THotPDF.GetLoadedSignatureQCStatements Method

Declaration

function GetLoadedSignatureQCStatements(SigIndex: Integer;
  out Info: THPDFQCStatementInfo): boolean;

Behavior

eIDAS qualified-certificate evaluation of one loaded signature: reports the ETSI EN 319 412-5 QCStatements of the signer certificate, including QcCompliance, QcSSCD, the QcType values, QcLimitValue, and the PDS locations, plus the ETSI TS 119 495 PSD2 statement

PSD2 statement

The PSD2 QCStatement (0.4.0.19495.2) carries a PSD2QcType: the roles the payment service provider is authorized for, the name of the national competent authority (NCA), and the NCA identifier. It is reported through these fields of THPDFQCStatementInfo:

HasPSD2Statement is true only when the certificate carries a well-formed PSD2 statement; a statement with overrunning or non-minimal lengths, missing or extra components, wrong tags, or names that are not 1 to 256 characters of valid UTF-8 is ignored and leaves the PSD2 fields empty
PSD2RolesOfPSP lists every role in certificate order as a THPDFPSD2Role with OID (0.4.0.19495.1.1 PSP_AS, 0.4.0.19495.1.2 PSP_PI, 0.4.0.19495.1.3 PSP_AI, 0.4.0.19495.1.4 PSP_IC) and Name, the role name stored in the certificate, such as PSP_AS
PSD2NCAName and PSD2NCAId hold the NCA name and identifier, for example CZ-CNB
PSD2RolesPayer and PSD2RolesPayee are deprecated and always empty, because ETSI TS 119 495 defines no payer and payee role lists; read PSD2RolesOfPSP instead

To parse a PSD2QcType you already hold as DER, call HPDFParsePSD2QcStatement from the HPDFSignVerify unit. It fills a THPDFPSD2QcStatement and returns false for any malformed input

var
  Info: THPDFQCStatementInfo;
  I: Integer;
begin
  if HotPDF1.GetLoadedSignatureQCStatements(0, Info) and Info.HasPSD2Statement then
  begin
    for I:= 0 to High(Info.PSD2RolesOfPSP) do
      Writeln(Info.PSD2RolesOfPSP[I].Name, ' (', Info.PSD2RolesOfPSP[I].OID, ')');
    Writeln('NCA: ', Info.PSD2NCAName, ' / ', Info.PSD2NCAId);
  end;
end;

Qualified signature heuristic

QualifiedSignatureLikely marks the eIDAS 910/2014 Annex IV heuristic of QcCompliance plus QcSSCD; a false value is not proof of a non-qualified signature, because the QTSP service trust decision stays with the caller. Returns false when the signature carries no usable certificate