Certification Signatures and Field Locks

HotPDF can author the PDF permission structures attached to certification signatures and signed field locks, then inspect the same structures in a loaded document

Producer API

procedure AddCertificationSignatureField(
  const FieldName: AnsiString;
  Rectangle: TRect;
  Permission: THPDFDocMDPPermission;
  ContentsBytes: Integer = 8192;
  const SubFilter: AnsiString = 'adbe.pkcs7.detached';
  const Reason: AnsiString = '';
  const Location: AnsiString = '';
  const ContactName: AnsiString = '';
  Flags: THPDFFormFieldFlags = []);

procedure ConfigureCertificationSignature(
  const FieldName: AnsiString;
  Permission: THPDFDocMDPPermission);

procedure AttachSignatureFieldLock(
  const FieldName: AnsiString;
  Action: THPDFFieldLockAction;
  const Fields: array of AnsiString);

AddCertificationSignatureField combines signed-placeholder creation with certification configuration

ConfigureCertificationSignature is for an existing authored signed placeholder and requires that field to be the first field carrying a signature dictionary

A document can contain only one certification signature, so a second configuration request is rejected before the object graph is changed

These APIs negotiate PDF 1.5 output automatically

DocMDP permission levels

Value	Certification permission
`dmpNoChanges`	No changes are permitted after certification
`dmpFormFillAndSign`	Form filling, template instantiation, and signing are permitted
`dmpFormFillSignAndAnnotate`	The preceding changes plus annotation creation, deletion, and modification are permitted

dmpNone is reserved for inspection results without a DocMDP transform and is rejected by producer methods

Field-lock scopes

Value	Fields argument	Effect after signing
`flaAll`	Must be empty	Locks every form field
`flaInclude`	One or more unique field names	Locks only the listed fields
`flaExclude`	One or more unique field names	Locks every field except the listed fields

AttachSignatureFieldLock rejects empty names, duplicate names, invalid action values, an incompatible Fields shape, an unsigned target field, or a field that already carries a lock or FieldMDP policy

Emitted structure

The certification signature carries a direct /Reference array containing a direct DocMDP signature-reference dictionary and direct transform parameters
The Catalog /Perms /DocMDP entry points to the same indirect signature dictionary
The field /Lock entry points to an indirect /Type /SigFieldLock dictionary
The lock scope is copied into a direct FieldMDP signature reference and its /Data entry points to the indirect Catalog root
The signature dictionary marks transform references as critical through /V 1

Delphi example

var
  LockedFields: THPDFAnsiStringArray;
begin
  HotPDF.CurrentPage.AddTextField(
    'InternalCode', '', Rect(40, 80, 220, 108));

  HotPDF.CurrentPage.AddCertificationSignatureField(
    'CertSig', Rect(40, 140, 260, 190),
    dmpFormFillAndSign, 8192,
    'adbe.pkcs7.detached', 'Document approval');

  SetLength(LockedFields, 1);
  LockedFields[0] := 'InternalCode';
  HotPDF.CurrentPage.AttachSignatureFieldLock(
    'CertSig', flaInclude, LockedFields);
end;

Loaded inspection

function GetLoadedSignaturePermissions(
  SigIndex: Integer;
  out Info: THPDFSignaturePermissionInfo): Boolean;

The reader reports DocMDP permission, Catalog linkage, SigFieldLock scope, FieldMDP scope, field names, structural validity, and a diagnostic issue string

It verifies the required direct and indirect object shapes and confirms that Catalog /Perms /DocMDP targets the same signature dictionary

If both SigFieldLock and FieldMDP are present, their actions and field lists must agree

The reader performs bounded dictionary and array inspection and does not execute JavaScript, actions, or signature content

Validation boundary

GetLoadedSignaturePermissions reports policy structure only

VerifyLoadedSignature continues to report cryptographic integrity separately

Neither method claims that every later incremental revision obeys the reported DocMDP or FieldMDP permission, because that requires revision-by-revision semantic change analysis

Performance

Producer validation scans only authored AcroForm fields and the small signature-reference array, while loaded inspection reads only the selected signature, its lock, its references, and the Catalog permission entry

No page content, image stream, font program, or unrelated indirect object is decoded