THPDFCertificateValidationOptions 记录
为证书路径验证配置信任锚、离线吊销证据、策略约束和算法限制
声明
THPDFCertificateValidationOptions= record
TrustAnchors: THPDFDERArray;
IntermediateCertificates: THPDFDERArray;
OCSPResponses: THPDFDERArray;
CRLs: THPDFDERArray;
DeltaCRLs: THPDFDERArray;
CRLIssuerCertificates: THPDFDERArray;
OCSPResponseSources: THPDFValidationEvidenceSourceArray;
CRLSources: THPDFValidationEvidenceSourceArray;
DeltaCRLSources: THPDFValidationEvidenceSourceArray;
RevocationMode: THPDFRevocationMode;
ValidationTime: TDateTime;
MaxPathLength: Integer;
OCSPNoncePolicy: THPDFOCSPNoncePolicy;
ExpectedOCSPNonce: TBytes;
OCSPMaxAgeDays: Double;
OCSPAllowedClockSkewMinutes: Integer;
RequireOCSPNextUpdate: boolean;
AllowDelegatedOCSPResponders: boolean;
RequireOCSPNoCheckForDelegated: boolean;
CRLMaxAgeDays: Double;
CRLAllowedClockSkewMinutes: Integer;
RequireCRLNextUpdate: boolean;
AllowIndirectCRLs: boolean;
RequireDeltaCRLWhenAdvertised: boolean;
TrustPurpose: THPDFCertificateTrustPurpose;
CustomTrustPurposeOID: AnsiString;
InitialPolicySet: THPDFOIDArray;
RequireExplicitCertificatePolicy: boolean;
InhibitCertificatePolicyMapping: boolean;
InhibitAnyCertificatePolicy: boolean;
AlgorithmPolicy: THPDFCertificateAlgorithmPolicy;
// v2.738.0 online chain building: when the path cannot close with
// the supplied pool, fetch the missing intermediates through the
// AIA caIssuers URLs of the leaf-most unmatched certificate before
// failing with cvsPathBuildingFailed (transport stays caller-side)
FetchMissingIntermediates: boolean;
MaxFetchedIntermediates: Integer;
class function Default: THPDFCertificateValidationOptions; static;
end;单元
HPDFSignVerify
字段
| 字段 | 用途 |
|---|---|
TrustAnchors | 允许闭合路径的 DER 编码信任锚证书 |
IntermediateCertificates | CMS 证书池不完整时构建器可以使用的额外非受信证书 |
OCSPResponses / CRLs / DeltaCRLs | OCSP 响应、基本 CRL 和增量 CRL 的离线池 |
CRLIssuerCertificates | 用于验证 CRL 签名者签名的证书 |
OCSPResponseSources / CRLSources / DeltaCRLSources | 为池中每一项记录的证据来源标记，会呈现在验证信息上 |
RevocationMode | 选择 rvmNone、rvmBestEffort 或 rvmRequire 吊销行为 |
ValidationTime | 有效期与新鲜度检查所依据的时间 |
MaxPathLength | 叶子证书与信任锚之间的最大证书数；Default 设为 12 |
OCSPNoncePolicy | OCSP nonce 是必须存在、存在即比对还是忽略；Default 为存在即比对 |
ExpectedOCSPNonce | 策略要求 nonce 时必须精确匹配的 nonce 字节 |
OCSPMaxAgeDays / CRLMaxAgeDays | OCSP 响应和 CRL 可接受的最大年龄；Default 分别设为 7 天和 30 天 |
OCSPAllowedClockSkewMinutes / CRLAllowedClockSkewMinutes | 应用于证据时间戳的时钟容差；Default 各设为 5 分钟 |
RequireOCSPNextUpdate / RequireCRLNextUpdate | 拒绝不带下一次更新字段的证据 |
AllowDelegatedOCSPResponders | 接受由委托响应器签署的响应；Default 允许 |
RequireOCSPNoCheckForDelegated | 要求委托响应器证书带有 OCSPNoCheck 扩展 |
AllowIndirectCRLs | 接受由间接 CRL 签名者发布的 CRL；Default 允许 |
RequireDeltaCRLWhenAdvertised | 声明了增量 CRL 指针却未提供增量 CRL 时判为失败 |
TrustPurpose / CustomTrustPurposeOID | 信任锚必须满足的证书用途；Default 接受任意用途 |
InitialPolicySet | 已验证路径必须满足的证书策略 OID |
RequireExplicitCertificatePolicy | 要求路径中至少有一个显式证书策略 |
InhibitCertificatePolicyMapping | 禁用证书策略映射处理 |
InhibitAnyCertificatePolicy | 在策略处理中排除 anyPolicy 限定符 |
AlgorithmPolicy | 应用于路径中每张证书和每个签名的密钥长度与算法限制 |
FetchMissingIntermediates | 在以 cvsPathBuildingFailed 失败之前，先通过 AIA caIssuers URL 抓取缺失的中间证书；传输仍由调用方负责 |
MaxFetchedIntermediates | 一次验证可通过 AIA 抓取的中间证书数量上限 |
Default | 类函数，返回上述内置配置 |
使用说明
- 从
THPDFCertificateValidationOptions.Default出发，只覆盖策略真正需要的项，让新鲜度窗口和信任用途与库默认保持一致 - 库从不打开网络套接字：证据通过各池提供；当
FetchMissingIntermediates需要抓取时，使用带调用方传输的在线验证变体 - 来源数组与证据池一一对应，让报告能把每个吊销判定归因到其出处