THPDFCertificateValidationInfo Record

Collects the certificate path verdict with revocation, trust, policy and algorithm diagnostics for one signer

Declaration

THPDFCertificateValidationInfo= record
  Status: THPDFCertificateValidationStatus;
  RevocationStatus: THPDFRevocationStatus;
  RevocationSource: THPDFValidationEvidenceSource;
  ChainLength: Integer;
  EvaluationTime: TDateTime;
  TrustAnchorSubjectDN: AnsiString;
  RevokedAt: TDateTime;
  EvidenceThisUpdate: TDateTime;
  EvidenceNextUpdate: TDateTime;
  EvidenceProducedAt: TDateTime;
  OCSPNoncePresent: boolean;
  OCSPNonceMatched: boolean;
  OCSPExtendedRevoke: boolean;
  UsedDelegatedOCSPResponder: boolean;
  UsedDeltaCRL: boolean;
  UsedIndirectCRLSigner: boolean;
  HasBaseCRLNumber: boolean;
  HasDeltaCRLNumber: boolean;
  BaseCRLNumber: Int64;
  DeltaCRLNumber: Int64;
  DeltaCRLSource: THPDFValidationEvidenceSource;
  EffectiveCertificatePolicies: THPDFOIDArray;
  CertificatePolicyMappingApplied: boolean;
  TrustPurpose: THPDFCertificateTrustPurpose;
  TrustPurposeOID: AnsiString;
  WeakestRSAKeyBits: Integer;
  WeakestECDSACurveBits: Integer;
  UsedSHA1CertificateSignature: boolean;
  AlgorithmConstraintIssue: AnsiString;
  Issue: AnsiString;
end;

Unit

HPDFSignVerify

Fields

Field	Purpose
`Status`	Overall `THPDFCertificateValidationStatus` verdict for the path evaluation
`RevocationStatus`	Revocation verdict for the evaluated certificate
`RevocationSource`	Which evidence source supplied the revocation verdict
`ChainLength`	Number of certificates in the validated path
`EvaluationTime`	Time the validity and revocation checks were evaluated against
`TrustAnchorSubjectDN`	Subject DN of the trust anchor that closed the path
`RevokedAt`	Revocation time reported by the evidence
`EvidenceThisUpdate`	This-update time taken from the consumed CRL or OCSP response
`EvidenceNextUpdate`	Next-update time taken from the consumed CRL or OCSP response
`EvidenceProducedAt`	Produced-at time of the consumed OCSP response
`OCSPNoncePresent`	True when the OCSP response carried a nonce
`OCSPNonceMatched`	True when the response nonce matched the expected request nonce
`OCSPExtendedRevoke`	True when the OCSP response used the extended revoked definition
`UsedDelegatedOCSPResponder`	True when the response came from a delegated OCSP responder
`UsedDeltaCRL`	True when a delta CRL contributed to the revocation verdict
`UsedIndirectCRLSigner`	True when the CRL was signed by an indirect CRL signer
`HasBaseCRLNumber` / `BaseCRLNumber`	Presence and value of the consumed base CRL's CRL number
`HasDeltaCRLNumber` / `DeltaCRLNumber`	Presence and value of the consumed delta CRL's CRL number
`DeltaCRLSource`	Evidence source that supplied the delta CRL
`EffectiveCertificatePolicies`	Certificate policy OIDs in force after policy mapping and qualifier processing
`CertificatePolicyMappingApplied`	True when a certificate policy mapping was applied while walking the path
`TrustPurpose` / `TrustPurposeOID`	Configured trust purpose and its OID form
`WeakestRSAKeyBits`	Smallest RSA key size encountered in the path
`WeakestECDSACurveBits`	Smallest ECDSA curve size encountered in the path
`UsedSHA1CertificateSignature`	True when any certificate in the path was signed with SHA-1
`AlgorithmConstraintIssue`	Description of the algorithm policy violation, empty when none
`Issue`	Free-text diagnostic for the failure, empty for a trusted path

Usage notes

The record attaches to THPDFSignatureInfo.CertificateValidation after HPDFValidateCMSCertificatePath or the online variant runs
Status is the single verdict; the remaining fields explain how that verdict was reached, so surface them in verification reports
WeakestRSAKeyBits, WeakestECDSACurveBits, and AlgorithmConstraintIssue expose why an algorithm policy rejected an otherwise valid path

THPDFCertificateValidationInfo Record

Declaration

Unit

Fields

Usage notes

Related APIs