# PdfCertificateValidation class

> The certificate checks for a signer or a time stamp authority: a chain to a trust anchor, then validity, usage, name constraints and revocation of each...

Namespace: [PdfNetStack.Signing](https://www.jadev-corp.com/api/pdfnetstack-signing/)  
Assembly: PdfNetStack.dll  
Package: `PdfNetStack`

The certificate checks for a signer or a time stamp authority: a chain to a trust anchor, then
validity, usage, name constraints and revocation of each certificate at the validation time,
certificate policies along the chain, and the qualified status the certificate claims.

```csharp
public sealed class PdfCertificateValidation
```

**Inheritance**

[object](https://learn.microsoft.com/dotnet/api/system.object) ← 
[PdfCertificateValidation](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfcertificatevalidation/)

## Remarks

These are the X.509 checks of ETSI EN 319 102-1 (5.2.6), made as RFC 5280, 6.1 describes:
certificate policies with policy mappings, policy constraints and inhibit anyPolicy, computed
with the policy graph of RFC 9618; name constraints on DNS names, email addresses, URI hosts,
directory names and IP addresses. The trust anchor's own policies are not processed, as RFC
5280 treats the anchor as input; its name constraints are applied. Policy qualifiers are not
read. A constraint on another name form fails a certificate that carries such a name, and any
other critical extension the library does not process fails the certificate. Qualified status
is what the QCStatements claim (ETSI EN 319 412-5), confirmed against the trusted lists the
application supplies (ETSI TS 119 615), which the library never downloads. Delta and
partitioned CRLs are not used.

## Properties

### <a id="PdfNetStack_Signing_PdfCertificateValidation_Certificates"></a> Certificates

The chain, the signer or time stamp authority first.

```csharp
public IReadOnlyList<PdfCertificateCheck> Certificates { get; }
```

#### Property Value

 [IReadOnlyList](https://learn.microsoft.com/dotnet/api/system.collections.generic.ireadonlylist\-1)<[PdfCertificateCheck](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfcertificatecheck/)\>

### <a id="PdfNetStack_Signing_PdfCertificateValidation_Chain"></a> Chain

The chain reaches a supplied trust anchor, or a trusted list anchor at the validation time
(see [TrustedListsAsTrustAnchors](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfvalidationoptions/#PdfNetStack_Signing_PdfValidationOptions_TrustedListsAsTrustAnchors)), and every link's
signature verifies. Not checked when no trust anchors were supplied and no usable trusted
list serves as anchors; the chain is still built as far as it goes. Failed when usable
lists serve as anchors but none of their services anchors the chain at the validation time.

```csharp
public PdfCheckStatus Chain { get; }
```

#### Property Value

 [PdfCheckStatus](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfcheckstatus/)

### <a id="PdfNetStack_Signing_PdfCertificateValidation_Policy"></a> Policy

The chain is valid for an acceptable certificate policy, or needs none (RFC 5280, 6.1).
Passed when no policies were asked for and no certificate requires one. Not checked when
the chain does not reach a trust anchor.

```csharp
public PdfCheckStatus Policy { get; }
```

#### Property Value

 [PdfCheckStatus](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfcheckstatus/)

### <a id="PdfNetStack_Signing_PdfCertificateValidation_Problems"></a> Problems

Everything that did not pass, in plain words.

```csharp
public IReadOnlyList<string> Problems { get; }
```

#### Property Value

 [IReadOnlyList](https://learn.microsoft.com/dotnet/api/system.collections.generic.ireadonlylist\-1)<[string](https://learn.microsoft.com/dotnet/api/system.string)\>

### <a id="PdfNetStack_Signing_PdfCertificateValidation_Qualification"></a> Qualification

The qualification the first certificate's QCStatements claim, such as QESig. Meaningful only
when [Status](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfcertificatevalidation/#PdfNetStack_Signing_PdfCertificateValidation_Status) is Passed. [TrustedListQualification](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfcertificatevalidation/#PdfNetStack_Signing_PdfCertificateValidation_TrustedListQualification) confirms it.

```csharp
public PdfQualification Qualification { get; }
```

#### Property Value

 [PdfQualification](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfqualification/)

### <a id="PdfNetStack_Signing_PdfCertificateValidation_Status"></a> Status

Failed when any check failed; Indeterminate when no check failed but one could not be
made (no trust anchors, missing or stale revocation data); Passed when every check passed.

```csharp
public PdfCheckStatus Status { get; }
```

#### Property Value

 [PdfCheckStatus](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfcheckstatus/)

### <a id="PdfNetStack_Signing_PdfCertificateValidation_TimeSource"></a> TimeSource

Where [ValidationTime](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfcertificatevalidation/#PdfNetStack_Signing_PdfCertificateValidation_ValidationTime) comes from.

```csharp
public PdfValidationTimeSource TimeSource { get; }
```

#### Property Value

 [PdfValidationTimeSource](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfvalidationtimesource/)

### <a id="PdfNetStack_Signing_PdfCertificateValidation_TrustedListQualification"></a> TrustedListQualification

The qualification confirmed against [TrustedLists](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfvalidationoptions/#PdfNetStack_Signing_PdfValidationOptions_TrustedLists) at the
validation time; null when no trusted lists were supplied, and for a time stamp authority.
Indeterminate, with the reason, when [Status](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfcertificatevalidation/#PdfNetStack_Signing_PdfCertificateValidation_Status) is not Passed: the lists are only
consulted for a certificate whose checks passed.

```csharp
public PdfTrustedListQualification? TrustedListQualification { get; }
```

#### Property Value

 [PdfTrustedListQualification](https://www.jadev-corp.com/api/pdfnetstack-signing/pdftrustedlistqualification/)?

### <a id="PdfNetStack_Signing_PdfCertificateValidation_ValidPolicies"></a> ValidPolicies

The policies the chain is valid for, as the trust anchor's domain names them (before any
mapping), limited to [AcceptablePolicies](https://www.jadev-corp.com/api/pdfnetstack-signing/pdfvalidationoptions/#PdfNetStack_Signing_PdfValidationOptions_AcceptablePolicies) when those were
given. 2.5.29.32.0 (anyPolicy) when every policy is accepted along the chain.

```csharp
public IReadOnlyList<string> ValidPolicies { get; }
```

#### Property Value

 [IReadOnlyList](https://learn.microsoft.com/dotnet/api/system.collections.generic.ireadonlylist\-1)<[string](https://learn.microsoft.com/dotnet/api/system.string)\>

### <a id="PdfNetStack_Signing_PdfCertificateValidation_ValidationTime"></a> ValidationTime

The time certificates were checked at.

```csharp
public DateTimeOffset ValidationTime { get; }
```

#### Property Value

 [DateTimeOffset](https://learn.microsoft.com/dotnet/api/system.datetimeoffset)

## Used in

- [Digitally sign PDF files in C# and .NET](https://www.jadev-corp.com/guides/signatures/)

Source: https://www.jadev-corp.com/pdfnetstack/api/pdfnetstack-signing/pdfcertificatevalidation/