If the requested-time chain is invalid, the verifier validates every signature timestamp and every document timestamp whose signed revision covers the target signature, derives the earliest trusted signature time and the latest whole-document archive time, and retries the chain at those proof-of-existence control times

A zero ValidationTime selects the current UTC time, while a nonzero value is passed directly to the certificate-chain policy as UTC

srmNone permits a trusted signature timestamp or covering document timestamp to supply the historical control time

srmCacheOnly and srmOnline require a trusted document timestamp that covers the complete current document before current DSS, VRI, CRL, or OCSP material can be treated as historical evidence; otherwise the report returns ahsEvidenceNotArchived

A timestamp supplies an upper bound on when the signed bytes existed, not an inferred signing time, so a signer certificate that was already invalid at the selected proof time remains invalid

TPDFlibAdESHistoricalValidationReport returns requested and effective chain reports, the best signature and archive times, the selected proof source, timestamp counts, time-slide state, and a specific historical status

DeriveBaselineProfile post-processes one such report, filling BaselineProfile from the signature subfilter together with the timestamp and DSS evidence already collected in the report

Compatibility methods

VerifySignature, GetSignatureMetadata, GetSignerCertificate, and VerifySignerCertificateChain remain available and select field 0 and signer 0

The corresponding ByIndex and ByName methods (GetSignatureMetadataByIndex, GetSignatureMetadataByName, GetSignerCertificateByIndex, GetSignerCertificateByName) provide explicit selection for multi-signature and multi-signer documents

See also

TPDFlibEUTSLTrustSource, SetSignProcessDocMDP, SetSignProcessFieldLock, SetPAdESSignatureTimeStampToken