HPDFCreateHeadlessDocumentTimestamp

function HPDFCreateHeadlessDocumentTimestamp(Source: TStream;
  const ByteRange: array of Int64; const Options: THPDFHeadlessCMSOptions;
  out SignerCertificatePEM: SysUtils.TBytes): SysUtils.TBytes;

Creates a genuine RFC 3161 timestamp token over the caller-supplied covered PDF byte ranges through the portable OpenSSL 3 provider

The caller owns a seekable source; two entries must cover the complete source, whilst four entries cover an exact historical revision with one nonempty excluded Contents interval

DigestMethod selects SHA256, SHA384 or SHA512; native streaming hash computation uses bounded 64 KiB reads and observes the shared CancellationToken

Timestamp.Transport and explicit Timestamp.TrustedCAFile are required; issuance validates the exact imprint and fresh request nonce, actual TSA CMS and ESS binding, critical timeStamping EKU, signer name, certificate chain and configured CRL evidence

The returned bytes contain the complete validated DER timestamp token without PDF reservation padding

SignerCertificatePEM returns the authenticated TSA signer first, followed by embedded certificate-chain entries; no private key is required or returned

MaxSignedBytes bounds the covered content length; MaxCMSBytes bounds token and serialised certificate-chain bytes, and timestamp-specific response limits remain effective

All source positions are restored on success or failure; low-level callers own reservation patching, staging and atomic publication

Use THPDFHeadlessDocument.TimestampToFile for signature-field policy validation and a complete incremental PDF workflow

Document timestamp workflow · Options