THPDFHeadlessDocument.SignPFXToFile

function SignPFXToFile(FieldIndex: Integer; const FileName: string;
  const PFX: SysUtils.TBytes; const Password: UnicodeString;
  const Options: THPDFHeadlessCMSOptions;
  ReservedCMSBytes: Integer = 16384): THPDFHeadlessCMSResult;

Loads a password-protected PKCS12 certificate/key identity with OpenSSL 3 and signs through the shared incremental PDF writer

Password is encoded as UTF-8 and must contain no NUL; malformed DER, trailing bytes, incorrect passwords, absent matching identities, and byte-budget failures publish no output

The identity certificate and additional chain certificates are included in CMS; temporary private-key PEM and password buffers are cleared after use

AES-256 R5/R6 passwords and source prefixes, source alias protection, atomic publication, CAdES, and DocMDP certification options follow SignToFile

Timestamps, revocation conclusions, and long-term validation are separate capabilities