HPDFSignHeadlessCMS

function HPDFSignHeadlessCMS(Source: TStream;
  const ByteRange: array of Int64;
  const CertificatePEM, PrivateKeyPEM: SysUtils.TBytes;
  const Options: THPDFHeadlessCMSOptions): SysUtils.TBytes;

The function signs the declared source ranges with an explicit PEM certificate and unencrypted PEM private key using OpenSSL 3, returns DER CMS SignedData with detached content, and restores the caller-owned source position

The source is read incrementally through the same bounded BIO used by the verifier; PEM input and generated DER must fit MaxCMSBytes, and the signed ranges must fit MaxSignedBytes

RequireCAdES adds the ESS signing-certificate attribute during CMS generation; validate the result with an explicit trusted CA file when requiring CAdES verification

Private keys remain caller-owned byte arrays; the OpenSSL key object is freed after signing, and the function never prompts for a key password

Encrypted PEM keys, certificate/key mismatches, invalid ranges, cancellation, runtime errors, and output-limit failures raise EHPDFHeadlessCMSError

This primitive generates CMS only; it does not create a PDF signature field, reserve PDF Contents space, publish a signed PDF, or contact a timestamp or revocation service