HPDFVerifyHeadlessCMS

HPDFHeadlessCMS verifies detached CMS signatures against a caller-owned TStream using OpenSSL 3 and the shared signature ByteRange validator

function HPDFVerifyHeadlessCMS(Source: TStream;
  const ByteRange: array of Int64; const CMSDER: SysUtils.TBytes;
  const Options: THPDFHeadlessCMSOptions): THPDFHeadlessCMSResult;

A two-element range must cover the complete stream; a four-element range starts at zero and excludes one nonempty interval, with ordered, bounded pairs and overflow-safe arithmetic

CMS must contain detached content and at least one signer; the verifier authenticates the content digest, signed attributes, and every signer without whole-source aggregation, accepts trailing zero padding, and rejects nonzero trailing CMS data

Source ownership remains with the caller, its position is restored, and the caller must provide exclusive serial access during verification

SignatureValid describes cryptographic integrity; certificate trust is evaluated separately only when TrustedCAFile supplies explicit PEM trust anchors

RequireCAdES requires an authenticated ESS v1 or v2 signing-certificate binding; its certificate hash and optional issuer and serial number must identify the actual signer, independently of certificate trust

Existing ESS attributes are checked even when RequireCAdES is false; duplicate attributes, multiple values, malformed sequences, and trailing ASN.1 bytes are rejected, while explicit trust anchors enable a separate certificate-chain verification pass

The function validates the numerical ranges but does not bind an excluded gap to a PDF Contents token; use THPDFHeadlessDocument.VerifySignature for that document-level check

The loader uses HOTPDF_OPENSSL_LIBRARY when set, otherwise libcrypto.so.3 on Linux or libcrypto-3.dll on Windows; the runtime library must match the process architecture, and the first successfully loaded library remains active until unit finalization

Malformed CMS, budgets, missing runtime symbols, source-read failures, and cancellation raise EHPDFHeadlessCMSError; invalid signatures and untrusted certificate chains return explicit false result fields with OpenSSL details

This function does not fetch revocation evidence, trust anchors, timestamps, or remote certificate data and does not establish a historical signing time