THPDFSignatureInfo Record
Describes a single loaded PDF signature, from certificate identities via byte-range coverage through to the verification verdict
Declaration
THPDFSignatureInfo= record
FieldName: AnsiString; // signature form field partial name
SubFilter: AnsiString; // /SubFilter of the signature dictionary
SignerName: AnsiString; // CN of the signer certificate subject
SubjectDN: AnsiString; // rendered subject distinguished name
IssuerDN: AnsiString; // rendered issuer distinguished name
SerialNumberHex: AnsiString; // certificate serial number, hex encoded
ValidFrom: TDateTime; // certificate notBefore (0 when absent)
ValidTo: TDateTime; // certificate notAfter (0 when absent)
SigningTime: TDateTime; // signed attribute 1.2.840.113549.1.9.5,
// else the /M entry, else 0
HashAlgorithm: AnsiString; // SHA-1, SHA-2, SHA-3, or SHAKE256
DigestAlgorithmOID: AnsiString;
DigestConsistencyIssue: THPDFCMSDigestConsistencyIssue;
SignaturePolicy: THPDFSignaturePolicyInfo;
Reason: AnsiString; // /Reason from the signature dictionary
Location: AnsiString; // /Location
ContactInfo: AnsiString; // /ContactInfo
ByteRange: array of Int64; // /ByteRange pairs (offset, length, ...)
CoversWholeDocument: boolean; // ByteRange spans the file except /Contents
SignedRevisionLength: Int64; // source prefix covered by this signature
UnsignedTrailingBytes: Int64; // bytes appended after the signed revision
CertificateTimeValidity: THPDFSignatureTimeValidity;
Status: THPDFSignatureVerifyStatus;
PublicKeyAlgorithm: AnsiString; // RSA, ECDSA, EdDSA, or ML-DSA
SignatureAlgorithm: AnsiString; // CMS signature algorithm name
SignatureAlgorithmOID: AnsiString;
CurveName: AnsiString; // ECDSA curve, such as 'P-256'
Timestamp: THPDFTimestampInfo; // RFC 3161 signature or document timestamp
CMSAttributes: THPDFCMSAttributeSummary;
CertificateValidation: THPDFCertificateValidationInfo;
end;Unit
HPDFSignVerify
Fields
| Field | Purpose |
|---|---|
FieldName | Partially qualified name of the signature form field |
SubFilter | Contents of the /SubFilter entry in the signature dictionary |
SignerName | CN taken from the signer certificate subject |
SubjectDN | Rendered subject distinguished name for the certificate |
IssuerDN | Rendered issuer distinguished name for the certificate |
SerialNumberHex | Certificate serial number, encoded in hex |
ValidFrom | Certificate notBefore; 0 where absent |
ValidTo | Certificate notAfter; 0 where absent |
SigningTime | Signed attribute 1.2.840.113549.1.9.5, otherwise the /M entry, otherwise 0 |
HashAlgorithm | Digest family name: SHA-1, SHA-2, SHA-3 or SHAKE256 |
DigestAlgorithmOID | Object identifier of the digest algorithm |
DigestConsistencyIssue | A mismatch found between digest algorithms within the CMS structure |
SignaturePolicy | Signature policy details where the signature carries a policy |
Reason | Contents of the /Reason entry |
Location | Contents of the /Location entry |
ContactInfo | Contents of the /ContactInfo entry |
ByteRange | /ByteRange offset and length pairs describing the byte intervals that are covered |
CoversWholeDocument | True where the byte range spans the whole file apart from the /Contents gap |
SignedRevisionLength | Length of the source prefix that this signature covers |
UnsignedTrailingBytes | Bytes that were appended after the signed revision |
CertificateTimeValidity | Whether the signing time falls within the certificate validity window |
Status | Verification verdict, of type THPDFSignatureVerifyStatus |
PublicKeyAlgorithm | Public key family: RSA, ECDSA, EdDSA or ML-DSA |
SignatureAlgorithm | Name of the CMS signature algorithm |
SignatureAlgorithmOID | Object identifier of the signature algorithm |
CurveName | ECDSA curve name, for instance P-256 |
Timestamp | Details of the RFC 3161 signature or document timestamp |
CMSAttributes | Summary of the CMS attributes that were signed |
CertificateValidation | Outcome of the certificate chain validation |
Usage notes
GetLoadedSignatureInforeturns the descriptive fields, whilstVerifyLoadedSignatureandVerifyLoadedSignatureExfill in the status and validation fields once the digests have been checkedCoversWholeDocumenttogether withUnsignedTrailingBytesreveals whether later revisions altered the document after signing- The same record feeds certificate validation, so a single call covers identities, coverage, algorithms and chain checks