|
Verifies PDF signature integrity and validates the signer certificate against an explicit offline trust policy
Delphi syntax:
function VerifyLoadedSignatureWithTrust(SigIndex: Integer; Source: TStream; const Options: THPDFCertificateValidationOptions; out Info: THPDFSignatureInfo): THPDFCertificateValidationStatus; overload;
function VerifyLoadedSignatureWithTrust(SigIndex: Integer; const Options: THPDFCertificateValidationOptions; out Info: THPDFSignatureInfo): THPDFCertificateValidationStatus; overload;
Description
TrustAnchors is mandatory and remains fully caller-controlled; HotPDF never falls back to an operating-system trust store or network retrieval
The path builder combines the CMS certificate set, PDF DSS and VRI certificates, and IntermediateCertificates, then verifies certificate signatures, validity periods, Basic Constraints, path-length constraints, and Key Usage
RevocationMode selects no checking, best-effort checking, or required evidence; OCSP processing supports nonce policies, delegated responders, id-pkix-ocsp-extended-revoke, configurable freshness, and optional nextUpdate requirements
CRL processing supports base and delta pairing, freshestCRL, removeFromCRL, indirect CRL signers, per-entry certificate issuers, source precedence, and configurable freshness limits
Name constraints are enforced for DNS, email, URI, IP, and directory-name subtrees; certificate-policy processing covers initial policy sets, mappings, explicit-policy requirements, and inhibitAnyPolicy
TrustPurpose can remain unrestricted or select document signing, code signing, email protection, timestamping, OCSP signing, or the dotted EKU OID in CustomTrustPurposeOID; a restrictive leaf EKU must contain the selected purpose or anyExtendedKeyUsage
AlgorithmPolicy applies minimum RSA and elliptic-curve strengths plus evaluation-time SHA-1 and RSA PKCS#1 v1.5 sunset rules without reclassifying signatures that were valid at an earlier validation time
Per-signature VRI evidence has first priority, followed by document-level DSS evidence, caller evidence, and CMS CRLs
The return value reports certificate trust independently from Info.Status, which keeps the established cryptographic svValid meaning
Info.CertificateValidation reports the path length, trust-anchor subject, evaluation time, selected trust purpose and OID, revocation status and source, evidence timestamps, base and delta CRL numbers, effective policies, weakest accepted key strengths, and an actionable issue message
See also: VerifyLoadedSignature, GetLoadedSignatureInfo, CMS validation reports
|