THPDFCertificateValidationOptions Record

Configures trust anchors, offline revocation evidence, policy constraints, and algorithm limits for certificate path validation

Declaration

THPDFCertificateValidationOptions= record
  TrustAnchors: THPDFDERArray;
  IntermediateCertificates: THPDFDERArray;
  OCSPResponses: THPDFDERArray;
  CRLs: THPDFDERArray;
  DeltaCRLs: THPDFDERArray;
  CRLIssuerCertificates: THPDFDERArray;
  OCSPResponseSources: THPDFValidationEvidenceSourceArray;
  CRLSources: THPDFValidationEvidenceSourceArray;
  DeltaCRLSources: THPDFValidationEvidenceSourceArray;
  RevocationMode: THPDFRevocationMode;
  ValidationTime: TDateTime;
  MaxPathLength: Integer;
  OCSPNoncePolicy: THPDFOCSPNoncePolicy;
  ExpectedOCSPNonce: TBytes;
  OCSPMaxAgeDays: Double;
  OCSPAllowedClockSkewMinutes: Integer;
  RequireOCSPNextUpdate: boolean;
  AllowDelegatedOCSPResponders: boolean;
  RequireOCSPNoCheckForDelegated: boolean;
  CRLMaxAgeDays: Double;
  CRLAllowedClockSkewMinutes: Integer;
  RequireCRLNextUpdate: boolean;
  AllowIndirectCRLs: boolean;
  RequireDeltaCRLWhenAdvertised: boolean;
  TrustPurpose: THPDFCertificateTrustPurpose;
  CustomTrustPurposeOID: AnsiString;
  InitialPolicySet: THPDFOIDArray;
  RequireExplicitCertificatePolicy: boolean;
  InhibitCertificatePolicyMapping: boolean;
  InhibitAnyCertificatePolicy: boolean;
  AlgorithmPolicy: THPDFCertificateAlgorithmPolicy;
  // v2.738.0 online chain building: when the path cannot close with
  // the supplied pool, fetch the missing intermediates through the
  // AIA caIssuers URLs of the leaf-most unmatched certificate before
  // failing with cvsPathBuildingFailed (transport stays caller-side)
  FetchMissingIntermediates: boolean;
  MaxFetchedIntermediates: Integer;
  class function Default: THPDFCertificateValidationOptions; static;
end;

Unit

HPDFSignVerify

Fields

Field	Purpose
`TrustAnchors`	DER-encoded trust anchor certificates allowed to close the path
`IntermediateCertificates`	Extra untrusted certificates the builder may use when the CMS pool is incomplete
`OCSPResponses` / `CRLs` / `DeltaCRLs`	Offline pools of OCSP responses, base CRLs, and delta CRLs
`CRLIssuerCertificates`	Certificates used to verify CRL signer signatures
`OCSPResponseSources` / `CRLSources` / `DeltaCRLSources`	Evidence source tag recorded for each pooled item, surfaced on the validation info
`RevocationMode`	Selects `rvmNone`, `rvmBestEffort`, or `rvmRequire` revocation behavior
`ValidationTime`	Time the validity and freshness checks are evaluated at
`MaxPathLength`	Maximum number of certificates between leaf and trust anchor; `Default` sets 12
`OCSPNoncePolicy`	Whether OCSP nonces are required, matched when present, or ignored; `Default` matches when present
`ExpectedOCSPNonce`	Exact nonce bytes to demand when the policy requires one
`OCSPMaxAgeDays` / `CRLMaxAgeDays`	Maximum accepted age of OCSP responses and CRLs; `Default` sets 7 and 30 days
`OCSPAllowedClockSkewMinutes` / `CRLAllowedClockSkewMinutes`	Clock tolerance applied to evidence timestamps; `Default` sets 5 minutes each
`RequireOCSPNextUpdate` / `RequireCRLNextUpdate`	Reject evidence that carries no next-update field
`AllowDelegatedOCSPResponders`	Accept responses signed by delegated responders; `Default` allows them
`RequireOCSPNoCheckForDelegated`	Demand the OCSPNoCheck extension on delegated responder certificates
`AllowIndirectCRLs`	Accept CRLs issued by an indirect CRL signer; `Default` allows them
`RequireDeltaCRLWhenAdvertised`	Fail when a delta CRL pointer is advertised but no delta CRL was supplied
`TrustPurpose` / `CustomTrustPurposeOID`	Required certificate purpose for the trust anchor; `Default` accepts any purpose
`InitialPolicySet`	Certificate policy OIDs the validated path must satisfy
`RequireExplicitCertificatePolicy`	Demand at least one explicit certificate policy in the path
`InhibitCertificatePolicyMapping`	Disable certificate policy mapping processing
`InhibitAnyCertificatePolicy`	Exclude the anyPolicy qualifier from policy processing
`AlgorithmPolicy`	Key size and algorithm limits applied to every certificate and signature in the path
`FetchMissingIntermediates`	Fetch missing intermediates through AIA caIssuers URLs before failing with `cvsPathBuildingFailed`; the transport stays caller-side
`MaxFetchedIntermediates`	Cap on how many intermediates one validation may fetch through AIA
`Default`	Class function returning the built-in configuration summarized above

Usage notes

Start from THPDFCertificateValidationOptions.Default and override only what your policy needs, so freshness windows and trust purpose match library defaults
The library never opens sockets: supply evidence through the pools, or use the online validation variant with a caller-side transport when FetchMissingIntermediates needs to fetch
The source arrays pair one-to-one with the evidence pools, letting reports attribute each revocation verdict to its origin

THPDFCertificateValidationOptions Record

Declaration

Unit

Fields

Usage notes

Related APIs