Certification Signatures and Field Locks

HotPDF can author the PDF permission structures attached to certification signatures and signed field locks, then inspect the same structures in a loaded document

Producer API

procedure AddCertificationSignatureField(
  const FieldName: AnsiString;
  Rectangle: TRect;
  Permission: THPDFDocMDPPermission;
  ContentsBytes: Integer = 8192;
  const SubFilter: AnsiString = 'adbe.pkcs7.detached';
  const Reason: AnsiString = '';
  const Location: AnsiString = '';
  const ContactName: AnsiString = '';
  Flags: THPDFFormFieldFlags = []);

procedure ConfigureCertificationSignature(
  const FieldName: AnsiString;
  Permission: THPDFDocMDPPermission);

procedure AttachSignatureFieldLock(
  const FieldName: AnsiString;
  Action: THPDFFieldLockAction;
  const Fields: array of AnsiString);

AddCertificationSignatureField combines signed-placeholder creation with certification configuration

ConfigureCertificationSignature is for an existing authored signed placeholder and requires that field to be the first field carrying a signature dictionary

A document can contain only one certification signature, so a second configuration request is rejected before the object graph is changed

These APIs negotiate PDF 1.5 output automatically

DocMDP permission levels

Value	Certification permission
`dmpNoChanges`	No changes are permitted after certification
`dmpFormFillAndSign`	Form filling, template instantiation, and signing are permitted
`dmpFormFillSignAndAnnotate`	The preceding changes plus annotation creation, deletion, and modification are permitted

dmpNone is reserved for inspection results without a DocMDP transform and is rejected by producer methods

Field-lock scopes

Value	Fields argument	Effect after signing
`flaAll`	Must be empty	Locks every form field
`flaInclude`	One or more unique field names	Locks only the listed fields
`flaExclude`	One or more unique field names	Locks every field except the listed fields

AttachSignatureFieldLock rejects empty names, duplicate names, invalid action values, an incompatible Fields shape, an unsigned target field, or a field that already carries a lock or FieldMDP policy

Emitted structure

The certification signature carries a direct /Reference array containing a direct DocMDP signature-reference dictionary and direct transform parameters
The Catalog /Perms /DocMDP entry points to the same indirect signature dictionary
The field /Lock entry points to an indirect /Type /SigFieldLock dictionary
The lock scope is copied into a direct FieldMDP signature reference and its /Data entry points to the indirect Catalog root
The signature dictionary marks transform references as critical through /V 1

Delphi example

var
  LockedFields: THPDFAnsiStringArray;
begin
  HotPDF.CurrentPage.AddTextField(
    'InternalCode', '', Rect(40, 80, 220, 108));
  HotPDF.CurrentPage.AddCertificationSignatureField(
    'CertSig', Rect(40, 140, 260, 190),
    dmpFormFillAndSign, 8192,
    'adbe.pkcs7.detached', 'Document approval');
  SetLength(LockedFields, 1);
  LockedFields[0] := 'InternalCode';
  HotPDF.CurrentPage.AttachSignatureFieldLock(
    'CertSig', flaInclude, LockedFields);
end;

Loaded inspection

function GetLoadedSignaturePermissions(
  SigIndex: Integer;
  out Info: THPDFSignaturePermissionInfo): Boolean;

The reader reports DocMDP permission, Catalog linkage, SigFieldLock scope, FieldMDP scope, field names, structural validity, and a diagnostic issue string

It verifies the required direct and indirect object shapes and confirms that Catalog /Perms /DocMDP targets the same signature dictionary/P 2 default

If both SigFieldLock and FieldMDP are present, their actions and field lists must agree

Identity scope traversal is cycle-safe and bounded to 64 levels and 100000 indirect objects, while inspection never executes JavaScript, actions, or signature content

Standard transform coverage

Method	Reported policy
`DocMDP`	Certification permission and matching Catalogue `/Perms /DocMDP` target
`UR`	Document, annotation, form, signature, and embedded-file rights plus legacy `/UR` or byte-range `/UR3` source
`FieldMDP`	All, Include, or Exclude field-lock scope and copied SigFieldLock agreement
`Identity`	Cycle-safe transitive object numbers reachable from the required indirect `/Data` root

Unknown method names are retained in UnknownTransformMethods and make the permission structure invalid so a critical transform cannot be overlooked

Validation boundary

GetLoadedSignaturePermissions reports policy structure only

VerifyLoadedSignature continues to report cryptographic integrity separately

Neither method claims that every later incremental revision obeys the reported DocMDP or FieldMDP permission, because that requires revision-by-revision semantic change analysisAnalyzeLoadedSignatureRevisions performs revision-by-revision semantic change analysis for byte-range DocMDP, FieldMDP, UR3, and Identity policies, while deprecated non-byte-range UR object-digest signatures remain available to structural inspection

SaveIncrementalUpdateAuthenticated turns inspection into enforcement: it reads policies from their signed snapshots, authenticates the controlling signatures, validates all later revisions, and publishes through atomic replacement only after every policy succeeds

Performance

Producer validation scans only authored AcroForm fields and the small signature-reference array, whilst loaded inspection reads only the selected signature, its lock, its references, and the Catalog permission entry

No page content, image stream, font programme, or unrelated indirect object is decoded