SecureBlackbox 2020 macOS Edition

Questions / Feedback?

CertificateValidator Configuration

The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

CertificateValidator Configuration Settings

CacheValidityTime:   Time period during which to keep validation cache.

The validity period of the cached validation results in milliseconds.

CheckStrongAlgorithmForTrusted:   Whether to check a 'strong' hash algorithm for trusted certificates.

Whether to check a 'strong' hash algorithm for trusted certificates.

CheckValidityPeriodForTrusted:   Whether to check validity period for trusted certificates.

Whether to check validity period for trusted certificates.

CrossCertificationValidationStrategy:   Defines how the cross certification validation is performed.

This property tells the class how to perform the cross certification validation. Supported values: csvSmart = 0 csvOptimistic = 1 csvPessimistic = 2 csvNoCrossCertification = 3

In the optimistic strategy, positive validation results are kept, and negative ones are ignored. If there are no good certificates in the chain, the validation proceeds using self-signed certificates. Smart is the same as optimistic.

In the pessimistic strategy, even one negative validation result makes the whole process to fail.

ForceCompleteChainValidationForTrusted:   Whether to validate the whole chain.

Whether the whole certificate chain down to the CA certificate should be validated for trusted certificates.

ForceRevocationCheckForRoot:   Whether to check revocation info for root certificates.

Specifies if revocation information should be checked for the root certificate.

IgnoreBadOCSPChains:   Whether to ignore bad OCSP chains during validation.

Whether to ignore bad OCSP chains during validation.

IgnoreCABasicConstraints:   Whether to ignore the Basic Constraints extension for the CA certificates.

Whether to ignore the Basic Constraints extension for the CA certificates.

IgnoreCAKeyUsage:   Whether to ignore Key Usage extension for CA certificates.

Whether to ignore Key Usage extension for CA certificates.

IgnoreCANameConstraints:   Whether to ignore the Name Constraints extension for the CA certificates.

Whether to ignore the Name Constraints extension for the CA certificates.

IgnoreOCSPNoCheckExtension:   Whether OCSP NoCheck extension should be ignored.

Set this property to false to make the validation engine ignore the OCSP no-check extension. You would normally need to set this property when validating severely non-compliant chains that misuse the extension, causing chain loops or other validation issues.

IgnoreRevocationKeyUsage:   Whether to check the CA certs used to sign revocation info.

Whether the issuer (CA) certificates should be checked if their key usage extension (when available) allows using them to sign revocation information.

IgnoreSSLKeyUsage:   Whether to check the CA certs used in SSL/TLS.

Whether the issuer (CA) certificates should be checked if their key usage extension (when available) allows using these certificates in SSL protocol communications.

IgnoreSystemTrust:   Whether trusted Windows Certificate Stores should be treated as trusted.

Specifies whether, during chain validation, the component should respect the trust to CA certificates as configured in the operating system. In Windows this effectively defines whether the component should trust the certificates residing in the Trusted Root Certification Authorities store.

If IgnoreSystemTrust is True, certificates residing in the trusted root store are treated as if they are known, rather than trusted. Only certificates provided via other means (such as TrustedCertificates property) are considered trusted.

ImplicitlyTrustSelfSignedCertificates:   Whether to trust self-signed certificates.

Set this property to True to implicitly trust all self-signed certificates.

LookupCRLByNameIfDPNotPresent:   Whether to look for implicit CRL Distribution Points.

Whether to look for implicit CRL Distribution Points (DPs) if no DPs are available.

PromoteLongOCSPResponses:   Whether long OCSP responses are requested.

Set this property to True to force the class to publish 'long' form of OCSP responses. Otherwise, only BasicOCSPResponse blobs are promoted.

RevocationMomentGracePeriod:   Grace period for revocation information propagation.

Use this property to specify the grace period (in seconds). Grace period allows the certificate revocation information to propagate through the revocation process.

SkipSubjectNameIfAltNameExists:   Whether to check CommonName if SubjectAltName is present.

RFC 6125 requires that the SubjectAltName (SAN) extension should be checked if it is present. In such case, SubjectName.CommonName (CN) should not be checked. This contradicts to some existing certificates where, for instance, CN contains "a.com" and SAN is "www.a.com".

UseMicrosoftCTL:   Enables or disables automatic use of Microsoft online certificate trust list.

Enable this property to make the chain validation module automatically look up missing CA certificates in the public Windows Update repository.

ValidateInvalidCertificates:   Whether to do all checks on invalid certificates.

If ValidateInvalidCertificates is True and certain certificate check determines that the certificate is not valid, further checks are done anyway. This allows to create a full validation report.

When ValidateInvalidCertificates is False and a certificate is found to be not valid, further checks of this certificate are not performed.

WeakAlgorithmHandlingMode:   How to handle certificates signed with a 'weak' hash algorithm.

Defines how to handle the certificates signed using a 'weak' hash algorithm.

Supported values: wahmIgnore = 0 wahmWarning = 1 wahmError = 2

TSL Configuration Settings

CustomTSLs:   Specifies the custom TSLs.

Use this property to specify the custom TSLs (Trust Service status Lists) to the validator. The URLs list is comma-separated.

QualifiedStatus:   Indicates a qualified electronic signature.

Use this property to check if an electronic signature is created using a qualified device for creating electronic signatures and that relies on a qualified electronic signature certificate. This property return TSP service status URI.

TSLDistributionPoints:   Contains XML content of distribution points of the TSL used.

Use this property to get XML content of distribution points of the TSL used to obtain the qualified status of the certificate.

TSLDistributionPoints[Idx]:   Contains distribution point of the specified index of the TSL used.

Use this property to get distribution point of the specified index of the TSL used to obtain the qualified status of the certificate.

TSLHistoricalInformationPeriod:   Contains historical information period of the TSL used.

Use this property to get historical information period of the TSL used to obtain the qualified status of the certificate.

TSLLegalNotices:   Contains XML content of legal notices of the TSL used.

Use this property to get XML content of multilingual legal notices of the TSL used to obtain the qualified status of the certificate.

TSLLegalNotices[lang]:   Contains legal notices for the specified language of the TSL used.

Use this property to get legal notices for the specified language code (e.g. 'en') of the TSL used to obtain the qualified status of the certificate.

TSLListIssueDateTime:   Contains list issue date and time of the TSL used.

Use this property to get list issue date and time of the TSL used to obtain the qualified status of the certificate.

TSLNextUpdate:   Contains next update date and time of the TSL used.

Use this property to get next update date and time of the TSL used to obtain the qualified status of the certificate.

TSLPolicies:   Contains XML content of policies of the TSL used.

Use this property to get XML content of multilingual policies of the TSL used to obtain the qualified status of the certificate.

TSLPolicies[lang]:   Contains policies for the specified language of the TSL used.

Use this property to get policies for the specified language code (e.g. 'en') of the TSL used to obtain the qualified status of the certificate.

TSLSchemeExtensions:   Contains XML content of scheme extensions of the TSL used.

Use this property to get XML content of scheme extensions of the TSL used to obtain the qualified status of the certificate.

TSLSchemeExtensions[Idx]:   Contains XML content of scheme extension of the specified index of the TSL used.

Use this property to get XML content of scheme extension of the specified index of the TSL used to obtain the qualified status of the certificate.

TSLSchemeInformationURI:   Contains XML content of scheme information URI of the TSL used.

Use this property to get XML content of multilingual scheme information URI of the TSL used to obtain the qualified status of the certificate.

TSLSchemeInformationURI[lang]:   Contains scheme information URI for the specified language of the TSL used.

Use this property to get scheme information URI for the specified language code (e.g. 'en') of the TSL used to obtain the qualified status of the certificate.

TSLSchemeName:   Contains XML content of scheme name of the TSL used.

Use this property to get XML content of multilingual scheme name of the TSL used to obtain the qualified status of the certificate.

TSLSchemeName[lang]:   Contains scheme name for the specified language of the TSL used.

Use this property to get scheme name for the specified language code (e.g. 'en') of the TSL used to obtain the qualified status of the certificate.

TSLSchemeOperatorAddress:   Contains XML content of scheme operator address of the TSL used.

Use this property to get XML content of scheme operator address of the TSL used to obtain the qualified status of the certificate.

TSLSchemeOperatorName:   Contains XML content of scheme operator name of the TSL used.

Use this property to get XML content of multilingual scheme operator name of the TSL used to obtain the qualified status of the certificate.

TSLSchemeOperatorName[lang]:   Contains scheme operator name for the specified language of the TSL used.

Use this property to get scheme operator name for the specified language code (e.g. 'en') of the TSL used to obtain the qualified status of the certificate.

TSLSchemeTerritory:   Contains scheme territory of the TSL used.

Use this property to get scheme territory of the TSL used to obtain the qualified status of the certificate.

TSLSchemeTypeCommunityRules:   Contains XML content of scheme type/community/rules of the TSL used.

Use this property to get XML content of multilingual scheme type/community/rules of the TSL used to obtain the qualified status of the certificate.

TSLSchemeTypeCommunityRules[lang]:   Contains scheme type/community/rules for the specified language of the TSL used.

Use this property to get scheme type/community/rules for the specified language code (e.g. 'en') of the TSL used to obtain the qualified status of the certificate.

TSLSequenceNumber:   Contains sequence number of the TSL used.

Use this property to get sequence number of the TSL used to obtain the qualified status of the certificate.

TSLsRetrieveLog:   Contains the complete log of the TSLs retrieve.

Use this property to access the TSLs retrieve log produced by the class. The log can be very useful when investigating issues with TSL retrieve.

TSLStatusDeterminationApproach:   Contains status determination approach of the TSL used.

Use this property to get status determination approach of the TSL used to obtain the qualified status of the certificate.

TSLsValidationLog:   Contains the complete log of the TSLs validation.

Use this property to access the TSLs validation log produced by the class. The log can be very useful when investigating issues with TSL validation.

TSLTSPAdditionalServiceInformation:   Contains addtional service information of the TSP service used.

Use this property to get the list of addtional service information of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate. The URIs list is comma-separated.

TSLTSPAddress:   Contains XML content of the address of the TSP used.

Use this property to get XML content of the address of the TSP (Trust Service Provider) used to obtain the qualified status of the certificate.

TSLTSPHistoryInstance:   Indicates that TSP service history instance used.

Indicates whether or not the qualified status was obtained from the TSP (Trust Service Provider) service history instance.

TSLTSPHistoryInstanceAdditionalServiceInformation:   Contains addtional service information of the TSP service history instance used.

Use this property to get the list of addtional service information of the history instance of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate. The URIs list is comma-separated.

TSLTSPHistoryInstanceQualifiers:   Contains list of qualifiers of the TSP service history instance used.

Use this property to get the list of qualifiers of the history instance of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate. The URIs list is comma-separated.

TSLTSPHistoryInstanceServiceInformationExtensions:   Contains XML content of information extensions of the TSP service history instance used.

Use this property to get XML content of information extensions of the history instance of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPHistoryInstanceServiceInformationExtensions[Idx]:   Contains XML content of information extension of the specified index of the TSP service history instance used.

Use this property to get XML content of information extension of the specified index of the history instance of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPHistoryInstanceServiceName:   Contains XML content of name of the TSP service history instance used.

Use this property to get XML content of multilingual name of the history instance of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPHistoryInstanceServiceName[lang]:   Contains name for the specified language of the TSP service history instance used.

Use this property to get the name for the specified language code (e.g. 'en') of the history instance of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPHistoryInstanceServiceStatus:   Contains status of the TSP service history instance used.

Use this property to get the status of the history instance of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPHistoryInstanceServiceStatusStartingTime:   Contains status starting time of the TSP service history instance used.

Use this property to get the status starting time of the history instance of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPHistoryInstanceServiceTypeIdentifier:   Contains type identifier of the TSP service history instance used.

Use this property to get type identifier of the history instance of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPHistoryInstanceXML:   Contains XML content of the TSP service history instance used.

Use this property to get XML content of the history instance of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPInformationExtensions:   Contains XML content of information extensions of the TSP used.

Use this property to get XML content of information extensions of the TSP (Trust Service Provider) used to obtain the qualified status of the certificate.

TSLTSPInformationExtensions[Idx]:   Contains XML content of information extension of the specified index of the TSP used.

Use this property to get XML content of information extension of the specified index of the TSP (Trust Service Provider) used to obtain the qualified status of the certificate.

TSLTSPInformationURI:   Contains XML content of information URI of the TSP used.

Use this property to get XML content of multilingual information URI of the TSP (Trust Service Provider) used to obtain the qualified status of the certificate.

TSLTSPInformationURI[lang]:   Contains information URI for the specified language of the TSP used.

Use this property to get the information URI for the specified language code (e.g. 'en') of the TSP (Trust Service Provider) used to obtain the qualified status of the certificate.

TSLTSPName:   Contains XML content of name of the TSP used.

Use this property to get XML content of multilingual name of the TSP (Trust Service Provider) used to obtain the qualified status of the certificate.

TSLTSPName[lang]:   Contains name for the specified language of the TSP used.

Use this property to get the name for the specified language code (e.g. 'en') of the TSP (Trust Service Provider) used to obtain the qualified status of the certificate.

TSLTSPSchemeServiceDefinitionURI:   Contains XML content of scheme service definition URI of the TSP service used.

Use this property to get XML content of multilingual scheme service definition URI of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPSchemeServiceDefinitionURI[lang]:   Contains scheme service definition URI for the specified language of the TSP service used.

Use this property to get the scheme service definition URI for the specified language code (e.g. 'en') of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPServiceDefinitionURI:   Contains XML content of definition URI of the TSP service used.

Use this property to get XML content of multilingual definition URI of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPServiceDefinitionURI[lang]:   Contains definition URI for the specified language of the TSP service used.

Use this property to get the definition URI for the specified language code (e.g. 'en') of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPServiceInformationExtensions:   Contains XML content of information extensions of the TSP service used.

Use this property to get XML content of information extensions of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPServiceInformationExtensions[Idx]:   Contains XML content of information extension of the specified index of the TSP service used.

Use this property to get XML content of information extension of the specified index of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPServiceName:   Contains XML content of name of the TSP service used.

Use this property to get XML content of multilingual name of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPServiceName[lang]:   Contains name for the specified language of the TSP service used.

Use this property to get the name for the specified language code (e.g. 'en') of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPServiceQualifiers:   Contains list of qualifiers of the TSP service used.

Use this property to get the list of qualifiers of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate. The URIs list is comma-separated.

TSLTSPServiceStatus:   Contains status of the TSP service used.

Use this property to get the status of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPServiceStatusStartingTime:   Contains status starting time of the TSP service used.

Use this property to get the status starting time of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPServiceSupplyPoints:   Contains XML content of the supply points of the TSP service used.

Use this property to get XML content of the supply points of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPServiceTypeIdentifier:   Contains type identifier of the TSP service used.

Use this property to get type identifier of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPServiceXML:   Contains XML content of the TSP service used.

Use this property to get XML content of the TSP (Trust Service Provider) service used to obtain the qualified status of the certificate.

TSLTSPTradeName:   Contains XML content of trade name of the TSP used.

Use this property to get XML content of multilingual trade name of the TSP (Trust Service Provider) used to obtain the qualified status of the certificate.

TSLTSPTradeName[lang]:   Contains trade name for the specified language of the TSP used.

Use this property to get the trade name for the specified language code (e.g. 'en') of the TSP (Trust Service Provider) used to obtain the qualified status of the certificate.

TSLTSPXML:   Contains XML content of the TSP used.

Use this property to get XML content of the TSP (Trust Service Provider) used to obtain the qualified status of the certificate.

TSLType:   Contains TSL type of the TSL used.

Use this property to get TSL type of the TSL used to obtain the qualified status of the certificate.

TSLVersionIdentifier:   Contains version identifier of the TSL used.

Use this property to get version identifier of the TSL used to obtain the qualified status of the certificate.

TSLXML:   Contains XML content of the TSL used.

Use this property to get XML content of the TSL used to obtain the qualified status of the certificate.

Base Configuration Settings

CheckKeyIntegrityBeforeUse:   Enables or disable private key integrity check before use.

This global property enables or disables private key material check before each signing operation. This slows down performance a bit, but prevents a selection of attacks on RSA keys where keys with unknown origins are used.

You can switch this property off to improve performance if your project only uses known, good private keys.

CookieCaching:   Specifies whether a cookie cache should be used for HTTP(S) transports.

Set this property to enable or disable cookies caching for the class.

Supported values are:

offNo caching (default)
localLocal caching (supported for HTTPClient, RESTClient and SOAPClient only)
globalGlobal caching

Cookies:   Gets or sets local cookies for the class (supported for HTTPClient, RESTClient and SOAPClient only).

Use this property to get cookies from the internal cookie storage of the class and/or restore them back between application sessions.

DefDeriveKeyIterations:   Specifies the default key derivation algorithm iteration count.

This global property sets the default number of iterations for all supported key derivation algorithms. Note that you can provide the required number of iterations by using properties of the relevant key generation component; this global setting is used in scenarios where specific iteration count is not or cannot be provided.

EnableClientSideSSLFFDHE:   Enables or disables finite field DHE key exchange support in TLS clients.

This global property enables or disables support for finite field DHE key exchange methods in TLS clients. FF DHE is a slower algorithm if compared to EC DHE; enabling it may result in slower connections.

This setting only applies to sessions negotiated with TLS version 1.3.

GlobalCookies:   Gets or sets global cookies for all the HTTP transports.

Use this property to get cookies from the GLOBAL cookie storage or restore them back between application sessions. These cookies will be used by all the classes that have its CookieCaching property set to "global".

HttpUserAgent:   Specifies the user agent name to be used by all HTTP clients.

This global setting defines the User-Agent field of the HTTP request provides information about the software that initiates the request. This value will be used by all the HTTP clients including the ones used internally in other classes.

LogDestination:   Specifies the debug log destination.

Contains a comma-separated list of values that specifies where debug log should be dumped.

Supported values are:

fileFile
consoleConsole
systemlogSystem Log (supported for Android only)
debuggerDebugger (supported for VCL for Windows and .Net)

LogDetails:   Specifies the debug log details to dump.

Contains a comma-separated list of values that specifies which debug log details to dump.

Supported values are:

timeCurrent time
levelLevel
packagePackage name
moduleModule name
classClass name
methodMethod name
threadidThread Id
contenttypeContent type
contentContent
allAll details

LogFile:   Specifies the debug log filename.

Use this property to provide a path to the log file.

LogFilters:   Specifies the debug log filters.

Contains a comma-separated list of value pairs ("name:value") that describe filters.

Supported filter names are:

exclude-packageExclude a package specified in the value
exclude-moduleExclude a module specified in the value
exclude-classExclude a class specified in the value
exclude-methodExclude a method specified in the value
include-packageInclude a package specified in the value
include-moduleInclude a module specified in the value
include-classInclude a class specified in the value
include-methodInclude a method specified in the value

LogFlushMode:   Specifies the log flush mode.

Use this property to set the log flush mode. The following values are defined:

noneNo flush (caching only)
immediateImmediate flush (real-time logging)
maxcountFlush cached entries upon reaching LogMaxEventCount entries in the cache.

LogLevel:   Specifies the debug log level.

Use this property to provide the desired debug log level.

Supported values are:

noneNone (by default)
fatalSevere errors that cause premature termination.
errorOther runtime errors or unexpected conditions.
warningUse of deprecated APIs, poor use of API, 'almost' errors, other runtime situations that are undesirable or unexpected, but not necessarily "wrong".
infoInteresting runtime events (startup/shutdown).
debugDetailed information on flow of through the system.
traceMore detailed information.

LogMaxEventCount:   Specifies the maximum number of events to cache before further action is taken.

Use this property to specify the log event number threshold. This threshold may have different effects, depending on the rotation setting and/or the flush mode.

The default value of this setting is 100.

LogRotationMode:   Specifies the log rotation mode.

Use this property to set the log rotation mode. The following values are defined:

noneNo rotation
deleteolderDelete older entries from the cache upon reaching LogMaxEventCount
keepolderKeep older entries in the cache upon reaching LogMaxEventCount (newer entries are discarded)

MaxASN1BufferLength:   Specifies the maximal allowed length for ASN.1 primitive tag data.

This global property limits the maximal allowed length for ASN.1 tag data for non-content-carrying structures, such as certificates, CRLs, or timestamps. It does not affect structures that can carry content, such as CMS/CAdES messages. This is a security property aiming at preventing DoS attacks.

MaxASN1TreeDepth:   Specifies the maximal depth for processed ASN.1 trees.

This global property limits the maximal depth of ASN.1 trees that the component can handle without throwing an error. This is a security property aiming at preventing DoS attacks.

OCSPHashAlgorithm:   Specifies the hash algorithm to be used to identify certificates in OCSP requests.

This global setting defines the hash algorithm to use in OCSP requests during chain validation. Some OCSP responders can only use older algorithms, in which case setting this property to SHA1 may be helpful.

UseOwnDNSResolver:   Specifies whether the client components should use own DNS resolver.

Set this global property to false to force all the client components to use the DNS resolver provided by the target OS instead of using own one.

UseSharedSystemStorages:   Specifies whether the validation engine should use a global per-process copy of the system certificate stores.

Set this global property to false to make each validation run use its own copy of system certificate stores.

UseSystemOAEPAndPSS:   Enforces or disables the use of system-driven RSA OAEP and PSS computations.

This global setting defines who is responsible for performing RSA-OAEP and RSA-PSS computations where the private key is stored in a Windows system store and is exportable. If set to true, SBB will delegate the computations to Windows via a CryptoAPI call. Otherwise, it will export the key material and perform the computations using its own OAEP/PSS implementation.

This setting only applies to certificates originating from a Windows system store.

UseSystemRandom:   Enables or disables the use of the OS PRNG.

Use this global property to enable or disable the use of operating system-driven pseudorandom number generation.

Copyright (c) 2022 /n software inc. - All rights reserved.
SecureBlackbox 2020 macOS Edition - Version 20.0 [Build 8165]