THotPDF.SignPDFWithPFXAndAttachedPDFMAC Method

Creates one encrypted signed revision whose PDF MAC authenticates both the complete signature byte ranges and the raw CMS signature value

Declaration

class function SignPDFWithPFXAndAttachedPDFMAC(
  const InputPDFPath, OutputPDFPath, PFXFilePath: string;
  const PFXPassword, PDFPassword: AnsiString;
  const MACOptions: THPDFPDFMACOptions): boolean; static;

Input requirements

• The input must be encrypted with a supported AES-256 password security handler
• The input must contain exactly one unsigned signature dictionary created with AddSignedSignatureField
• The signature dictionary and its signature field must be direct xref objects so their fixed-width placeholders remain patchable
• The PFX file must contain supported RSA key material and the supplied PFX password must authenticate the container

Output guarantees

• The active trailer contains a direct AuthCode with /MACLocation /AttachedToSig and one indirect SigObjRef
• The CMS SignerInfo contains one id-attr-pdfMacData unsigned attribute
• PdfMacIntegrityInfo.signatureDigest carries the digest of the raw signature value alongside the document digest
• SHA-256 signing and the selected PDF MAC digest share one bounded-memory file scan
• The target path is replaced only after the complete signed output succeeds

Use ValidatePDFMAC to verify the active trailer, SigObjRef, signature field binding, complete byte-range coverage, document digest, signature digest, and MAC authentication