THotPDF.SignPDFWithPFX Method

THotPDF.SignPDFWithPFX

Signs an existing PDF placeholder using a PFX / PKCS#12 file, building a CMS SignedData container and writing the signed PDF in one call.

Delphi syntax (file overload):

class function SignPDFWithPFX(

const InputPDFPath: string;

const OutputPDFPath: string;

const PFXFilePath: string;

const Password: AnsiString): boolean; overload; static;

Delphi syntax (stream overload):

class function SignPDFWithPFX(

InputStream: TStream;

OutputStream: TStream;

const PFXFilePath: string;

const Password: AnsiString): boolean; overload; static;

Опис

SignPDFWithPFX - end-to-end entry point для підписання PFX, доданий у v2.119.27 Input PDF вже має містити signature placeholder, emitted by THPDFPage.AddSignedSignatureField (або його PAdES wrapper), із subFilter adbe.pkcs7.detached Метод виконує такі кроки:

1. Завантажує input PDF, знаходить sentinel placeholders /ByteRange + /Contents і patches /ByteRange фактичними byte offsets

2. Завантажує PFX file і decrypts його supplied password Підтримується PBES2 з PBKDF2-HMAC-SHA-256 + AES-256-CBC (default для PFX files, exported by OpenSSL 3.0+, Windows 11+ certutil і macOS Keychain Access) Legacy PBE-SHA1-3DES files raise diagnostic; re-export with openssl pkcs12 -export ... -keypbe AES-256-CBC -certpbe AES-256-CBC

3. Обчислює SHA-256 над document bytes, covered by /ByteRange, і builds CMS SignedData (RFC 5652) DER blob із X.509 certificate, signed attributes (contentType + messageDigest + signingTime) і RSA + SHA-256 signature над SET-tagged signed attributes

4. Hex-encodes CMS DER, verifies that it fits /Contents budget, reserved by AddSignedSignatureField (default 8 KB covers 1024 / 2048-bit RSA), і injects it into placeholder

5. Writes the patched bytes to the output path or stream.

Returns True on success. Raises EHPDFPFXError on a bad password, unsupported encryption profile, or malformed PFX; EHPDFCMSError when the input PDF lacks the expected placeholder or the CMS DER overflows the reserved /Contents budget; EHPDFRSAError on RSA key mismatch.

Typical workflow

Doc := THotPDF.Create(nil);

Doc.FileName := 'unsigned.pdf';

Doc.BeginDoc;

Doc.CurrentPage.AddSignedSignatureField(

'Sig1', Rect(60, 60, 260, 90), 8192,

'adbe.pkcs7.detached', 'Approved', 'Brussels', '', []);

Doc.EndDoc;

Doc.Free;

THotPDF.SignPDFWithPFX('unsigned.pdf', 'signed.pdf', 'mykey.pfx', 'mypassword');

Notes

Signature algorithm - RSA + SHA-256 (1.2.840.113549.1.1.1 + 2.16.840.1.101.3.4.2.1) Signer identifier - IssuerAndSerialNumber, extracted from X.509 certificate encapContentInfo є detached (eContent omitted) Signed attributes sorted by ascending DER byte string per RFC 5652 §5.4 before hashing

Для PAdES B-T / B-LT / B-LTA workflows, яким потрібні RFC 3161 timestamps, DSS dictionaries або document timestamp signatures, producer-side helpers (AddPAdESSignatureField, AddPAdESDSSCertificate, AddDocumentTimestampSignature) still apply; SignPDFWithPFX itself emits basic CMS-only signature (PAdES-B-B equivalent)