TPadesPaddingScheme = (psRsaPss, psRsaPkcs1v15, psEcdsa);
TPadesSignerOptions = record
CertificateThumbprint: string;
PaddingScheme: TPadesPaddingScheme;
class function Default: TPadesSignerOptions; static;
end;
TPadesChainCertArray = array of TBytes;
TPadesResolvedSigner = record
Signer: ICmsSigner;
SignerCertDer: TBytes;
ChainCertDer: TPadesChainCertArray;
end;
TPdfRevocationMode = (prmNone, prmOffline, prmOnlineAllowed,
prmOnlineRequired);
TPdfStringArray = array of string;
TPdfCertificatePathOptions = record
ValidationTime: TDateTime;
RevocationMode: TPdfRevocationMode;
RequiredPolicyOids: TPdfStringArray;
MaxCertificates: Integer;
MaxCertificateBytes: Integer;
MaxFetchBytes: Integer;
MaxPathDepth: Integer;
class function Default: TPdfCertificatePathOptions; static;
end;
TPdfCertificatePathReport = record
Trusted: Boolean;
PathBuilt: Boolean;
PolicyValid: Boolean;
RevocationChecked: Boolean;
PathCertificateCount: Integer;
ErrorCode: Integer;
ErrorMessage: string;
end;
IPdfTrustStore = interface
function LoadTrustAnchors: TPadesChainCertArray;
end;
IPdfValidationFetcher = interface
function Fetch(const Uri: string; MaxBytes: Integer;
out Data: TBytes): Boolean;
end;
IPdfCertificatePathValidator = interface
function Validate(const LeafCertificate: TBytes;
const Intermediates, TrustAnchors: TPadesChainCertArray;
TrustStore: IPdfTrustStore; Fetcher: IPdfValidationFetcher;
const Options: TPdfCertificatePathOptions;
out Report: TPdfCertificatePathReport): Boolean;
end;
IPadesSignerProvider = interface
function BackendName: string;
function Resolve(const Options: TPadesSignerOptions): TPadesResolvedSigner;
end;
TPdfPkcs11Slot = record
SlotID: UInt64;
Description: string;
TokenLabel: string;
TokenPresent: Boolean;
end;
TPdfPkcs11Slots = array of TPdfPkcs11Slot;
TPdfPkcs11Certificate = record
SlotID: UInt64;
ObjectID: TBytes;
LabelText: string;
CertificateDer: TBytes;
Mechanisms: TPdfStringArray;
end;
TPdfPkcs11Certificates = array of TPdfPkcs11Certificate;
IPdfPkcs11SignerProvider = interface(IPadesSignerProvider)
function EnumerateSlots: TPdfPkcs11Slots;
function EnumerateCertificates(SlotID: UInt64): TPdfPkcs11Certificates;
procedure CloseProtectedSessions;
end;
TPdfCmsVerifyStatus = (pcvsUnavailable, pcvsValid, pcvsInvalid,
pcvsUnsupported, pcvsIndeterminate);
TPdfCmsRevocationReason = (pcrrNone, pcrrCertificateRevoked, pcrrCrlExpired,
pcrrCrlNotYetValid, pcrrCrlUnavailable, pcrrCrlSignatureInvalid,
pcrrCrlInvalid, pcrrChainUntrusted, pcrrUnknown, pcrrOcspUnavailable,
pcrrOcspInvalid, pcrrOcspStatusUnknown);
TPdfCmsVerifyStage = (pcvstCryptographicSignature, pcvstChainBuild,
pcvstOnlineRetrieval, pcvstRevocationCheck);
TPdfCmsVerifyCheckpoint = procedure(Stage: TPdfCmsVerifyStage) of object;
TPdfCmsVerifyOptions = record
OnlineRetrieval: Boolean;
CheckRevocation: Boolean;
CollectChainCertificates: Boolean;
UrlRetrievalTimeoutMs: Cardinal;
OnCheckpoint: TPdfCmsVerifyCheckpoint;
CollectSignerDiagnostics: Boolean;
MaxSignerCount: Integer;
class function Default: TPdfCmsVerifyOptions; static;
end;
TPdfCmsSignerVerifyResult = record
SignerIndex: Integer;
SignatureStatus, TrustStatus, RevocationStatus: TPdfCmsVerifyStatus;
SignatureError, TrustError: Cardinal;
SignerCertificate: TBytes;
RevocationReason: TPdfCmsRevocationReason;
RevocationError: Cardinal;
RevocationCertificate: TBytes;
end;
TPdfCmsSignerVerifyResults = array of TPdfCmsSignerVerifyResult;
TPdfCmsVerifyResult = record
SignatureStatus: TPdfCmsVerifyStatus;
TrustStatus: TPdfCmsVerifyStatus;
RevocationStatus: TPdfCmsVerifyStatus;
SignatureError: Cardinal;
TrustError: Cardinal;
SignerCertificate: TBytes;
ChainCertificates: TPadesChainCertArray;
RevocationReason: TPdfCmsRevocationReason;
RevocationError: Cardinal;
RevocationCertificate: TBytes;
SignerResults: TPdfCmsSignerVerifyResults;
SignerDiagnosticsStatus: TPdfCmsVerifyStatus;
SignerCount: Integer;
end;
IPdfCmsVerifier = interface
function BackendName: string;
function VerifyDetached(const CmsDer: TBytes;
Segment1: Pointer; Segment1Length: Cardinal;
Segment2: Pointer; Segment2Length: Cardinal;
const Options: TPdfCmsVerifyOptions): TPdfCmsVerifyResult;
function VerifyAttached(const CmsDer: TBytes;
const Options: TPdfCmsVerifyOptions): TPdfCmsVerifyResult;
end;
procedure ConfigurePadesCmsVerifier(const Verifier: IPdfCmsVerifier);
function PadesCmsVerificationAvailable: Boolean;
function PadesCmsVerificationBackendName: string;
function PadesCryptoAvailable: Boolean;
function PadesCryptoBackendName: string;
function ResolvePadesSigner(const Options: TPadesSignerOptions): TPadesResolvedSigner;
procedure ConfigurePdfCertificatePathValidator(
const Validator: IPdfCertificatePathValidator);
function ValidatePdfCertificatePath(const LeafCertificate: TBytes;
const Intermediates, TrustAnchors: TPadesChainCertArray;
TrustStore: IPdfTrustStore; Fetcher: IPdfValidationFetcher;
const Options: TPdfCertificatePathOptions;
out Report: TPdfCertificatePathReport): Boolean;
procedure ConfigurePadesSignerProvider(const Provider: IPadesSignerProvider);
TPadesSignerResolverProc = function(const Options: TPadesSignerOptions): TPadesResolvedSigner;
PadesSignerResolverOverride: TPadesSignerResolverProc;
PdfCertificatePathValidator: IPdfCertificatePathValidator;
PadesSignerProvider: IPadesSignerProvider;
PadesCmsVerifier: IPdfCmsVerifier;
FPdfCrypto is the front door to the PAdES signing stack. PadesCryptoAvailable reports whether signing material and its backend are available, and PadesCryptoBackendName identifies the selected backend; Windows uses Cryptography Next Generation by default, while other platforms resolve the explicitly configured OpenSSL private key and certificate from FPdfCryptoSsl
ResolvePadesSigner takes a certificate thumbprint and a padding scheme and returns a fully populated TPadesResolvedSigner: the ICmsSigner implementation that performs the private-key operation, the signer certificate DER, and the issuing chain certificates. The result is passed straight to FPdfCms.BuildSignedData
Custom integrations can register an IPadesSignerProvider, including an IPdfPkcs11SignerProvider that enumerates token slots and certificates, or use PadesSignerResolverOverride as a deterministic resolver seam
Certificate path validation is provider-based and budgeted: callers configure IPdfCertificatePathValidator, optionally supply explicit trust anchors, an IPdfTrustStore, and an IPdfValidationFetcher, then inspect TPdfCertificatePathReport
| Function | Description |
|---|---|
PadesCryptoAvailable | Returns True when a crypto backend is available for PAdES signing on the current platform |
PadesCryptoBackendName | Returns the display name of the active crypto backend |
ResolvePadesSigner | Resolves a certificate thumbprint and padding scheme into a signer, signer certificate, and chain |
ConfigurePdfCertificatePathValidator | Sets or clears the process-wide IPdfCertificatePathValidator used by ValidatePdfCertificatePath |
ValidatePdfCertificatePath | Validates a leaf certificate against intermediates and the combined explicit and trust-store anchors after enforcing certificate count, size, fetch, and path-depth budgets |
ConfigurePadesSignerProvider | Sets or clears the process-wide signer provider used ahead of the platform backend |
ConfigurePadesCmsVerifier | Installs the CMS verification backend used by the PAdES validator; clearing it restores Windows CryptoAPI on Windows. Other platforms require an explicit ConfigureSslCmsVerifier or ConfigureKeychainCmsVerifier call |
PadesCmsVerificationAvailable | Returns True when some backend can verify CMS on this build, whether registered or built in |
PadesCmsVerificationBackendName | Returns the display name of the active verification backend, or an empty string when none is present |
| Interface member | Description |
|---|---|
IPdfTrustStore.LoadTrustAnchors | Returns additional DER-encoded trust anchors subject to the configured certificate budgets |
IPdfValidationFetcher.Fetch | Fetches validation material from Uri without exceeding MaxBytes |
IPdfCertificatePathValidator.Validate | Builds and evaluates the certificate path and populates TPdfCertificatePathReport |
IPadesSignerProvider.BackendName | Returns the provider display name exposed by PadesCryptoBackendName |
IPadesSignerProvider.Resolve | Returns complete signer material for the supplied TPadesSignerOptions |
IPdfPkcs11SignerProvider.EnumerateSlots | Returns the available PKCS#11 slots and token-presence metadata |
IPdfPkcs11SignerProvider.EnumerateCertificates | Returns the certificates and signing mechanisms visible in one PKCS#11 slot |
IPdfPkcs11SignerProvider.CloseProtectedSessions | Closes protected or authenticated PKCS#11 sessions owned by the provider |
IPdfCmsVerifier.BackendName | Returns the verification backend display name reported by PadesCmsVerificationBackendName |
IPdfCmsVerifier.VerifyDetached | Verifies a PDF signature, whose signed content is the two byte ranges either side of the /Contents hole |
IPdfCmsVerifier.VerifyAttached | Verifies a timestamp token, which carries its own content and needs no detached segments |
| Type | Description |
|---|---|
EPadesCrypto | Base exception for crypto-backend failures |
EPadesCryptoUnavailable | Raised when a required signer backend or certificate path validator is not configured |
TPadesPaddingScheme | psRsaPss, psRsaPkcs1v15, or psEcdsa |
TPadesSignerOptions | CertificateThumbprint selects the certificate and PaddingScheme selects the signature scheme; Default uses an empty thumbprint and psRsaPss |
TPadesChainCertArray | Dynamic array of DER-encoded chain certificates |
TPadesResolvedSigner | Signer, SignerCertDer, and ChainCertDer bundle the resolved signer and certificate material |
TPdfRevocationMode | prmNone, prmOffline, prmOnlineAllowed, or prmOnlineRequired |
TPdfStringArray | Dynamic string array used for policy OIDs and provider mechanism names |
TPdfCertificatePathOptions | ValidationTime, RevocationMode, RequiredPolicyOids, MaxCertificates, MaxCertificateBytes, MaxFetchBytes, and MaxPathDepth control validation and resource budgets; Default selects offline revocation with limits of 64 certificates, 4 MiB per certificate, 16 MiB fetched data, and path depth 16 |
TPdfCertificatePathReport | Trusted, PathBuilt, PolicyValid, RevocationChecked, PathCertificateCount, ErrorCode, and ErrorMessage report the validation outcome |
TPdfPkcs11Slot | SlotID, Description, TokenLabel, and TokenPresent describe one PKCS#11 slot |
TPdfPkcs11Slots | Dynamic array of TPdfPkcs11Slot records |
TPdfPkcs11Certificate | SlotID, ObjectID, LabelText, CertificateDer, and Mechanisms describe one token certificate |
TPdfPkcs11Certificates | Dynamic array of TPdfPkcs11Certificate records |
TPadesSignerResolverProc | Function-pointer type for the PadesSignerResolverOverride injection var |
TPdfCmsVerifyStatus | pcvsUnavailable, pcvsValid, pcvsInvalid, pcvsUnsupported, or pcvsIndeterminate |
TPdfCmsRevocationReason | pcrrNone, pcrrCertificateRevoked, pcrrCrlExpired, pcrrCrlNotYetValid, pcrrCrlUnavailable, pcrrCrlSignatureInvalid, pcrrCrlInvalid, pcrrChainUntrusted, pcrrUnknown, pcrrOcspUnavailable, pcrrOcspInvalid, or pcrrOcspStatusUnknown explains revocation evidence separately from the verification status |
TPdfCmsVerifyStage | pcvstCryptographicSignature, pcvstChainBuild, pcvstOnlineRetrieval, or pcvstRevocationCheck |
TPdfCmsVerifyCheckpoint | Object-method callback receiving each TPdfCmsVerifyStage as verification progresses |
TPdfCmsVerifyOptions | OnlineRetrieval, CheckRevocation, CollectChainCertificates, UrlRetrievalTimeoutMs, and OnCheckpoint steer verification; CollectSignerDiagnostics requests per-signer snapshots and MaxSignerCount bounds their count. Default disables retrieval, revocation, and signer diagnostics, sets a 15 second retrieval budget, and limits signer snapshots to 64 |
TPdfCmsSignerVerifyResult | SignerIndex identifies the encoded SignerInfo order; signature, trust, revocation statuses and native errors describe that signer independently. SignerCertificate is its DER certificate, while RevocationCertificate identifies the certificate associated with a captured revocation error when the backend can supply it |
TPdfCmsSignerVerifyResults | Dynamic array of bounded signer snapshots |
TPdfCmsVerifyResult | Aggregate signature, trust, and revocation statuses remain independent. The record also returns SignatureError, TrustError, SignerCertificate, ChainCertificates, RevocationReason, RevocationError, RevocationCertificate, SignerResults, SignerDiagnosticsStatus, and SignerCount |
Rebuild consumers when upgrading because the public option and result records have grown. Custom verifiers should initialize managed result records with Default(TPdfCmsVerifyResult) and leave unsupported snapshot fields unavailable; do not clear a live record containing strings or dynamic arrays with FillChar
Read RevocationReason and RevocationError from the TPdfCmsVerifyResult returned by IPdfCmsVerifier.VerifyDetached or VerifyAttached. PAdES trust validation preserves them as RevocationReason and NativeRevocationError, with separate TimeStampRevocationReason and NativeTimeStampRevocationError fields for timestamp tokens; evidence reports include both pairs
RevocationError is a backend-specific native verification code, with zero meaning no native diagnostic was captured. OpenSSL uses the X509_V_ERR_* error space. Windows preserves a raw DWORD from a certificate's CERT_REVOCATION_INFO.dwRevocationResult, or from GetLastError if its revocation chain call fails; this is not a uniform HRESULT error space or the aggregate chain trust bitmask
OpenSSL distinguishes confirmed revocation from expired, unavailable, or invalid CRL evidence and unavailable, invalid, or unknown OCSP evidence. Windows reports confirmed revocation, untrusted chains, or an unknown native failure. The macOS verifier evaluates signature integrity, Basic X.509 trust, and revocation separately, returning native Security.framework errors without translating every platform failure into a CRL or OCSP classification
RevocationCertificate can identify a revoked intermediate rather than the CMS signer certificate; it is empty when the backend cannot capture that certificate. OpenSSL can collect it, while the current macOS backend leaves it empty
Neither pcrrNone nor a zero error proves that revocation was checked or succeeded; always inspect RevocationStatus
Set CollectSignerDiagnostics=True to inspect bounded snapshots in SignerResults. SignerCount is the encoded SignerInfo count when established; a value of zero means that the count was not established
SignerDiagnosticsStatus=pcvsValid means the requested snapshots are complete, including snapshots of invalid signatures; it does not mean all signatures passed. pcvsUnavailable means collection was disabled or unsupported, and pcvsIndeterminate means the backend could not complete the requested collection within its parsing or resource limits
The OpenSSL and native macOS implementations cap collection at 64 signers. OpenSSL additionally limits diagnostic CMS input to 4 MiB and aggregate diagnostic input/output work to 64 MiB; macOS bounds returned certificate material to 4 MiB per certificate and 64 MiB in total. A lower MaxSignerCount further reduces the caller's requested count
Signer snapshots reuse configured evidence and evidence retrieved during the aggregate verification. OpenSSL does not perform a second network retrieval for each diagnostic snapshot, and an incomplete aggregate retrieval cannot become a successful offline revocation snapshot
PadesSignerResolverOverride has priority, followed by an explicitly registered IPadesSignerProvider, then the platform default. Non-Windows defaults require ConfigureSslSigningCredentials; availability of libcrypto alone does not supply a private key or certificate
The OpenSSL default rejects a nonempty CertificateThumbprint because its certificate was selected by explicit configuration. Keychain signing remains available through ConfigureKeychainSignerProvider when the application chooses that provider
| Variable | Description |
|---|---|
PadesSignerResolverOverride | Optional resolver callback evaluated before registered and platform providers |
PadesCmsVerifier | Current CMS verification backend, normally assigned through ConfigurePadesCmsVerifier |
PdfCertificatePathValidator | Current certificate path validator, normally assigned through ConfigurePdfCertificatePathValidator |
PadesSignerProvider | Current signer provider, normally assigned through ConfigurePadesSignerProvider |