Windows Signing Timestamps
The Windows sign operation can request a genuine RFC3161 timestamp through a synchronous application callback and publish the PDF only after authenticating the response
Signing options
{"schemaVersion":1,"type":"sign","incremental":true,
"existingField":true,"fieldName":"ApprovalOne",
"pfxFile":"C:/keys/signer.pfx","pfxPassword":"password",
"cades":true,"digestMethod":"SHA384","timestamp":true,
"timestampURL":"https://tsa.example/service",
"timestampTrustedCAFile":"C:/trust/tsa-roots.pem",
"timestampTrustedCRLFile":"C:/trust/tsa-crls.pem",
"requireTimestampRevocation":true}timestamp defaults to false; a true value requires the application transport callback and an explicit timestampTrustedCAFile containing trusted PEM certificate roots
digestMethod selects the actual document CMS digest and timestamp imprint algorithm from SHA256, SHA384, or SHA512; the messageImprint hashes the actual CMS signature octets exactly once
timestampTrustedCRLFile optionally supplies PEM CRLs; requireTimestampRevocation requires that file and enables issuer and certificate CRL checks, including revoked certificates and expired evidence
Trust input files remain open with write sharing denied during signing and their combined size is limited to one eighth of memoryBytes before OpenSSL loads them
Each request contains a fresh cryptographic nonce and requests TSA certificates; response validation authenticates the request nonce, imprint, complete CMS signature, ESS signing-certificate binding, certificate chain, and critical timestamp EKU
C ABI transport
Pass hpdf_signing_operation_v1 to hpdf_document_execute_json_v1, set operation.struct_size to sizeof(hpdf_signing_operation_v1), and provide timestamp_transport and timestamp_user_data
The operation prefix retains the existing hpdf_operation_v1 layout and ABI version; ordinary operations continue to use the original structure
The callback receives the complete DER TimeStampReq and a borrowed response_io; write the complete DER TimeStampResp through response_io.write and return an hpdf_status
The callback runs on the calling thread, and request and response IO pointers remain valid only during that invocation; the application owns network transport, authentication, timeout, and connection policy
response_io.is_cancelled polls the operation input, output, and result cancellation callbacks; response writes enforce a 16 MiB maximum additionally capped at one eighth of memoryBytes before copying callback memory
A response write or cancellation failure remains active for the operation even when the callback subsequently returns success; failed responses cannot publish PDF bytes
Pascal service entry
THPDFJobProcessor.ExecuteLoadedSigningOperation accepts the loaded document, operation JSON object, output stream, checkpoint, THPDFHeadlessTimestampTransport callback, and opaque callback context
The Pascal transport receives request DER and returns response DER; nested synchronous signing restores the enclosing callback context when the inner operation returns
Seed values and provenance
A required SV TimeStamp constraint is satisfied by an actual authenticated response; when the required TimeStamp dictionary specifies a URL, timestampURL must match that value
timestampURL is application-asserted transport provenance; comparing the declared URL does not establish HTTPS server identity, and the application must authenticate its selected endpoint
Standalone file jobs without an application callback cannot perform a timestamp request; a URL string alone cannot satisfy a required timestamp