There are several ways to create a CAdES signature with SecureBlackbox. One of the simplest of them is to use the TElCAdESSignatureProcessor class. Whilst creating an advanced signature is generally a nontrivial and fairly sophisticated task, TElCAdESSignatureProcessor aims to do most of the job internally and transparently to the user. TElCAdESSignatureProcessor is capable of creating CAdES signatures of all the subtypes defined in the standard (CAdES-BES, -EPES, -T, -C, -X, -XL, and -A). It can also upgrade CAdES signatures of a 'lower' subtype (e.g., CAdES-T) to an 'upper' one (e.g., CAdES-XL or CAdES-A).

Below you will find a collection of code snippets that illustrate the use of the TElCAdESSignatureProcessor class.

Content

• Creating a CAdES-BES Signature
• Creating a CAdES-EPES Signature
• Creating a CAdES-T Signature
• Creating a CAdES-C Signature
• Creating a CAdES-X Signature
• Creating a CAdES-XL Signature
• Creating a CAdES-A (Archival) Signature
• Preparing and Tuning the TElCAdESSignatureProcessor Object
• Registering Revocation Retriever Factories
• References

Creating a CAdES-BES Signature

CAdES-BES ([CADES, p. 4.3.1]) is the simplest subtype of CAdES signatures, which only contain the digital signature itself and a collection of mandatory signed attributes (the message digest, content type, and signing certificate). A CAdES-BES signature can be created with the following code:

[Delphi]

// Creating an instance of the signature processor.
CAdESProcessor := TElCAdESSignatureProcessor.Create();
try
  // Creating an instance of the signed message class.
  CMS := TElSignedCMSMessage.Create(nil);
  try
    // Creating a NEW signed message.
    CMS.CreateNew(SourceStream, 0, SourceStream.Size);

    // Adding a signature.
    Sig := CMS.Signatures[CMS.AddSignature()];

    // Binding the signature to the CAdES processor.
    CAdESProcessor.Signature := Sig;

    // Creating the signature.
    CAdESProcessor.CreateBES(Cert);

    // Saving the CMS.
    CMSStream := TFileStream.Create('signature-BES.bin', fmCreate);
    try
      CMS.Save(CMSStream);
    finally
      FreeAndNil(CMSStream);
    end;
  finally
    FreeAndNil(CMS);
  end;
finally
  FreeAndNil(CAdESProcessor);
end;

[C#]

// Creating an instance of the signature processor.
TElCAdESSignatureProcessor processor = new TElCAdESSignatureProcessor();
try
{
  // Creating an instance of the signed message class.
  TElSignedCMSMessage cms = new TElSignedCMSMessage();
  try
  {
    // Creating a NEW signed message.
    cms.CreateNew(sourceStream, 0, sourceStream.Length);

    // Adding a signature.
    TElCMSSignature sig = cms.get_Signatures(cms.AddSignature());

    // Binding the signature to the CAdES processor.
    processor.Signature = sig;

    // Creating the signature.
    processor.CreateBES(cert);

    // Saving the CMS.
    FileStream cmsStream = new FileStream(“signature-BES.bin”, FileMode.Create);
    try
    {
      cms.Save(cmsStream);
    }
    finally
    {
      cmsStream.Close();
    }
  }
  finally
  {
    cms.Dispose();
  }
}
finally
{
  processor.Dispose();
}

In the above code the SourceStream object should contain the data to be signed and should be positioned to its beginning, and the Cert object should reference a valid signing certificate with the associated private key. These requirements apply to all sample code snippets below.

Creating a CAdES-EPES Signature

CAdES-EPES ([CADES, p. 4.3.2]) is the second possible subtype of the CAdES signature, which references a signature policy in accordance with which the signature should be created and verified. The relevant code follows:

[Delphi]

// Creating an instance of the signature processor.
CAdESProcessor := TElCAdESSignatureProcessor.Create();
try
  // Creating an instance of the signed message class.
  CMS := TElSignedCMSMessage.Create(nil);
  try
    // Creating a NEW signed message.
    CMS.CreateNew(SourceStream, 0, SourceStream.Size);

    // Adding a signature.
    Sig := CMS.Signatures[CMS.AddSignature()];

    // Binding the signature to the CAdES processor.
    CAdESProcessor.Signature := Sig;

    // Creating the signature.
    CAdESProcessor.CreateEPES(Cert,
      StrToOID('1.3.6.1.4.1.34850.20001.32.1.23'),
      SB_ALGORITHM_DGST_SHA1,
      PolicyHash
    );

    // Saving the CMS.
    CMSStream := TFileStream.Create('signature-EPES.bin', fmCreate);
    try
      CMS.Save(CMSStream);
    finally
      FreeAndNil(CMSStream);
    end;
  finally
    FreeAndNil(CMS);
  end;
finally
  FreeAndNil(CAdESProcessor);
end;

[C#]

// Creating an instance of the signature processor.
TElCAdESSignatureProcessor processor = new TElCAdESSignatureProcessor();
try
{
  // Creating an instance of the signed message class.
  TElSignedCMSMessage cms = new TElSignedCMSMessage();
  try
  {
    // Creating a NEW signed message.
    cms.CreateNew(sourceStream, 0, sourceStream.Length);

    // Adding a signature.
    TElCMSSignature sig = cms.get_Signatures(cms.AddSignature());

    // Binding the signature to the CAdES processor.
    processor.Signature = sig;

    // Creating the signature.
    processor.CreateEPES(cert,
      SBStrUtils.Unit.StrToOID(“1.3.6.1.4.1.34850.20001.32.1.23”),
      SBConstants.Unit.SB_ALGORITHM_DGST_SHA1,
      policyHash
    );

    // Saving the CMS.
    FileStream cmsStream = new FileStream(“signature-EPES.bin”, FileMode.Create);
    try
    {
      cms.Save(cmsStream);
    }
    finally
    {
      cmsStream.Close();
    }
  }
  finally
  {
    cms.Dispose();
  }
}
finally
{
  processor.Dispose();
}

Additional parameters of the CreateEPES() method are expected to contain the following values:

• PolicyID: the object identifier of the applicable signature policy.
• PolicyHashAlg: the hash algorithm used to calculate the policy hash.
• PolicyHash: the result of the hash function applied to the DER encoded policy file.

Creating a CAdES-T Signature

CAdES-T ([CADES, p. 4.4.1]) extends CAdES-BES and CAdES-EPES with an external timestamp that certifies the time of signing. To be able to create CAdES-T signatures you must have access to an online TSA service that is capable of producing RFC3161-compliant timestamps.

[Delphi]

// Creating an instance of the signature processor.
CAdESProcessor := TElCAdESSignatureProcessor.Create();
try
  // Creating an instance of the signed message class.
  CMS := TElSignedCMSMessage.Create(nil);
  try
    // Creating a NEW signed message.
    CMS.CreateNew(SourceStream, 0, SourceStream.Size);

    // Adding a signature.
    Sig := CMS.Signatures[CMS.AddSignature()];

    // Binding the signature to the CAdES processor.
    CAdESProcessor.Signature := Sig;

    // Creating timestamping components.
    HttpClient := TElHTTPSClient.Create(nil);
    try
      // (!) Remember to handle the HttpClient's OnCertificateValidate
      // event if the TSA server is accessible via HTTPS protocol.

      TspClient := TElHTTPTSPClient.Create(nil);
      try
        TspClient.HTTPClient := HttpClient;
        TspClient.URL := “http://tsa.myserver.com”;
        HttpClient.SocketTimeout := 20000; // 20 seconds

        // Creating the signature.
        CAdESProcessor.CreateT(Cert, TspClient);

        // Saving the CMS.
        CMSStream := TFileStream.Create('signature-T.bin', fmCreate);
        try
          CMS.Save(CMSStream);
        finally
          FreeAndNil(CMSStream);
        end;
      finally
        FreeAndNil(TspClient);
      end;
    finally
      FreeAndNil(HttpClient);
    end;
  finally
    FreeAndNil(CMS);
  end;
finally
  FreeAndNil(CAdESProcessor);
end;

[C#]

// Creating an instance of the signature processor.
TElCAdESSignatureProcessor processor = new TElCAdESSignatureProcessor();
try
{
  // Creating an instance of the signed message class.
  TElSignedCMSMessage cms = new TElSignedCMSMessage();
  try
  {
    // Creating a NEW signed message.
    cms.CreateNew(sourceStream, 0, sourceStream.Length);

    // Adding a signature.
    TElCMSSignature sig = cms.get_Signatures(cms.AddSignature());

    // Binding the signature to the CAdES processor.
    processor.Signature = sig;

    // Creating timestamping components.
    httpClient = new TElHTTPSClient();
    try
    {
      // (!) Remember to handle the httpClient's OnCertificateValidate
      // event if the TSA server is accessible via HTTPS protocol.

      tspClient = new TElHTTPTSPClient();
      try
      {
        tspClient.HTTPClient = httpClient;
        tspClient.URL = “http://tsa.myserver.com”;
        httpClient.SocketTimeout = 20000; // 20 seconds

        // Creating the signature.
        processor.CreateT(cert, tspClient);

        // Saving the CMS.
        FileStream cmsStream = new FileStream(“signature-T.bin”, FileMode.Create);
        try
        {
          cms.Save(cmsStream);
        }
        finally
        {
          cmsStream.Close();
        }
      }
      finally
      {
        tspClient.Dispose();
      }
    }
    finally
    {
      httpClient.Dispose();
    }
  }
  finally
  {
    cms.Dispose();
  }
}
finally
{
  processor.Dispose();
}

The CreateT() method creates a CAdES-BES message and applies a timestamp to it.

Creating a CAdES-C Signature

CAdES-C ([CADES, p. 4.4.2]) extends a signature of the CAdES-T type with complete certificate and revocation element references to allow the verifier to reconstruct the PKI environment in its revision at the moment of signing. Only including the references and not the whole elements themselves helps reduce the signature size for the cases where verifiers are known to have access to all past revisions of the validation elements.

[Delphi]

// Creating an instance of signature processor.
CAdESProcessor := TElCAdESSignatureProcessor.Create();
try
  // Creating an instance of the signed message class.
  CMS := TElSignedCMSMessage.Create(nil);
  try
    // Creating NEW signed message.
    CMS.CreateNew(SourceStream, 0, SourceStream.Size);

    // Adding a signature.
    Sig := CMS.Signatures[CMS.AddSignature()];

    // Binding the signature to the CAdES processor.
    CAdESProcessor.Signature := Sig;

    // Creating timestamping components.
    HttpClient := TElHTTPSClient.Create(nil);
    try
      // (!) Remember to handle the HttpClient's OnCertificateValidate
      // event if the TSA server is accessible via HTTPS protocol.

      TspClient := TElHTTPTSPClient.Create(nil);
      try
        TspClient.HTTPClient := HttpClient;
        TspClient.URL := “http://tsa.myserver.com”;
        HttpClient.SocketTimeout := 20000; // 20 seconds

        // Creating the signature.
        CAdESProcessor.CreateC(Cert, TspClient);

        // Saving the CMS.
        CMSStream := TFileStream.Create('signature-C.bin', fmCreate);
        try
          CMS.Save(CMSStream);
        finally
          FreeAndNil(CMSStream);
        end;
      finally
        FreeAndNil(TspClient);
      end;
    finally
      FreeAndNil(HttpClient);
    end;
  finally
    FreeAndNil(CMS);
  end;
finally
  FreeAndNil(CAdESProcessor);
end;

[C#]

// Creating an instance of signature processor.
TElCAdESSignatureProcessor processor = new TElCAdESSignatureProcessor();
try
{
  // Creating an instance of the signed message class.
  TElSignedCMSMessage cms = new TElSignedCMSMessage();
  try
  {
    // Creating NEW signed message.
    cms.CreateNew(sourceStream, 0, sourceStream.Length);

    // Adding a signature.
    TElCMSSignature sig = cms.get_Signatures(cms.AddSignature());

    // Binding the signature to the CAdES processor.
    processor.Signature = sig;

    // Creating timestamping components.
    httpClient = new TElHTTPSClient();
    try
    {
      // (!) Remember to handle the httpClient's OnCertificateValidate
      // event if the TSA server is accessible via HTTPS protocol.

      tspClient = new TElHTTPTSPClient();
      try
      {
        tspClient.HTTPClient = httpClient;
        tspClient.URL = “http://tsa.myserver.com”;
        httpClient.SocketTimeout = 20000; // 20 seconds

        // Creating the signature.
        processor.CreateC(cert, tspClient);

        // Saving the CMS.
        FileStream cmsStream = new FileStream(“signature-C.bin”, FileMode.Create);
        try
        {
          cms.Save(cmsStream);
        }
        finally
        {
          cmsStream.Close();
        }
      }
      finally
      {
        tspClient.Dispose();
      }
    }
    finally
    {
      httpClient.Dispose();
    }
  }
  finally
  {
    cms.Dispose();
  }
}
finally
{
  processor.Dispose();
}

CAdES-C is the first signature subtype so far to involve deep certificate validation during the signing process. The procedure of deep validation consists of the construction of the complete certificate chain and validation of each certificate using offline and/or online revocation information provisioning services (CRL and OCSP responders). Please remember to register relevant component factories before signing (see below) if you plan to use online PKI services in your project.

Creating a CAdES-X Signature

CAdES-X (types 1 and 2) ([CADES, pp. 4.4.3.2 and 4.4.3.3]) extends a CAdES-C signature with a validation timestamp over the entire CAdES-C structure (type 1) or the certificate and revocation references only (type 2). The validation timestamp provides an external trusted third party certification of the validation elements, thus allowing verifiers to establish the integrity of those elements at the moment of signing.

[Delphi]

// Creating an instance of signature processor.
CAdESProcessor := TElCAdESSignatureProcessor.Create();
try
  // Creating an instance of the signed message class.
  CMS := TElSignedCMSMessage.Create(nil);
  try
    // Creating NEW signed message.
    CMS.CreateNew(SourceStream, 0, SourceStream.Size);

    // Adding a signature.
    Sig := CMS.Signatures[CMS.AddSignature()];

    // Binding the signature to the CAdES processor.
    CAdESProcessor.Signature := Sig;

    // Creating timestamping components.
    HttpClient := TElHTTPSClient.Create(nil);
    try
      // (!) Remember to handle the HttpClient's OnCertificateValidate
      // event if the TSA server is accessible via HTTPS protocol.

      TspClient := TElHTTPTSPClient.Create(nil);
      try
        TspClient.HTTPClient := HttpClient;
        TspClient.URL := “http://tsa.myserver.com”;
        HttpClient.SocketTimeout := 20000; // 20 seconds

        // Creating the signature.
        CAdESProcessor.CreateX1(Cert, TspClient, TspClient);

        // Saving the CMS.
        CMSStream := TFileStream.Create('signature-X1.bin', fmCreate);
        try
          CMS.Save(CMSStream);
        finally
          FreeAndNil(CMSStream);
        end;
      finally
        FreeAndNil(TspClient);
      end;
    finally
      FreeAndNil(HttpClient);
    end;
  finally
    FreeAndNil(CMS);
  end;
finally
  FreeAndNil(CAdESProcessor);
end;

[C#]

// Creating an instance of signature processor.
TElCAdESSignatureProcessor processor = new TElCAdESSignatureProcessor();
try
{
  // Creating an instance of the signed message class.
  TElSignedCMSMessage cms = new TElSignedCMSMessage();
  try
  {
    // Creating NEW signed message.
    cms.CreateNew(sourceStream, 0, sourceStream.Length);

    // Adding a signature.
    TElCMSSignature sig = cms.get_Signatures(cms.AddSignature());

    // Binding the signature to the CAdES processor.
    processor.Signature = sig;

    // Creating timestamping components.
    httpClient = new TElHTTPSClient();
    try
    {
      // (!) Remember to handle the httpClient's OnCertificateValidate
      // event if the TSA server is accessible via HTTPS protocol.

      tspClient = new TElHTTPTSPClient();
      try
      {
        tspClient.HTTPClient = httpClient;
        tspClient.URL = “http://tsa.myserver.com”;
        httpClient.SocketTimeout = 20000; // 20 seconds

        // Creating the signature.
        processor.CreateX1(cert, tspClient, tspClient);

        // Saving the CMS.
        FileStream cmsStream = new FileStream(“signature-X1.bin”, FileMode.Create);
        try
        {
          cms.Save(cmsStream);
        }
        finally
        {
          cmsStream.Close();
        }
      }
      finally
      {
        tspClient.Dispose();
      }
    }
    finally
    {
      httpClient.Dispose();
    }
  }
  finally
  {
    cms.Dispose();
  }
}
finally
{
  processor.Dispose();
}

Note that the CreateX1() and CreateX2() methods accept two TSP client objects. The first object is used to request a signature timestamp (used to produce a CAdES-T signature), and the second one to request a validation timestamp over the CAdES-C blob or the validation references.

Just as in the CAdES-C case, the creation of CAdES-X signatures involves deep certificate validation.

Creating a CAdES-XL Signature

CAdES-XL ([CADES, p. 4.4.3.4]) is obtained from CAdES-X by inserting the values of the referenced validation elements (certificates, CRLs, and OCSP responses) to the signature blob. The CAdES-XL signature is thus a self-contained signature that does not require any external certificate or revocation provisioning services to be successfully validated.

[Delphi]

// Creating an instance of signature processor.
CAdESProcessor := TElCAdESSignatureProcessor.Create();
try
  // Creating an instance of the signed message class.
  CMS := TElSignedCMSMessage.Create(nil);
  try
    // Creating NEW signed message.
    CMS.CreateNew(SourceStream, 0, SourceStream.Size);

    // Adding a signature.
    Sig := CMS.Signatures[CMS.AddSignature()];

    // Binding the signature to the CAdES processor.
    CAdESProcessor.Signature := Sig;

    // Creating timestamping components.
    HttpClient := TElHTTPSClient.Create(nil);
    try
      // (!) Remember to handle the HttpClient's OnCertificateValidate
      // event if the TSA server is accessible via HTTPS protocol.

      TspClient := TElHTTPTSPClient.Create(nil);
      try
        TspClient.HTTPClient := HttpClient;
        TspClient.URL := “http://tsa.myserver.com”;
        HttpClient.SocketTimeout := 20000; // 20 seconds

        // Creating the signature.
        CAdESProcessor.CreateXL1(Cert, TspClient, TspClient);

        // Saving the CMS.
        CMSStream := TFileStream.Create('signature-XL1.bin', fmCreate);
        try
          CMS.Save(CMSStream);
        finally
          FreeAndNil(CMSStream);
        end;
      finally
        FreeAndNil(TspClient);
      end;
    finally
      FreeAndNil(HttpClient);
    end;
  finally
    FreeAndNil(CMS);
  end;
finally
  FreeAndNil(CAdESProcessor);
end;

[C#]

// Creating an instance of signature processor.
TElCAdESSignatureProcessor processor = new TElCAdESSignatureProcessor();
try
{
  // Creating an instance of the signed message class.
  TElSignedCMSMessage cms = new TElSignedCMSMessage();
  try
  {
    // Creating NEW signed message.
    cms.CreateNew(sourceStream, 0, sourceStream.Length);

    // Adding a signature.
    TElCMSSignature sig = cms.get_Signatures(cms.AddSignature());

    // Binding the signature to the CAdES processor.
    processor.Signature = sig;

    // Creating timestamping components.
    httpClient = new TElHTTPSClient();
    try
    {
      // (!) Remember to handle the httpClient's OnCertificateValidate
      // event if the TSA server is accessible via HTTPS protocol.

      tspClient = new TElHTTPTSPClient();
      try
      {
        tspClient.HTTPClient = httpClient;
        tspClient.URL = “http://tsa.myserver.com”;
        httpClient.SocketTimeout = 20000; // 20 seconds

        // Creating the signature.
        processor.CreateXL1(cert, tspClient, tspClient);

        // Saving the CMS.
        FileStream cmsStream = new FileStream(“signature-XL1.bin”, FileMode.Create);
        try
        {
          cms.Save(cmsStream);
        }
        finally
        {
          cmsStream.Close();
        }
      }
      finally
      {
        tspClient.Dispose();
      }
    }
    finally
    {
      httpClient.Dispose();
    }
  }
  finally
  {
    cms.Dispose();
  }
}
finally
{
  processor.Dispose();
}

Note that the CreateXL1() and CreateXL2() methods accept two TSP client objects. The first object is used to request a signature timestamp (used to produce a CAdES-T signature), and the second one to request a validation timestamp over the CAdES-C blob or the validation references.

Just as in the CAdES-C and CAdES-X cases, the creation of CAdES-X signatures involves deep certificate validation.

Creating a CAdES-A (Archival) Signature

The CAdES-A subtype ([CADES, p. 4.4.4]) builds on a CAdES-C or CAdES-XL signature by adding one or more archival timestamps. CAdES-A is used for long-term archival of electronic signatures. Successive timestamps protect the whole signature material against vulnerable hashing algorithms and the expiration/termination of the PKI services used at the time when the signature and/or previous archival timestamps were created.

[Delphi]

// Creating an instance of signature processor.
CAdESProcessor := TElCAdESSignatureProcessor.Create();
try
  // Creating an instance of the signed message class.
  CMS := TElSignedCMSMessage.Create(nil);
  try
    // Opening existing signed message.
    CMS.Open(SigStream, nil);

    // Obtaining the signature object.
    Sig := CMS.Signatures[0];

    // Binding the signature to the CAdES processor.
    CAdESProcessor.Signature := Sig;

    // Creating timestamping components.
    HttpClient := TElHTTPSClient.Create(nil);
    try
      // (!) Remember to handle the HttpClient's OnCertificateValidate
      // event if the TSA server is accessible via HTTPS protocol.

      TspClient := TElHTTPTSPClient.Create(nil);
      try
        TspClient.HTTPClient := HttpClient;
        TspClient.URL := “http://tsa.myserver.com”;
        HttpClient.SocketTimeout := 20000; // 20 seconds

        // Creating the signature.
        if FCAdESProcessor.IsT() then
          // A signature timestamp is already included.
          CAdESProcessor.UpgradeToA(TspClient)
        else
          // No signature timestamp yet, passing two TSP client objects.
          CAdESProcessor.UpgradeToA(TspClient, TspClient);

        // Saving the CMS.
        CMSStream := TFileStream.Create('signature-A.bin', fmCreate);
        try
          CMS.Save(CMSStream);
        finally
          FreeAndNil(CMSStream);
        end;
      finally
        FreeAndNil(TspClient);
      end;
    finally
      FreeAndNil(HttpClient);
    end;
  finally
    FreeAndNil(CMS);
  end;
finally
  FreeAndNil(CAdESProcessor);
end;

[C#]

// Creating an instance of signature processor.
TElCAdESSignatureProcessor processor = new TElCAdESSignatureProcessor();
try
{
  // Creating an instance of the signed message class.
  TElSignedCMSMessage cms = new TElSignedCMSMessage();
  try
  {
    // Creating NEW signed message.
    cms.Open(sigStream, null, 0, 0);

    // Adding a signature.
    TElCMSSignature sig = cms.get_Signatures(0);

    // Binding the signature to the CAdES processor.
    processor.Signature = sig;

    // Creating timestamping components.
    httpClient = new TElHTTPSClient();
    try
    {
      // (!) Remember to handle the httpClient's OnCertificateValidate
      // event if the TSA server is accessible via HTTPS protocol.

      tspClient = new TElHTTPTSPClient();
      try
      {
        tspClient.HTTPClient = httpClient;
        tspClient.URL = “http://tsa.myserver.com”;
        httpClient.SocketTimeout = 20000; // 20 seconds

        // Creating the signature.
        if (processor.IsT())
        {
          // A signature timestamp is already included.
          processor.UpgradeToA(tspClient)
        }
        else
        {
          // No signature timestamp yet, passing two TSP client objects.
          processor.UpgradeToA(tspClient, tspClient);
        }

        // Saving the CMS.
        FileStream cmsStream = new FileStream(“signature-A.bin”, FileMode.Create);
        try
        {
          cms.Save(cmsStream);
        }
        finally
        {
          cmsStream.Close();
        }
      }
      finally
      {
        tspClient.Dispose();
      }
    }
    finally
    {
      httpClient.Dispose();
    }
  }
  finally
  {
    cms.Dispose();
  }
}
finally
{
  processor.Dispose();
}

Note that unlike previous subtypes, you can't create a CAdES-A signature from scratch. Instead, you should create a signature of a lower subtype (e.g., CAdES-XL) and then upgrade it to CAdES-A.

Preparing and Tuning the TElCAdESSignatureProcessor Object

Each PKI environment is different, so you will probably need to tune up the TElCAdESSignatureProcessor object to match your particular one. Not only are there are plenty of configuration aspects that might affect the deep validation process (such as the locations of revocation status provisioning sources and connectivity options), but also the CAdES standard as well had undertaken a number of reviews, improvements, and breaking changes since it appeared in 2001.

Sometimes there is a need to get a detailed trace of the chain validation process (to find a reason for a reported validation issue, for example). TElCAdESSignatureProcessor performs the validation internally with the use of the TElX509CertificateValidator component. To get access to this component and a collection of its tracing events, handle the OnCertValidatorPrepared event.

You can also use the event to perform a finer tuning of the TElX509CertificateValidator component.

Registering Revocation Retriever Factories

The TElCAdESSignatureProcessor and TElX509CertificateValidator classes use revocation information retrievers to obtain various pieces of validation information during the deep validation process. The retrievers are created by four object factories, responsible for different kinds of online services. In most public PKI environments, it is enough to register the HTTP OCSP and HTTP CRL factories, while private and corporate environments might require LDAP connectivity as well. In projects built against the .NET, Java, and C++ product editions the factories should be populated manually with the following code:

// Registering HTTP OCSP client
SBHTTPOCSPClient.Unit.RegisterHTTPOCSPClientFactory();

// Registering HTTP CRL retriever
SBHTTPCRL.Unit.RegisterHTTPCRLRetrieverFactory();

// Registering LDAP CRL retriever
SBLDAPCRL.Unit.RegisterLDAPCRLRetrieverFactory();

// Registering LDAP certificate retriever
SBLDAPCertRetriever.Unit.RegisterLDAPCertificateRetrieverFactory();

In Delphi environments the retrievers are registered automatically, provided that you've referenced the corresponding units in your project's or form's uses clause:

uses
  SBHTTPOCSPClient, SBHTTPCRL, SBLDAPCRL, SBLDAPCertRetriever;

References

[CADES]: Electronic Signatures and Infrastructures (ESI); CMS Advanced Electronic Signatures (CAdES), ETSI TS 101 733 V2.1.1.