PdfCertificateValidation class
Namespace: PdfNetStack.Signing
Assembly: PdfNetStack.dll
Package: PdfNetStack
The certificate checks for a signer or a time stamp authority: a chain to a trust anchor, then validity, usage, name constraints and revocation of each certificate at the validation time, certificate policies along the chain, and the qualified status the certificate claims.
public sealed class PdfCertificateValidationInheritance
object ← PdfCertificateValidation
Remarks
Section titled “Remarks”These are the X.509 checks of ETSI EN 319 102-1 (5.2.6), made as RFC 5280, 6.1 describes: certificate policies with policy mappings, policy constraints and inhibit anyPolicy, computed with the policy graph of RFC 9618; name constraints on DNS names, email addresses, URI hosts, directory names and IP addresses. The trust anchor’s own policies are not processed, as RFC 5280 treats the anchor as input; its name constraints are applied. Policy qualifiers are not read. A constraint on another name form fails a certificate that carries such a name, and any other critical extension the library does not process fails the certificate. Qualified status is what the QCStatements claim (ETSI EN 319 412-5), confirmed against the trusted lists the application supplies (ETSI TS 119 615), which the library never downloads. Delta and partitioned CRLs are not used.
Properties
Section titled “Properties”Certificates
Section titled “ Certificates”The chain, the signer or time stamp authority first.
public IReadOnlyList<PdfCertificateCheck> Certificates { get; }Property Value
Section titled “Property Value”IReadOnlyList<PdfCertificateCheck>
The chain reaches a supplied trust anchor, or a trusted list anchor at the validation time (see TrustedListsAsTrustAnchors), and every link’s signature verifies. Not checked when no trust anchors were supplied and no usable trusted list serves as anchors; the chain is still built as far as it goes. Failed when usable lists serve as anchors but none of their services anchors the chain at the validation time.
public PdfCheckStatus Chain { get; }Property Value
Section titled “Property Value”Policy
Section titled “ Policy”The chain is valid for an acceptable certificate policy, or needs none (RFC 5280, 6.1). Passed when no policies were asked for and no certificate requires one. Not checked when the chain does not reach a trust anchor.
public PdfCheckStatus Policy { get; }Property Value
Section titled “Property Value”Problems
Section titled “ Problems”Everything that did not pass, in plain words.
public IReadOnlyList<string> Problems { get; }Property Value
Section titled “Property Value”Qualification
Section titled “ Qualification”The qualification the first certificate’s QCStatements claim, such as QESig. Meaningful only when Status is Passed. TrustedListQualification confirms it.
public PdfQualification Qualification { get; }Property Value
Section titled “Property Value”Status
Section titled “ Status”Failed when any check failed; Indeterminate when no check failed but one could not be made (no trust anchors, missing or stale revocation data); Passed when every check passed.
public PdfCheckStatus Status { get; }Property Value
Section titled “Property Value”TimeSource
Section titled “ TimeSource”Where ValidationTime comes from.
public PdfValidationTimeSource TimeSource { get; }Property Value
Section titled “Property Value”TrustedListQualification
Section titled “ TrustedListQualification”The qualification confirmed against TrustedLists at the validation time; null when no trusted lists were supplied, and for a time stamp authority. Indeterminate, with the reason, when Status is not Passed: the lists are only consulted for a certificate whose checks passed.
public PdfTrustedListQualification? TrustedListQualification { get; }Property Value
Section titled “Property Value”ValidPolicies
Section titled “ ValidPolicies”The policies the chain is valid for, as the trust anchor’s domain names them (before any mapping), limited to AcceptablePolicies when those were given. 2.5.29.32.0 (anyPolicy) when every policy is accepted along the chain.
public IReadOnlyList<string> ValidPolicies { get; }Property Value
Section titled “Property Value”ValidationTime
Section titled “ ValidationTime”The time certificates were checked at.
public DateTimeOffset ValidationTime { get; }