PdfValidationOptions class
Namespace: PdfNetStack.Signing
Assembly: PdfNetStack.dll
Package: PdfNetStack
What Verify checks certificates against.
public sealed record PdfValidationOptions : IEquatable<PdfValidationOptions>Inheritance
Implements
IEquatable<PdfValidationOptions>
Properties
Section titled “Properties”AcceptablePolicies
Section titled “ AcceptablePolicies”The certificate policies the chain must be valid for, as object identifiers (the user-initial-policy-set of RFC 5280, 6.1.1). Empty, the default, accepts any policy, and the chain then passes the policy check unless a certificate’s policy constraints require an explicit policy. With policies given, the chain must be valid for at least one of them or for anyPolicy.
public IReadOnlyList<string> AcceptablePolicies { get; init; }Property Value
Section titled “Property Value”Certificates
Section titled “ Certificates”Extra certificates, such as intermediate CAs, for building chains.
public IReadOnlyList<X509Certificate2> Certificates { get; init; }Property Value
Section titled “Property Value”IReadOnlyList<X509Certificate2>
CheckRevocation
Section titled “ CheckRevocation”Check revocation of every certificate below the trust anchor. Default true.
public bool CheckRevocation { get; init; }Property Value
Section titled “Property Value”InhibitAnyPolicy
Section titled “ InhibitAnyPolicy”Do not let anyPolicy in a certificate stand for every policy (initial-any-policy-inhibit). Default false.
public bool InhibitAnyPolicy { get; init; }Property Value
Section titled “Property Value”InhibitPolicyMapping
Section titled “ InhibitPolicyMapping”Ignore policy mappings: a mapped policy no longer counts (initial-policy-mapping-inhibit). Default false.
public bool InhibitPolicyMapping { get; init; }Property Value
Section titled “Property Value”RequireExplicitPolicy
Section titled “ RequireExplicitPolicy”Require the chain to be valid for a policy even when no certificate asks for that (initial-explicit-policy). Default false.
public bool RequireExplicitPolicy { get; init; }Property Value
Section titled “Property Value”RevocationSource
Section titled “ RevocationSource”Revocation data beyond what the document’s security store (DSS) holds; null for none.
public IPdfRevocationSource? RevocationSource { get; init; }Property Value
Section titled “Property Value”TrustAnchors
Section titled “ TrustAnchors”The certificates trusted as roots of a chain, usually root CAs. With none, chains are built but Chain is not checked.
public IReadOnlyList<X509Certificate2> TrustAnchors { get; init; }Property Value
Section titled “Property Value”IReadOnlyList<X509Certificate2>
TrustedLists
Section titled “ TrustedLists”Trusted lists (ETSI TS 119 612) to confirm qualified status against, such as the EU list of trusted lists and the national lists it points to, read with Load. Lists whose signature did not pass, or that have expired, are not used. With lists, every signer gets TrustedListQualification and every timestamp QualifiedTimestamp. Empty by default.
public IReadOnlyList<PdfTrustedList> TrustedLists { get; init; }Property Value
Section titled “Property Value”TrustedListsAsTrustAnchors
Section titled “ TrustedListsAsTrustAnchors”Count certificates of the usable TrustedLists as trust anchors, beside TrustAnchors, as the EU trust model does. Default true.
public bool TrustedListsAsTrustAnchors { get; init; }Property Value
Section titled “Property Value”Remarks
Section titled “Remarks”Only the identities of CA services (CA/QC and CA/PKC) anchor a chain, and only for a validation time at which the service’s entry in force (its current information or a history entry) has an approved status: granted, recognised at national level, or before eIDAS under supervision, in cessation or accredited, with no critical extension the library does not interpret. TSA/QTST and TSA services anchor a time stamp authority’s chain under the same rules, never a signer’s. OCSP, CRL and other services, and services that are withdrawn, deprecated or were never approved, anchor nothing. The default stays true because a list is only used when its XML signature verified against certificates the application supplied for it, and because without anchors chains are not checked, so the trusted list qualification would always be Indeterminate. Set it to false to anchor chains on TrustAnchors alone and use the lists only for qualification.
UseDocumentSecurityStore
Section titled “ UseDocumentSecurityStore”Use the certificates, OCSP responses and CRLs in the document’s security store. Default true.
public bool UseDocumentSecurityStore { get; init; }Property Value
Section titled “Property Value”ValidationTime
Section titled “ ValidationTime”The time to check certificates at; null to use the time of a valid timestamp, or the current time when there is none.
public DateTimeOffset? ValidationTime { get; init; }