ValidatePadesTrust - TPdf - PDFium Delphi Component

Component: TPdf · Unit: PDFium

Validates PAdES signature integrity, current system trust, optional revocation evidence and RFC 3161 timestamp tokens

Syntax

function ValidatePadesTrust(const Options: TPadesTrustValidationOptions): TPadesValidationResult;

function ValidatePadesTrustAsync(const Options: TPadesTrustValidationOptions; const Reply: TPadesTrustValidationReply): Boolean;

Description

Both methods capture the exact original file, memory buffer, custom stream or completed progressive source retained by the active component and never validate a PDFium-resaved copy

Every ordinary signature is checked against its original ByteRange, CMS signed attributes and signature value, signing-certificate-v2 binding, the configured backend's current certificate chain, and optional revocation evidence

Signature timestamps and Document Time-stamps additionally validate their SHA-256 message imprint, attached CMS signature, TSA chain and optional revocation state

RFC 3161 section 2.3 requires the timestamp signer's Extended Key Usage extension to be critical and contain only id-kp-timeStamping. Absent, noncritical, mixed or different EKU makes TimeStampTrustStatus invalid even with a valid token CMS signature and basic chain; the outer document signature keeps its independent results

The asynchronous overload captures the source before dispatch and reports completion through TPadesTrustValidationReply

Options

NetworkPolicy	`ptnpOffline` uses cached certificate data only whilst `ptnpOnline` permits Windows chain retrieval
CheckRevocation	Requests the configured backend's chain revocation evaluation; Windows excludes the root certificate, whilst OpenSSL checks configured CRLs against the chain
CheckTimeStamps	Validates signature timestamp and Document Time-stamp tokens when present
UrlRetrievalTimeoutMs	Bounds native URL retrieval used by chain and revocation processing
QualifiedTrustEvaluator	Optionally evaluates the signer and collected chain against an authenticated offline trusted-list snapshot
QualifiedValidationTime	Selects the UTC service-history evaluation time, with zero using the current time
CancellationToken	Stops at the next validation stage boundary
OnProgress	Receives the stage, signature index, signature count and overall percentage

Result

TPadesValidationResult.Signatures reports independent ByteRangeStatus, CmsSignatureStatus, AlgorithmPolicyStatus, SigningCertificateStatus, CertificateTrustStatus, QualifiedTrustStatus, RevocationStatus, TimeStampStatus, TimeStampSignatureStatus, TimeStampTrustStatus, and TimeStampRevocationStatus values, whilst QualifiedTrust identifies the matched territory, provider, service, type, status and start time

AlgorithmInfo records the CMS digest and signature OIDs plus the signing certificate public-key and named-curve OIDs, and applies the ISO/TS 32002 NIST, Brainpool, Ed25519, Ed448 and curve-to-digest rules before integrity is accepted

Unsupported algorithms, unavailable platform trust services, incomplete revocation evidence and cancelled validation are not promoted to valid states

Each signature entry includes RevocationReason and NativeRevocationError from its CMS verification, plus independent TimeStampRevocationReason and NativeTimeStampRevocationError from timestamp-token verification. The reason fields use TPdfCmsRevocationReason; native error fields are Cardinal values in the selected backend's error space, such as OpenSSL's X509_V_ERR_* codes or a raw Windows provider or GetLastError DWORD. Windows values are preserved without conversion to a common HRESULT space

The timestamp pair describes an embedded signature timestamp or a Document Time-stamp, without overwriting the ordinary signature pair. Timestamp diagnostics are populated only once token structure and message imprint checks allow CMS verification to run

With CheckRevocation = False, diagnostic reasons remain pcrrNone and errors remain zero. The same defaults apply when a check is never reached or its backend supplies no detailed reason, so always read the corresponding status rather than taking an empty diagnostic as success

Remarks

Requires Active to be True and a complete original source snapshot
The result describes the original loaded version and does not include unsaved component edits
The default options are offline, skip revocation retrieval, validate timestamps and use a 15000 millisecond URL timeout
Trust uses the configured backend's present system store and explicit anchors, not historical trust at signing time; macOS Keychain and OpenSSL retain their own policies and diagnostics
Online AIA, OCSP and CRL decisions are made by the Windows certificate chain engine
Native cryptographic and network calls cannot be interrupted whilst executing, so cancellation is checked at stage boundaries and the URL timeout bounds retrieval
OnProgress runs on the worker thread when called by ValidatePadesTrustAsync and must not manipulate UI controls directly
The asynchronous completion callback uses the default TPdfFuture main-thread synchronisation mode

Example

var
  Options: TPadesTrustValidationOptions;
  Validation: TPadesValidationResult;
begin
  Options := TPadesTrustValidationOptions.Default;
  Options.NetworkPolicy := ptnpOnline;
  Options.CheckRevocation := True;
  Validation := Pdf1.ValidatePadesTrust(Options);
end;

ValidatePadesTrust methods