ValidatePadesTrust - TPdf - PDFium Delphi Component

Component: TPdf · Unit: PDFium

Validates PAdES signature integrity, current system trust, optional revocation evidence, and RFC 3161 timestamp tokens

Syntax

function ValidatePadesTrust(const Options: TPadesTrustValidationOptions): TPadesValidationResult;

function ValidatePadesTrustAsync(const Options: TPadesTrustValidationOptions; const Reply: TPadesTrustValidationReply): Boolean;

Description

Both methods capture the exact original file, memory buffer, custom stream, or completed progressive source retained by the active component and never validate a PDFium-resaved copy

Every ordinary signature is checked against its original ByteRange, CMS signed attributes and signature value, signing-certificate-v2 binding, the configured backend's current certificate chain, and optional revocation evidence

Signature timestamps and Document Time-stamps additionally validate their SHA-256 message imprint, attached CMS signature, TSA chain, and optional revocation state

The timestamp signer certificate must have a critical Extended Key Usage extension containing only id-kp-timeStamping, as required by RFC 3161 section 2.3. A missing, noncritical, mixed, or different EKU produces an invalid TimeStampTrustStatus even when the token's CMS signature and basic certificate chain are valid; the outer document signature retains its independent results

The asynchronous overload captures the source before dispatch and reports completion through TPadesTrustValidationReply

Options

NetworkPolicy	`ptnpOffline` uses cached certificate data only while `ptnpOnline` permits Windows chain retrieval
CheckRevocation	Requests the configured backend's chain revocation evaluation; Windows excludes the root certificate, while OpenSSL checks configured CRLs against the chain
CheckTimeStamps	Validates signature timestamp and Document Time-stamp tokens when present
UrlRetrievalTimeoutMs	Bounds native URL retrieval used by chain and revocation processing
QualifiedTrustEvaluator	Optionally evaluates the signer and collected chain against an authenticated offline trusted-list snapshot
QualifiedValidationTime	Selects the UTC service-history evaluation time, with zero using the current time
CancellationToken	Stops at the next validation stage boundary
OnProgress	Receives the stage, signature index, signature count, and overall percentage

Result

TPadesValidationResult.Signatures reports independent ByteRangeStatus, CmsSignatureStatus, AlgorithmPolicyStatus, SigningCertificateStatus, CertificateTrustStatus, QualifiedTrustStatus, RevocationStatus, TimeStampStatus, TimeStampSignatureStatus, TimeStampTrustStatus, and TimeStampRevocationStatus values, while QualifiedTrust identifies the matched territory, provider, service, type, status, and start time

AlgorithmInfo records the CMS digest and signature OIDs plus the signing certificate public-key and named-curve OIDs, and applies the ISO/TS 32002 NIST, Brainpool, Ed25519, Ed448, and curve-to-digest rules before integrity is accepted

Unsupported algorithms, unavailable platform trust services, incomplete revocation evidence, and cancelled validation are not promoted to valid states

Each signature entry includes RevocationReason and NativeRevocationError from its CMS verification, plus independent TimeStampRevocationReason and NativeTimeStampRevocationError from timestamp-token verification. The reason fields use TPdfCmsRevocationReason; native error fields are Cardinal values in the selected backend's error space, such as OpenSSL's X509_V_ERR_* codes or a raw Windows provider or GetLastError DWORD. Windows values are preserved without conversion to a common HRESULT space

The timestamp pair describes an embedded signature timestamp or a Document Time-stamp, without overwriting the ordinary signature pair. Timestamp diagnostics are populated only after token structure and message imprint checks allow CMS verification to run

With CheckRevocation = False, diagnostic reasons remain pcrrNone and errors remain zero. The same defaults apply when a check is not reached or its backend supplies no detailed reason, so always read the corresponding status rather than treating an empty diagnostic as success

Remarks

Requires Active to be True and a complete original source snapshot
The result describes the original loaded version and does not include unsaved component edits
The default options are offline, skip revocation retrieval, validate timestamps, and use a 15000 millisecond URL timeout
Trust uses the configured backend's current system store and explicit anchors rather than the historical trust state at signing time; macOS Keychain and OpenSSL keep their own backend policies and diagnostics
Online AIA, OCSP, and CRL decisions are made by the Windows certificate chain engine
Native cryptographic and network calls cannot be interrupted while executing, so cancellation is checked at stage boundaries and the URL timeout bounds retrieval
OnProgress runs on the worker thread when called by ValidatePadesTrustAsync and must not manipulate UI controls directly
The asynchronous completion callback uses the default TPdfFuture main-thread synchronization mode

Example

var
  Options: TPadesTrustValidationOptions;
  Validation: TPadesValidationResult;
begin
  Options := TPadesTrustValidationOptions.Default;
  Options.NetworkPolicy := ptnpOnline;
  Options.CheckRevocation := True;
  Validation := Pdf1.ValidatePadesTrust(Options);
end;

ValidatePadesTrust methods