Headless Signature Seed Constraints
SignToFile and SignPFXToFile resolve the signature field SV dictionary through its parent chain and validate required seed values before publishing the signed output
The signing profile honours required Adobe.PPKLite handling, adbe.pkcs7.detached or ETSI.CAdES.detached encoding, seed capability versions 1 through 3, SHA256/SHA384/SHA512 selection, signing reasons, approval versus certification MDP values, and authenticated RFC 3161 timestamps
Set THPDFHeadlessCMSOptions.DigestMethod and Reason to select the corresponding actual CMS digest and signature Reason entry; a required single-period reason list suppresses the Reason entry
A required LockDocument true value writes an effective FieldMDP All transform; a required false value rejects a conflicting all-field lock
LegalAttestation seed constraints apply to certification signatures; LegalAttestation selects a permitted Unicode clarification for the standard Catalog Legal/Attestation dictionary, preserving existing legal content details
Approval signatures ignore certification-only LegalAttestation seed constraints; supplying a legal clarification with an approval request is rejected
Certificate constraints
HPDFReadHeadlessCertificatePolicy reads the SVCert model, and HPDFValidateHeadlessCertificatePolicy evaluates it against the actual leaf certificate and intermediate PEM certificates
| Constraint | Required behaviour |
|---|---|
| Subject | The leaf matches one complete DER certificate |
| Issuer | A cryptographically valid, currently valid direct or indirect chain reaches an allowed issuer; an allowed intermediate can terminate the chain |
| OID | Every configured policy OID occurs in the leaf certificate policies extension; this constraint applies when Issuer is supplied |
| SubjectDN | One alternative contains attributes matching the leaf subject; additional leaf attributes are permitted, with X.509 canonical comparison and Unicode support |
| KeyUsage | An existing extension matches one acceptable nine-position pattern; 0 requires an unset bit, 1 requires a set bit, and other or missing characters are wildcards |
| URL | CredentialSourceURL equals the configured enrollment URL when required |
Certificate constraint matching uses the seed issuers as explicit enrollment constraints; ordinary CMS business trust remains controlled separately by TrustedCAFile
CredentialSourceURL is provenance supplied by the application that obtained the signing identity; the library performs no enrollment network requests and cannot derive that provenance from X.509 bytes
TimestampServerURL identifies the endpoint routed by Timestamp.Transport; required timestamps additionally undergo real imprint, nonce, TSA certificate, and trust validation
Boundaries
Required AddRevInfo true requires UseAdobeRevocationInfo with authenticated evidence and an explicit trusted CA file; required false rejects that profile, and optional values do not override the selected profile
The Adobe attribute contains CRLs and BasicOCSPResponse values as signed attributes; all signer and included TSA chains must have currently valid authenticated revocation coverage before output publication
Required nonempty AppearanceFilter must match the built-in profile actually selected by SetSignatureFieldAppearance in the current document instance; unknown, replaced, or merely reloaded profile metadata does not satisfy the constraint
Malformed dictionaries, duplicate semantic keys, malformed DER or PEM, reserved certificate flags, over-budget constraints, and cancellation produce failures without replacing an existing output
Standalone certificate policy options bound total certificate bytes, aggregate constraint bytes, entries, and chain certificates; the result separates provided and matched flags from Accepted