|
Verifies PDF signature integrity and validates the signer certificate against an explicit offline trust policy
Delphi syntax:
function VerifyLoadedSignatureWithTrust(SigIndex: Integer; Source: TStream; const Options: THPDFCertificateValidationOptions; out Info: THPDFSignatureInfo): THPDFCertificateValidationStatus; overload;
function VerifyLoadedSignatureWithTrust(SigIndex: Integer; const Options: THPDFCertificateValidationOptions; out Info: THPDFSignatureInfo): THPDFCertificateValidationStatus; overload;
Description
TrustAnchors is mandatory and remains fully caller-controlled; HotPDF never falls back to an operating-system trust store or network retrieval
The path builder combines the CMS certificate set, PDF DSS and VRI certificates, and IntermediateCertificates, then verifies certificate signatures, validity periods, Basic Constraints, path-length constraints, and Key Usage
RevocationMode selects no checking, best-effort checking, or required evidence; OCSP and CRL responses are validated cryptographically and checked for issuer, serial number, responder authority, and freshnessid-pkix-ocsp-extended-revoke, configurable freshness, and optional nextUpdate requirements
CRL processing supports base and delta pairing, freshestCRL, removeFromCRL, indirect CRL signers, per-entry certificate issuers, source precedence, and configurable freshness limits
Name constraints are enforced for DNS, email, URI, IP, and directory-name subtrees; certificate-policy processing covers initial policy sets, mappings, explicit-policy requirements, and inhibitAnyPolicy
TrustPurpose can remain unrestricted or select document signing, code signing, email protection, timestamping, OCSP signing, or the dotted EKU OID in CustomTrustPurposeOID; a restrictive leaf EKU must contain the selected purpose or anyExtendedKeyUsage
AlgorithmPolicy applies minimum RSA and elliptic-curve strengths plus evaluation-time SHA-1 and RSA PKCS#1 v1.5 sunset rules without reclassifying signatures that were valid at an earlier validation time
Per-signature VRI evidence has first priority, followed by document-level DSS evidence, caller evidence, and CMS CRLs
The return value reports certificate trust independently from Info.Status, which keeps the established cryptographic svValid meaning
Info.CertificateValidation reports the path length, trust-anchor subject, evaluation time, revocation status and source, revocation time, and an actionable issue message
See also: VerifyLoadedSignature, GetLoadedSignatureInfo
|