THPDFCertificateValidationOptions Record
為憑證路徑驗證設定信任錨點、離線撤銷證據、政策約束與演算法限制
宣告
THPDFCertificateValidationOptions= record
TrustAnchors: THPDFDERArray;
IntermediateCertificates: THPDFDERArray;
OCSPResponses: THPDFDERArray;
CRLs: THPDFDERArray;
DeltaCRLs: THPDFDERArray;
CRLIssuerCertificates: THPDFDERArray;
OCSPResponseSources: THPDFValidationEvidenceSourceArray;
CRLSources: THPDFValidationEvidenceSourceArray;
DeltaCRLSources: THPDFValidationEvidenceSourceArray;
RevocationMode: THPDFRevocationMode;
ValidationTime: TDateTime;
MaxPathLength: Integer;
OCSPNoncePolicy: THPDFOCSPNoncePolicy;
ExpectedOCSPNonce: TBytes;
OCSPMaxAgeDays: Double;
OCSPAllowedClockSkewMinutes: Integer;
RequireOCSPNextUpdate: boolean;
AllowDelegatedOCSPResponders: boolean;
RequireOCSPNoCheckForDelegated: boolean;
CRLMaxAgeDays: Double;
CRLAllowedClockSkewMinutes: Integer;
RequireCRLNextUpdate: boolean;
AllowIndirectCRLs: boolean;
RequireDeltaCRLWhenAdvertised: boolean;
TrustPurpose: THPDFCertificateTrustPurpose;
CustomTrustPurposeOID: AnsiString;
InitialPolicySet: THPDFOIDArray;
RequireExplicitCertificatePolicy: boolean;
InhibitCertificatePolicyMapping: boolean;
InhibitAnyCertificatePolicy: boolean;
AlgorithmPolicy: THPDFCertificateAlgorithmPolicy;
// v2.738.0 online chain building: when the path cannot close with
// the supplied pool, fetch the missing intermediates through the
// AIA caIssuers URLs of the leaf-most unmatched certificate before
// failing with cvsPathBuildingFailed (transport stays caller-side)
FetchMissingIntermediates: boolean;
MaxFetchedIntermediates: Integer;
class function Default: THPDFCertificateValidationOptions; static;
end;單元
HPDFSignVerify
欄位
| 欄位 | 用途 |
|---|---|
TrustAnchors | 允許閉合路徑的 DER 編碼信任錨點憑證 |
IntermediateCertificates | CMS 憑證集合不完整時,建構器可使用的額外非受信憑證 |
OCSPResponses / CRLs / DeltaCRLs | 離線提供的 OCSP 回應、基礎 CRL 與 delta CRL 集合 |
CRLIssuerCertificates | 用於驗證 CRL 簽署者簽章的憑證 |
OCSPResponseSources / CRLSources / DeltaCRLSources | 為每個集合項目記錄的證據來源標籤,顯示在驗證資訊上 |
RevocationMode | 選擇 rvmNone、rvmBestEffort 或 rvmRequire 的撤銷行為 |
ValidationTime | 有效期與新鮮度檢查的評估時間 |
MaxPathLength | 葉憑證與信任錨點之間的憑證數上限;Default 設為 12 |
OCSPNoncePolicy | OCSP nonce 要強制要求、存在時比對,還是忽略;Default 為存在時比對 |
ExpectedOCSPNonce | 政策要求 nonce 時必須相符的確切 nonce 位元組 |
OCSPMaxAgeDays / CRLMaxAgeDays | OCSP 回應與 CRL 可接受的最大時效;Default 分別設為 7 天與 30 天 |
OCSPAllowedClockSkewMinutes / CRLAllowedClockSkewMinutes | 套用於證據時間戳記的時鐘容差;Default 兩者皆設 5 分鐘 |
RequireOCSPNextUpdate / RequireCRLNextUpdate | 拒絕不帶 next-update 欄位的證據 |
AllowDelegatedOCSPResponders | 接受由委派回應器簽署的回應;Default 允許 |
RequireOCSPNoCheckForDelegated | 要求委派回應器憑證必須帶有 OCSPNoCheck 擴充 |
AllowIndirectCRLs | 接受間接 CRL 簽署者發行的 CRL;Default 允許 |
RequireDeltaCRLWhenAdvertised | 宣告了 delta CRL 指標卻未提供 delta CRL 時失敗 |
TrustPurpose / CustomTrustPurposeOID | 信任錨點必須符合的憑證用途;Default 接受任何用途 |
InitialPolicySet | 已驗證路徑必須滿足的憑證政策 OID |
RequireExplicitCertificatePolicy | 要求路徑中至少有一個明確的憑證政策 |
InhibitCertificatePolicyMapping | 停用憑證政策映射處理 |
InhibitAnyCertificatePolicy | 把 anyPolicy 修飾詞排除在政策處理之外 |
AlgorithmPolicy | 套用於路徑中每張憑證與每個簽章的金鑰長度與演算法限制 |
FetchMissingIntermediates | 在以 cvsPathBuildingFailed 失敗前,先透過 AIA caIssuers URL 擷取缺少的中繼憑證;傳輸仍由呼叫端負責 |
MaxFetchedIntermediates | 單次驗證可透過 AIA 擷取的中繼憑證數量上限 |
Default | 類別函式,傳回上述內建組態 |
使用說明
- 從
THPDFCertificateValidationOptions.Default出發,只覆寫你的政策需要的項目,讓新鮮度視窗與信任用途和程式庫預設一致 - 程式庫從不開啟 socket:證據請透過集合提供,或當
FetchMissingIntermediates需要擷取時,使用帶呼叫端傳輸的線上驗證變體 - 來源陣列與證據集合一一對應,讓報告能把每個撤銷判定歸因到其來源