THotPDF.SignPDFWithPFX

THotPDF

Signs an existing PDF placeholder using a PFX / PKCS#12 file, building a CMS SignedData container and writing the signed PDF in one call.

Delphi syntax (file overload):

class function SignPDFWithPFX(

  const InputPDFPath: string;

  const OutputPDFPath: string;

  const PFXFilePath: string;

  const Password: AnsiString): boolean; overload; static;

Delphi syntax (stream overload):

class function SignPDFWithPFX(

  InputStream: TStream;

  OutputStream: TStream;

  const PFXFilePath: string;

  const Password: AnsiString): boolean; overload; static;

說明

SignPDFWithPFX 是 v2.119.27 新增的端對端 PFX 簽章入口點。輸入 PDF 必須已包含由

1. 載入輸入 PDF、找出

2. 載入 PFX 檔案並使用提供的 password 解密。支援搭配 PBKDF2-HMAC-SHA-256 + AES-256-CBC 的 PBES2（這是 OpenSSL 3.0+、Windows 11+ certutil 與 macOS Keychain Access 匯出 PFX 檔案時的預設值）。舊版 PBE-SHA1-3DES 檔案會產生診斷訊息；請使用 openssl pkcs12 -export ... -keypbe AES-256-CBC -certpbe AES-256-CBC 重新匯出

3. 對 /ByteRange 涵蓋的檔案位元組計算 SHA-256，並建立 CMS SignedData (RFC 5652) DER blob，其中包含 X.509 certificate、signed attributes（contentType + messageDigest + signingTime），以及針對 SET-tagged signed attributes 的 RSA + SHA-256 signature

4. 將 CMS DER 進行 hex encoding、確認它符合 AddSignedSignatureField 保留的 /Contents budget（預設 8 KB 可涵蓋 1024 / 2048-bit RSA），並注入 placeholder

5. Hex-encodes the CMS DER, verifies it fits the /目錄 budget reserved by AddSignedSignatureField (default 8 KB covers 1024 / 2048-bit RSA), and injects it into the placeholder

5. Writes the patched bytes to the output path or stream.

Returns True on success. Raises EHPDFPFXError on a bad password, unsupported encryption profile, or malformed PFX; EHPDFCMSError when the input PDF lacks the expected placeholder or the CMS DER overflows the reserved /Contents budget; EHPDFRSAError on RSA key mismatch.

Typical workflow

Doc := THotPDF.Create(nil);

Doc.FileName := 'unsigned.pdf';

Doc.BeginDoc;

Doc.CurrentPage.AddSignedSignatureField(

  'Sig1', Rect(60, 60, 260, 90), 8192,

  'adbe.pkcs7.detached', 'Approved', 'Brussels', '', []);

Doc.EndDoc;

Doc.Free;

THotPDF.SignPDFWithPFX('unsigned.pdf', 'signed.pdf', 'mykey.pfx', 'mypassword');

Notes

簽章演算法為 RSA + SHA-256 (1.2.840.113549.1.1.1 + 2.16.840.1.101.3.4.2.1)。signer identifier 是從 X.509 certificate 擷取的 IssuerAndSerialNumber。encapContentInfo 為 detached（省略 eContent）。Signed attributes 會依 RFC 5652 §5.4，在雜湊前按 DER byte string 遞增排序HPDFEnumeratePFXIdentities to inspect the deterministic identity list and its LocalKeyID and FriendlyName fields, or call HPDFParsePFXByLocalKeyID when only the selected key material is required

For end-to-end signing, initialise THPDFCMSSignOptions with HPDFCMSDefaultSignOptions, copy the selected exact octets into Options.PFXLocalKeyID, and call the HPDFCMSSignPDFStream overload that accepts those options. The selected leaf, available intermediate certificates, and available root are embedded automatically; caller-supplied Options.AdditionalCertsDER values are merged with exact DER deduplication

對於需要 RFC 3161 timestamps、DSS dictionaries 或 document timestamp signatures 的 PAdES B-T / B-LT / B-LTA 工作流程，producer-side helpers（AddPAdESSignatureField、AddPAdESDSSCertificate、AddDocumentTimestampSignature）仍然適用；SignPDFWithPFX 本身會輸出基礎的 CMS-only signature（等同 PAdES-B-B）HPDFCMSSignPDFStream callers may set THPDFCMSSignOptions.OpenSSLLibraryPath, while the convenience overload uses the normal platform library search path

The signature algorithm is RSA + SHA-256 (1.2.840.113549.1.1.1 + 2.16.840.1.101.3.4.2.1). The signer identifier is IssuerAndSerialNumber extracted from the X.509 certificate. The encapContentInfo is detached (eContent omitted). Signed attributes are sorted by ascending DER byte string per RFC 5652 section 5.4 before being hashed

For PAdES B-T / B-LT / B-LTA workflows that need RFC 3161 timestamps, DSS dictionaries, or document timestamp signatures, the producer-side helpers (AddPAdESSignatureField, AddPAdESDSSCertificate, AddDocumentTimestampSignature) still apply; SignPDFWithPFX itself emits a basic CMS-only signature (PAdES-B-B equivalent)

The stream overload never retains a complete second PDF in memory. It hashes the patched output in bounded ranges and seek-patches the hexadecimal CMS value without changing file length. Fixed-width decimal offsets support prepared PDFs smaller than 10,000,000,000 bytes

請參閱： AddSignedSignatureField, PreparePDFForSigning, InsertSignatureHex, AddPAdESSignatureField