CertificateValidator Module

Properties   Methods   Events   Config Settings   Errors  

The CertificateValidator module provides fine-grained validation of X.509 certificates.

Syntax

SecureBlackbox.Certificatevalidator

Remarks

This is a powerful and configurable class which can be used to validate all kinds of certificates and their chains.

The purpose of CertificateValidator is to validate certificate chains according to the X.509 specification. It supports a variety of technologies, including CRL and OCSP services, and can provide a comprehensive output on the certificate cryptographic validity, chain integrity, and trust levels. CertificateValidator is used internally in many other SecureBlackbox components, such as PDFSigner, HTTPClient, and OfficeVerifier.

To validate a certificate, please tune up the component as following:

• Assign the certificate to be validated to the Certificate property.
• Set RevocationCheck in accordance with your revocation check preferences.
• Enable UseSystemCertificates property to trust certificates that are trusted by the operating system. Copy any certificates that are not available in the standard system locations to KnownCertificates and TrustedCertificates collections (see Note 1 below).
• Optionally, adjust TLSSettings and SocketSettings.
• Adjust ValidationMoment if you would like to check the certificate validity at a different moment in time. Leave it unchanged to validate the certificate at the current time moment.
• Call Validate or ValidateForSSL method to initiate chain validation.

Depending on the complexity of the chain and the configuration of the component, the validation routine may take certain amount of time. The validator reports chain validation progress using a selection of events, such as BeforeCertificateProcessing, AfterCertificateProcessing, and CRLDownloaded events. It may also ask you for missing objects using CRLNeeded or CACertificateNeeded events. In each such event handler you can access the currently validated certificate via the CurrentCertificate property, and the interim validity figures via the InterimValidationResult and InterimValidationDetails property.

The return of the Validate (or similar) method indicates the completion of the validation procedure. The outcome of the chain validation is represented with the two parameters:

• ChainValidationResult reports the general validation outcome: valid, valid-but-untrusted, invalid, and unknown. As a rule, only the valid result can be taken as a good reason to consider the chain valid.
• ChainValidationDetails provides insights into the factors that caused the validation to fail.

Note 1: On Windows, CertificateValidator can use CA and ROOT system stores to look for any missing CA certificates and trust anchors. No similar functionality is currently available for other platforms, so in most cases you must provide your own list of trusted and CA certificates via TrustedCertificates and KnownCertificates collections to have your chains validate fully in Linux and macOS projects.

Note 2: The OfflineMode property is a handy way to check the completeness of your revocation/validation information. When the offline mode is on, CertificateValidator won't go online for any missing certificates, CRLs, and OCSP responses. Paired with a switched-off UseSystemCertificates property, it allows to make sure that any content provided via KnownCertificates, KnownCRLs, and KnownOCSPs represents the complete set of validation information required to validate the chain.

Property List

The following is the full list of the properties of the module with short descriptions. Click on the links for further details.

Method List

The following is the full list of the methods of the module with short descriptions. Click on the links for further details.

Event List

The following is the full list of the events fired by the module with short descriptions. Click on the links for further details.

Config Settings

The following is a list of config settings for the module with short descriptions. Click on the links for further details.

BlockedCertificates Property (CertificateValidator Module)

The certificates that must be rejected as trust anchors.

Syntax

• Swift
• Objective-C

public var blockedCertificates: Array<Certificate> {
  get {...}
}

@property (nonatomic,readwrite,assign,getter=blockedCertCount,setter=setBlockedCertCount:) int blockedCertCount;

- (int)blockedCertCount;
- (void)setBlockedCertCount :(int)newBlockedCertCount;

- (NSData*)blockedCertBytes:(int)blockedCertIndex;

- (long long)blockedCertHandle:(int)blockedCertIndex;
- (void)setBlockedCertHandle:(int)blockedCertIndex :(long long)newBlockedCertHandle;

Default Value

""

Remarks

Use this property to provide a list of compromised or blocked certificates. Any chain containing a blocked certificate will fail validation.

CacheValidationResults Property (CertificateValidator Module)

Enables or disables validation result caching.

Syntax

• Swift
• Objective-C

public var cacheValidationResults: Bool {
  get {...}
  set {...}
}

@property (nonatomic,readwrite,assign,getter=cacheValidationResults,setter=setCacheValidationResults:) BOOL cacheValidationResults;

- (BOOL)cacheValidationResults;
- (void)setCacheValidationResults :(BOOL)newCacheValidationResults;

Default Value

False

Remarks

Set this property to True to enable caching of validation results.

Certificate Property (CertificateValidator Module)

The certificate to be validated.

Syntax

• Swift
• Objective-C

public var certificate: Certificate {
  get {...}
  set {...}
}

@property (nonatomic,readonly,assign,getter=certBytes) NSData* certBytes;

- (NSData*)certBytes;

@property (nonatomic,readwrite,assign,getter=certHandle,setter=setCertHandle:) long long certHandle;

- (long long)certHandle;
- (void)setCertHandle :(long long)newCertHandle;

 

Default Value

""

Remarks

Assign the certificate that needs to be validated to this property.

ChainValidationDetails Property (CertificateValidator Module)

The details of a certificate chain validation outcome.

Syntax

• Swift
• Objective-C

public var chainValidationDetails: Int32 {
  get {...}
}

@property (nonatomic,readonly,assign,getter=chainValidationDetails) int chainValidationDetails;

- (int)chainValidationDetails;

Default Value

0

Remarks

Use the value(s) returned by this property to identify the reasons that contributed to the overall validation result.

Returns a bit mask of the following options:

This property is read-only.

ChainValidationResult Property (CertificateValidator Module)

The general outcome of a certificate chain validation routine. Use ChainValidationDetails to get information about the reasons that contributed to the validation result.

Syntax

• Swift
• Objective-C

public var chainValidationResult: CertificatevalidatorChainValidationResults {
  get {...}
}

public enum CertificatevalidatorChainValidationResults: Int32 {
  case cvtValid = 0
  case cvtValidButUntrusted = 1
  case cvtInvalid = 2
  case cvtCantBeEstablished = 3
}

@property (nonatomic,readonly,assign,getter=chainValidationResult) int chainValidationResult;

- (int)chainValidationResult;

Default Value

0

Remarks

Available options:

Use the ValidationLog property to access the detailed validation log.

This property is read-only.

CurrentCACertificate Property (CertificateValidator Module)

The CA of the currently processed certificate.

Syntax

• Swift
• Objective-C

public var currentCACertificate: Certificate {
  get {...}
}

@property (nonatomic,readonly,assign,getter=currentCACertBytes) NSData* currentCACertBytes;

- (NSData*)currentCACertBytes;

@property (nonatomic,readonly,assign,getter=currentCACertCA) BOOL currentCACertCA;

- (BOOL)currentCACertCA;

@property (nonatomic,readonly,assign,getter=currentCACertCAKeyID) NSData* currentCACertCAKeyID;

- (NSData*)currentCACertCAKeyID;

@property (nonatomic,readonly,assign,getter=currentCACertCRLDistributionPoints) NSString* currentCACertCRLDistributionPoints;

- (NSString*)currentCACertCRLDistributionPoints;

@property (nonatomic,readonly,assign,getter=currentCACertCurve) NSString* currentCACertCurve;

- (NSString*)currentCACertCurve;

@property (nonatomic,readonly,assign,getter=currentCACertFingerprint) NSData* currentCACertFingerprint;

- (NSData*)currentCACertFingerprint;

@property (nonatomic,readonly,assign,getter=currentCACertFriendlyName) NSString* currentCACertFriendlyName;

- (NSString*)currentCACertFriendlyName;

@property (nonatomic,readonly,assign,getter=currentCACertHandle) long long currentCACertHandle;

- (long long)currentCACertHandle;

@property (nonatomic,readonly,assign,getter=currentCACertHashAlgorithm) NSString* currentCACertHashAlgorithm;

- (NSString*)currentCACertHashAlgorithm;

@property (nonatomic,readonly,assign,getter=currentCACertIssuer) NSString* currentCACertIssuer;

- (NSString*)currentCACertIssuer;

@property (nonatomic,readonly,assign,getter=currentCACertIssuerRDN) NSString* currentCACertIssuerRDN;

- (NSString*)currentCACertIssuerRDN;

@property (nonatomic,readonly,assign,getter=currentCACertKeyAlgorithm) NSString* currentCACertKeyAlgorithm;

- (NSString*)currentCACertKeyAlgorithm;

@property (nonatomic,readonly,assign,getter=currentCACertKeyBits) int currentCACertKeyBits;

- (int)currentCACertKeyBits;

@property (nonatomic,readonly,assign,getter=currentCACertKeyFingerprint) NSData* currentCACertKeyFingerprint;

- (NSData*)currentCACertKeyFingerprint;

@property (nonatomic,readonly,assign,getter=currentCACertKeyUsage) int currentCACertKeyUsage;

- (int)currentCACertKeyUsage;

@property (nonatomic,readonly,assign,getter=currentCACertKeyValid) BOOL currentCACertKeyValid;

- (BOOL)currentCACertKeyValid;

@property (nonatomic,readonly,assign,getter=currentCACertOCSPLocations) NSString* currentCACertOCSPLocations;

- (NSString*)currentCACertOCSPLocations;

@property (nonatomic,readonly,assign,getter=currentCACertOCSPNoCheck) BOOL currentCACertOCSPNoCheck;

- (BOOL)currentCACertOCSPNoCheck;

@property (nonatomic,readonly,assign,getter=currentCACertOrigin) int currentCACertOrigin;

- (int)currentCACertOrigin;

@property (nonatomic,readonly,assign,getter=currentCACertPolicyIDs) NSString* currentCACertPolicyIDs;

- (NSString*)currentCACertPolicyIDs;

@property (nonatomic,readonly,assign,getter=currentCACertPrivateKeyBytes) NSData* currentCACertPrivateKeyBytes;

- (NSData*)currentCACertPrivateKeyBytes;

@property (nonatomic,readonly,assign,getter=currentCACertPrivateKeyExists) BOOL currentCACertPrivateKeyExists;

- (BOOL)currentCACertPrivateKeyExists;

@property (nonatomic,readonly,assign,getter=currentCACertPrivateKeyExtractable) BOOL currentCACertPrivateKeyExtractable;

- (BOOL)currentCACertPrivateKeyExtractable;

@property (nonatomic,readonly,assign,getter=currentCACertPublicKeyBytes) NSData* currentCACertPublicKeyBytes;

- (NSData*)currentCACertPublicKeyBytes;

@property (nonatomic,readonly,assign,getter=currentCACertQualifiedStatements) int currentCACertQualifiedStatements;

- (int)currentCACertQualifiedStatements;

@property (nonatomic,readonly,assign,getter=currentCACertSelfSigned) BOOL currentCACertSelfSigned;

- (BOOL)currentCACertSelfSigned;

@property (nonatomic,readonly,assign,getter=currentCACertSerialNumber) NSData* currentCACertSerialNumber;

- (NSData*)currentCACertSerialNumber;

@property (nonatomic,readonly,assign,getter=currentCACertSigAlgorithm) NSString* currentCACertSigAlgorithm;

- (NSString*)currentCACertSigAlgorithm;

@property (nonatomic,readonly,assign,getter=currentCACertSubject) NSString* currentCACertSubject;

- (NSString*)currentCACertSubject;

@property (nonatomic,readonly,assign,getter=currentCACertSubjectAlternativeName) NSString* currentCACertSubjectAlternativeName;

- (NSString*)currentCACertSubjectAlternativeName;

@property (nonatomic,readonly,assign,getter=currentCACertSubjectKeyID) NSData* currentCACertSubjectKeyID;

- (NSData*)currentCACertSubjectKeyID;

@property (nonatomic,readonly,assign,getter=currentCACertSubjectRDN) NSString* currentCACertSubjectRDN;

- (NSString*)currentCACertSubjectRDN;

@property (nonatomic,readonly,assign,getter=currentCACertValidFrom) NSString* currentCACertValidFrom;

- (NSString*)currentCACertValidFrom;

@property (nonatomic,readonly,assign,getter=currentCACertValidTo) NSString* currentCACertValidTo;

- (NSString*)currentCACertValidTo;

 

Default Value

""

Remarks

The validator component uses this property to publish the issuer certificate of the certificate that is currently being processed, if it is available.

CurrentCertificate Property (CertificateValidator Module)

The certificate that is currently being processed.

Syntax

• Swift
• Objective-C

public var currentCertificate: Certificate {
  get {...}
}

@property (nonatomic,readonly,assign,getter=currentCertBytes) NSData* currentCertBytes;

- (NSData*)currentCertBytes;

@property (nonatomic,readonly,assign,getter=currentCertCA) BOOL currentCertCA;

- (BOOL)currentCertCA;

@property (nonatomic,readonly,assign,getter=currentCertCAKeyID) NSData* currentCertCAKeyID;

- (NSData*)currentCertCAKeyID;

@property (nonatomic,readonly,assign,getter=currentCertCRLDistributionPoints) NSString* currentCertCRLDistributionPoints;

- (NSString*)currentCertCRLDistributionPoints;

@property (nonatomic,readonly,assign,getter=currentCertCurve) NSString* currentCertCurve;

- (NSString*)currentCertCurve;

@property (nonatomic,readonly,assign,getter=currentCertFingerprint) NSData* currentCertFingerprint;

- (NSData*)currentCertFingerprint;

@property (nonatomic,readonly,assign,getter=currentCertFriendlyName) NSString* currentCertFriendlyName;

- (NSString*)currentCertFriendlyName;

@property (nonatomic,readonly,assign,getter=currentCertHandle) long long currentCertHandle;

- (long long)currentCertHandle;

@property (nonatomic,readonly,assign,getter=currentCertHashAlgorithm) NSString* currentCertHashAlgorithm;

- (NSString*)currentCertHashAlgorithm;

@property (nonatomic,readonly,assign,getter=currentCertIssuer) NSString* currentCertIssuer;

- (NSString*)currentCertIssuer;

@property (nonatomic,readonly,assign,getter=currentCertIssuerRDN) NSString* currentCertIssuerRDN;

- (NSString*)currentCertIssuerRDN;

@property (nonatomic,readonly,assign,getter=currentCertKeyAlgorithm) NSString* currentCertKeyAlgorithm;

- (NSString*)currentCertKeyAlgorithm;

@property (nonatomic,readonly,assign,getter=currentCertKeyBits) int currentCertKeyBits;

- (int)currentCertKeyBits;

@property (nonatomic,readonly,assign,getter=currentCertKeyFingerprint) NSData* currentCertKeyFingerprint;

- (NSData*)currentCertKeyFingerprint;

@property (nonatomic,readonly,assign,getter=currentCertKeyUsage) int currentCertKeyUsage;

- (int)currentCertKeyUsage;

@property (nonatomic,readonly,assign,getter=currentCertKeyValid) BOOL currentCertKeyValid;

- (BOOL)currentCertKeyValid;

@property (nonatomic,readonly,assign,getter=currentCertOCSPLocations) NSString* currentCertOCSPLocations;

- (NSString*)currentCertOCSPLocations;

@property (nonatomic,readonly,assign,getter=currentCertOCSPNoCheck) BOOL currentCertOCSPNoCheck;

- (BOOL)currentCertOCSPNoCheck;

@property (nonatomic,readonly,assign,getter=currentCertOrigin) int currentCertOrigin;

- (int)currentCertOrigin;

@property (nonatomic,readonly,assign,getter=currentCertPolicyIDs) NSString* currentCertPolicyIDs;

- (NSString*)currentCertPolicyIDs;

@property (nonatomic,readonly,assign,getter=currentCertPrivateKeyBytes) NSData* currentCertPrivateKeyBytes;

- (NSData*)currentCertPrivateKeyBytes;

@property (nonatomic,readonly,assign,getter=currentCertPrivateKeyExists) BOOL currentCertPrivateKeyExists;

- (BOOL)currentCertPrivateKeyExists;

@property (nonatomic,readonly,assign,getter=currentCertPrivateKeyExtractable) BOOL currentCertPrivateKeyExtractable;

- (BOOL)currentCertPrivateKeyExtractable;

@property (nonatomic,readonly,assign,getter=currentCertPublicKeyBytes) NSData* currentCertPublicKeyBytes;

- (NSData*)currentCertPublicKeyBytes;

@property (nonatomic,readonly,assign,getter=currentCertQualifiedStatements) int currentCertQualifiedStatements;

- (int)currentCertQualifiedStatements;

@property (nonatomic,readonly,assign,getter=currentCertSelfSigned) BOOL currentCertSelfSigned;

- (BOOL)currentCertSelfSigned;

@property (nonatomic,readonly,assign,getter=currentCertSerialNumber) NSData* currentCertSerialNumber;

- (NSData*)currentCertSerialNumber;

@property (nonatomic,readonly,assign,getter=currentCertSigAlgorithm) NSString* currentCertSigAlgorithm;

- (NSString*)currentCertSigAlgorithm;

@property (nonatomic,readonly,assign,getter=currentCertSubject) NSString* currentCertSubject;

- (NSString*)currentCertSubject;

@property (nonatomic,readonly,assign,getter=currentCertSubjectAlternativeName) NSString* currentCertSubjectAlternativeName;

- (NSString*)currentCertSubjectAlternativeName;

@property (nonatomic,readonly,assign,getter=currentCertSubjectKeyID) NSData* currentCertSubjectKeyID;

- (NSData*)currentCertSubjectKeyID;

@property (nonatomic,readonly,assign,getter=currentCertSubjectRDN) NSString* currentCertSubjectRDN;

- (NSString*)currentCertSubjectRDN;

@property (nonatomic,readonly,assign,getter=currentCertValidFrom) NSString* currentCertValidFrom;

- (NSString*)currentCertValidFrom;

@property (nonatomic,readonly,assign,getter=currentCertValidTo) NSString* currentCertValidTo;

- (NSString*)currentCertValidTo;

 

Default Value

""

Remarks

This property returns the certificate that is currently being processed by the validator.

FIPSMode Property (CertificateValidator Module)

Reserved.

Syntax

• Swift
• Objective-C

public var fipsMode: Bool {
  get {...}
  set {...}
}

@property (nonatomic,readwrite,assign,getter=FIPSMode,setter=setFIPSMode:) BOOL FIPSMode;

- (BOOL)FIPSMode;
- (void)setFIPSMode :(BOOL)newFIPSMode;

Default Value

False

Remarks

This property is reserved for future use.

GracePeriod Property (CertificateValidator Module)

Specifies a grace period to apply during certificate validation.

Syntax

• Swift
• Objective-C

public var gracePeriod: Int32 {
  get {...}
  set {...}
}

@property (nonatomic,readwrite,assign,getter=gracePeriod,setter=setGracePeriod:) int gracePeriod;

- (int)gracePeriod;
- (void)setGracePeriod :(int)newGracePeriod;

Default Value

0

Remarks

Use this property to specify a grace period (in seconds). Grace period applies to certain subprotocols, such as OCSP, and caters to the inaccuracy and/or missynchronization of clocks on different participating systems. Any time deviations within the grace period will be tolerated.

InterimValidationDetails Property (CertificateValidator Module)

Contains the validation details of the moment.

Syntax

• Swift
• Objective-C

public var interimValidationDetails: Int32 {
  get {...}
  set {...}
}

@property (nonatomic,readwrite,assign,getter=interimValidationDetails,setter=setInterimValidationDetails:) int interimValidationDetails;

- (int)interimValidationDetails;
- (void)setInterimValidationDetails :(int)newInterimValidationDetails;

Default Value

0

Remarks

Over the course of the validation process, the validator maintains an interim validity status for the chain that is being processed. This status is influenced by every single step of the validation routine, and may change along the way, before the end of the chain is reached and the final validation conclusion is drawn.

Use this property to check the interim validity details mid-flight.

The value of this property is a bit mask of the following options:

InterimValidationResult Property (CertificateValidator Module)

Contains the validation status of the moment.

Syntax

• Swift
• Objective-C

public var interimValidationResult: CertificatevalidatorInterimValidationResults {
  get {...}
  set {...}
}

public enum CertificatevalidatorInterimValidationResults: Int32 {
  case cvtValid = 0
  case cvtValidButUntrusted = 1
  case cvtInvalid = 2
  case cvtCantBeEstablished = 3
}

@property (nonatomic,readwrite,assign,getter=interimValidationResult,setter=setInterimValidationResult:) int interimValidationResult;

- (int)interimValidationResult;
- (void)setInterimValidationResult :(int)newInterimValidationResult;

Default Value

0

Remarks

Over the course of the validation process, the validator maintains an interim validity status for the chain that is being processed. This status is influenced by every single step of the validation routine, and may change along the way, before the end of the chain is reached and the final validation conclusion is drawn.

Use this property to check the interim validity status mid-flight.

KnownCertificates Property (CertificateValidator Module)

Additional certificates for chain validation.

Syntax

• Swift
• Objective-C

public var knownCertificates: Array<Certificate> {
  get {...}
}

@property (nonatomic,readwrite,assign,getter=knownCertCount,setter=setKnownCertCount:) int knownCertCount;

- (int)knownCertCount;
- (void)setKnownCertCount :(int)newKnownCertCount;

- (NSData*)knownCertBytes:(int)knownCertIndex;

- (long long)knownCertHandle:(int)knownCertIndex;
- (void)setKnownCertHandle:(int)knownCertIndex :(long long)newKnownCertHandle;

Default Value

""

Remarks

Use this property to supply a list of additional certificates that might be needed for chain validation. An example of a scenario where you might want to do that is when intermediary CA certificates are absent from the standard system locations (or when there are no standard system locations), and therefore should be supplied to the class manually.

The purpose of the certificates to be added to this collection is roughly equivalent to that of the Intermediate Certification Authorities system store in Windows.

Do not add trust anchors or root certificates to this collection: add them to TrustedCertificates instead.

KnownCRLs Property (CertificateValidator Module)

Additional CRLs for chain validation.

Syntax

• Swift
• Objective-C

public var knownCRLs: Array<CRL> {
  get {...}
}

@property (nonatomic,readwrite,assign,getter=knownCRLCount,setter=setKnownCRLCount:) int knownCRLCount;

- (int)knownCRLCount;
- (void)setKnownCRLCount :(int)newKnownCRLCount;

- (NSData*)knownCRLBytes:(int)knownCRLIndex;

- (long long)knownCRLHandle:(int)knownCRLIndex;
- (void)setKnownCRLHandle:(int)knownCRLIndex :(long long)newKnownCRLHandle;

Default Value

""

Remarks

Use this property to supply additional CRLs that might be needed for chain validation. This property may be helpful when a chain is validated in offline mode, and the associated CRLs are stored separately from the signed message or document.

KnownOCSPs Property (CertificateValidator Module)

Additional OCSP responses for chain validation.

Syntax

• Swift
• Objective-C

public var knownOCSPs: Array<OCSPResponse> {
  get {...}
}

@property (nonatomic,readwrite,assign,getter=knownOCSPCount,setter=setKnownOCSPCount:) int knownOCSPCount;

- (int)knownOCSPCount;
- (void)setKnownOCSPCount :(int)newKnownOCSPCount;

- (NSData*)knownOCSPBytes:(int)knownOCSPIndex;

- (long long)knownOCSPHandle:(int)knownOCSPIndex;
- (void)setKnownOCSPHandle:(int)knownOCSPIndex :(long long)newKnownOCSPHandle;

Default Value

""

Remarks

Use this property to supply additional OCSP responses that might be needed for chain validation. This property may be helpful when a chain is validated in offline mode, and the associated OCSP responses are stored separately from the signed message or document.

MaxValidationTime Property (CertificateValidator Module)

Specifies the maximum time the validation process may take.

Syntax

• Swift
• Objective-C

public var maxValidationTime: Int32 {
  get {...}
  set {...}
}

@property (nonatomic,readwrite,assign,getter=maxValidationTime,setter=setMaxValidationTime:) int maxValidationTime;

- (int)maxValidationTime;
- (void)setMaxValidationTime :(int)newMaxValidationTime;

Default Value

0

Remarks

Use this property to limit the amount of time available for the validator to carry out the validation. If the validation process exceeds this time, it is terminated and the validation error is returned.

OfflineMode Property (CertificateValidator Module)

Switches the module to offline mode.

Syntax

• Swift
• Objective-C

public var offlineMode: Bool {
  get {...}
  set {...}
}

@property (nonatomic,readwrite,assign,getter=offlineMode,setter=setOfflineMode:) BOOL offlineMode;

- (BOOL)offlineMode;
- (void)setOfflineMode :(BOOL)newOfflineMode;

Default Value

False

Remarks

When working in offline mode, the class restricts itself from using any online revocation information sources, such as CRL or OCSP responders.

Offline mode may be useful if there is a need to verify the completeness of the validation information included within the signature or provided via KnownCertificates, KnownCRLs, and other related properties.

Proxy Property (CertificateValidator Module)

The proxy server settings.

Syntax

• Swift
• Objective-C

public var proxy: ProxySettings {
  get {...}
}

@property (nonatomic,readwrite,assign,getter=proxyAddress,setter=setProxyAddress:) NSString* proxyAddress;

- (NSString*)proxyAddress;
- (void)setProxyAddress :(NSString*)newProxyAddress;

@property (nonatomic,readwrite,assign,getter=proxyAuthentication,setter=setProxyAuthentication:) int proxyAuthentication;

- (int)proxyAuthentication;
- (void)setProxyAuthentication :(int)newProxyAuthentication;

@property (nonatomic,readwrite,assign,getter=proxyPassword,setter=setProxyPassword:) NSString* proxyPassword;

- (NSString*)proxyPassword;
- (void)setProxyPassword :(NSString*)newProxyPassword;

@property (nonatomic,readwrite,assign,getter=proxyPort,setter=setProxyPort:) int proxyPort;

- (int)proxyPort;
- (void)setProxyPort :(int)newProxyPort;

@property (nonatomic,readwrite,assign,getter=proxyProxyType,setter=setProxyProxyType:) int proxyProxyType;

- (int)proxyProxyType;
- (void)setProxyProxyType :(int)newProxyProxyType;

@property (nonatomic,readwrite,assign,getter=proxyRequestHeaders,setter=setProxyRequestHeaders:) NSString* proxyRequestHeaders;

- (NSString*)proxyRequestHeaders;
- (void)setProxyRequestHeaders :(NSString*)newProxyRequestHeaders;

@property (nonatomic,readwrite,assign,getter=proxyResponseBody,setter=setProxyResponseBody:) NSString* proxyResponseBody;

- (NSString*)proxyResponseBody;
- (void)setProxyResponseBody :(NSString*)newProxyResponseBody;

@property (nonatomic,readwrite,assign,getter=proxyResponseHeaders,setter=setProxyResponseHeaders:) NSString* proxyResponseHeaders;

- (NSString*)proxyResponseHeaders;
- (void)setProxyResponseHeaders :(NSString*)newProxyResponseHeaders;

@property (nonatomic,readwrite,assign,getter=proxyUseIPv6,setter=setProxyUseIPv6:) BOOL proxyUseIPv6;

- (BOOL)proxyUseIPv6;
- (void)setProxyUseIPv6 :(BOOL)newProxyUseIPv6;

@property (nonatomic,readwrite,assign,getter=proxyUseProxy,setter=setProxyUseProxy:) BOOL proxyUseProxy;

- (BOOL)proxyUseProxy;
- (void)setProxyUseProxy :(BOOL)newProxyUseProxy;

@property (nonatomic,readwrite,assign,getter=proxyUsername,setter=setProxyUsername:) NSString* proxyUsername;

- (NSString*)proxyUsername;
- (void)setProxyUsername :(NSString*)newProxyUsername;

 

Default Value

""

Remarks

Use this property to tune up the proxy server settings.

QualifiedInfo Property (CertificateValidator Module)

The qualified details for the validated certificate.

Syntax

• Swift
• Objective-C

public var qualifiedInfo: QualifiedInfo {
  get {...}
}

@property (nonatomic,readonly,assign,getter=qualifiedInfoAddress) NSString* qualifiedInfoAddress;

- (NSString*)qualifiedInfoAddress;

@property (nonatomic,readwrite,assign,getter=qualifiedInfoCustomTSLs,setter=setQualifiedInfoCustomTSLs:) NSString* qualifiedInfoCustomTSLs;

- (NSString*)qualifiedInfoCustomTSLs;
- (void)setQualifiedInfoCustomTSLs :(NSString*)newQualifiedInfoCustomTSLs;

@property (nonatomic,readonly,assign,getter=qualifiedInfoDownloadLog) NSString* qualifiedInfoDownloadLog;

- (NSString*)qualifiedInfoDownloadLog;

@property (nonatomic,readonly,assign,getter=qualifiedInfoInformationURI) NSString* qualifiedInfoInformationURI;

- (NSString*)qualifiedInfoInformationURI;

@property (nonatomic,readwrite,assign,getter=qualifiedInfoLanguages,setter=setQualifiedInfoLanguages:) NSString* qualifiedInfoLanguages;

- (NSString*)qualifiedInfoLanguages;
- (void)setQualifiedInfoLanguages :(NSString*)newQualifiedInfoLanguages;

@property (nonatomic,readonly,assign,getter=qualifiedInfoNextUpdate) NSString* qualifiedInfoNextUpdate;

- (NSString*)qualifiedInfoNextUpdate;

@property (nonatomic,readonly,assign,getter=qualifiedInfoProvider) NSString* qualifiedInfoProvider;

- (NSString*)qualifiedInfoProvider;

@property (nonatomic,readonly,assign,getter=qualifiedInfoQualified) BOOL qualifiedInfoQualified;

- (BOOL)qualifiedInfoQualified;

@property (nonatomic,readonly,assign,getter=qualifiedInfoQualifiers) NSString* qualifiedInfoQualifiers;

- (NSString*)qualifiedInfoQualifiers;

@property (nonatomic,readonly,assign,getter=qualifiedInfoServiceName) NSString* qualifiedInfoServiceName;

- (NSString*)qualifiedInfoServiceName;

@property (nonatomic,readonly,assign,getter=qualifiedInfoServiceTypeId) NSString* qualifiedInfoServiceTypeId;

- (NSString*)qualifiedInfoServiceTypeId;

@property (nonatomic,readonly,assign,getter=qualifiedInfoSource) int qualifiedInfoSource;

- (int)qualifiedInfoSource;

@property (nonatomic,readonly,assign,getter=qualifiedInfoStatus) int qualifiedInfoStatus;

- (int)qualifiedInfoStatus;

@property (nonatomic,readonly,assign,getter=qualifiedInfoTradeName) NSString* qualifiedInfoTradeName;

- (NSString*)qualifiedInfoTradeName;

@property (nonatomic,readwrite,assign,getter=qualifiedInfoUseDefaultTSLs,setter=setQualifiedInfoUseDefaultTSLs:) BOOL qualifiedInfoUseDefaultTSLs;

- (BOOL)qualifiedInfoUseDefaultTSLs;
- (void)setQualifiedInfoUseDefaultTSLs :(BOOL)newQualifiedInfoUseDefaultTSLs;

@property (nonatomic,readonly,assign,getter=qualifiedInfoValidationLog) NSString* qualifiedInfoValidationLog;

- (NSString*)qualifiedInfoValidationLog;

@property (nonatomic,readonly,assign,getter=qualifiedInfoXML) NSString* qualifiedInfoXML;

- (NSString*)qualifiedInfoXML;

 

Default Value

""

Remarks

Use this property to check the qualified information for Certificate. The contents of this property is updated upon completion of the full validation routine performed by the Validate method (if the qualified check is enabled) or after the GetQualifiedStatus call.

RevocationCheck Property (CertificateValidator Module)

Specifies the kind(s) of revocation check to perform for all chain certificates.

Syntax

• Swift
• Objective-C

public var revocationCheck: CertificatevalidatorRevocationChecks {
  get {...}
  set {...}
}

public enum CertificatevalidatorRevocationChecks: Int32 {
  case crcNone = 0
  case crcAuto = 1
  case crcAllCRL = 2
  case crcAllOCSP = 3
  case crcAllCRLAndOCSP = 4
  case crcAnyCRL = 5
  case crcAnyOCSP = 6
  case crcAnyCRLOrOCSP = 7
  case crcAnyOCSPOrCRL = 8
}

@property (nonatomic,readwrite,assign,getter=revocationCheck,setter=setRevocationCheck:) int revocationCheck;

- (int)revocationCheck;
- (void)setRevocationCheck :(int)newRevocationCheck;

Default Value

1

Remarks

Revocation checking is necessary to ensure the integrity of the chain and obtain up-to-date certificate validity and trustworthiness information.

Certificate Revocation Lists (CRLs) and Online Certificate Status Protocol (OCSP) responses serve the same purpose of ensuring that the certificate had not been revoked by the Certificate Authority (CA) at the time of use. Depending on your circumstances and security policy requirements, you may want to use either one or both of the revocation information source types.

This setting controls the way the revocation checks are performed for every certificate in the chain. Typically certificates come with two types of revocation information sources: CRL (certificate revocation lists) and OCSP responders. CRLs are static objects periodically published by the CA at some online location. OCSP responders are active online services maintained by the CA that can provide up-to-date information on certificate statuses in near real time.

There are some conceptual differences between the two. CRLs are normally larger in size. Their use involves some latency because there is normally some delay between the time when a certificate was revoked and the time the subsequent CRL mentioning that is published. The benefits of CRL is that the same object can provide statuses for all certificates issued by a particular CA, and that the whole technology is much simpler than OCSP (and thus is supported by more CAs).

This setting lets you adjust the validation course by including or excluding certain types of revocation sources from the validation process. The crcAnyOCSPOrCRL setting (give preference to the faster OCSP route and only demand one source to succeed) is a good choice for most typical validation environments. The "crcAll*" modes are much stricter, and may be used in scenarios where bulletproof validity information is essential.

Note: If no CRL or OCSP endpoints are provided by the CA, the revocation check will be considered successful. This is because the CA chose not to supply revocation information for its certificates, meaning they are considered irrevocable.

Note: Within each of the above settings, if any retrieved CRL or OCSP response indicates that the certificate has been revoked, the revocation check fails.

SocketSettings Property (CertificateValidator Module)

Manages network connection settings.

Syntax

• Swift
• Objective-C

public var socketSettings: SocketSettings {
  get {...}
}

@property (nonatomic,readwrite,assign,getter=socketDNSMode,setter=setSocketDNSMode:) int socketDNSMode;

- (int)socketDNSMode;
- (void)setSocketDNSMode :(int)newSocketDNSMode;

@property (nonatomic,readwrite,assign,getter=socketDNSPort,setter=setSocketDNSPort:) int socketDNSPort;

- (int)socketDNSPort;
- (void)setSocketDNSPort :(int)newSocketDNSPort;

@property (nonatomic,readwrite,assign,getter=socketDNSQueryTimeout,setter=setSocketDNSQueryTimeout:) int socketDNSQueryTimeout;

- (int)socketDNSQueryTimeout;
- (void)setSocketDNSQueryTimeout :(int)newSocketDNSQueryTimeout;

@property (nonatomic,readwrite,assign,getter=socketDNSServers,setter=setSocketDNSServers:) NSString* socketDNSServers;

- (NSString*)socketDNSServers;
- (void)setSocketDNSServers :(NSString*)newSocketDNSServers;

@property (nonatomic,readwrite,assign,getter=socketDNSTotalTimeout,setter=setSocketDNSTotalTimeout:) int socketDNSTotalTimeout;

- (int)socketDNSTotalTimeout;
- (void)setSocketDNSTotalTimeout :(int)newSocketDNSTotalTimeout;

@property (nonatomic,readwrite,assign,getter=socketIncomingSpeedLimit,setter=setSocketIncomingSpeedLimit:) int socketIncomingSpeedLimit;

- (int)socketIncomingSpeedLimit;
- (void)setSocketIncomingSpeedLimit :(int)newSocketIncomingSpeedLimit;

@property (nonatomic,readwrite,assign,getter=socketLocalAddress,setter=setSocketLocalAddress:) NSString* socketLocalAddress;

- (NSString*)socketLocalAddress;
- (void)setSocketLocalAddress :(NSString*)newSocketLocalAddress;

@property (nonatomic,readwrite,assign,getter=socketLocalPort,setter=setSocketLocalPort:) int socketLocalPort;

- (int)socketLocalPort;
- (void)setSocketLocalPort :(int)newSocketLocalPort;

@property (nonatomic,readwrite,assign,getter=socketOutgoingSpeedLimit,setter=setSocketOutgoingSpeedLimit:) int socketOutgoingSpeedLimit;

- (int)socketOutgoingSpeedLimit;
- (void)setSocketOutgoingSpeedLimit :(int)newSocketOutgoingSpeedLimit;

@property (nonatomic,readwrite,assign,getter=socketTimeout,setter=setSocketTimeout:) int socketTimeout;

- (int)socketTimeout;
- (void)setSocketTimeout :(int)newSocketTimeout;

@property (nonatomic,readwrite,assign,getter=socketUseIPv6,setter=setSocketUseIPv6:) BOOL socketUseIPv6;

- (BOOL)socketUseIPv6;
- (void)setSocketUseIPv6 :(BOOL)newSocketUseIPv6;

 

Default Value

""

Remarks

Use this property to tune up network connection parameters.

TLSClientChain Property (CertificateValidator Module)

The TLS client certificate chain.

Syntax

• Swift
• Objective-C

public var tlsClientChain: Array<Certificate> {
  get {...}
}

@property (nonatomic,readwrite,assign,getter=TLSClientCertCount,setter=setTLSClientCertCount:) int TLSClientCertCount;

- (int)TLSClientCertCount;
- (void)setTLSClientCertCount :(int)newTLSClientCertCount;

- (NSData*)TLSClientCertBytes:(int)tLSClientCertIndex;

- (long long)TLSClientCertHandle:(int)tLSClientCertIndex;
- (void)setTLSClientCertHandle:(int)tLSClientCertIndex :(long long)newTLSClientCertHandle;

Default Value

""

Remarks

Assign a certificate chain to this property to enable TLS client authentication in the class. Note that the client's end-entity certificate should have a private key associated with it.

Use the CertificateStorage or CertificateManager components to import the certificate from a file, system store, or PKCS11 device.

TLSServerChain Property (CertificateValidator Module)

The TLS server's certificate chain.

Syntax

• Swift
• Objective-C

public var tlsServerChain: Array<Certificate> {
  get {...}
}

@property (nonatomic,readonly,assign,getter=TLSServerCertCount) int TLSServerCertCount;

- (int)TLSServerCertCount;

- (NSData*)TLSServerCertBytes:(int)tLSServerCertIndex;

- (long long)TLSServerCertHandle:(int)tLSServerCertIndex;

Default Value

""

Remarks

Use this property to access the certificate chain sent by the TLS server. This property is ready to read when the TLSCertValidate event is fired by the client component.

TLSSettings Property (CertificateValidator Module)

Manages TLS layer settings.

Syntax

• Swift
• Objective-C

public var tlsSettings: TLSSettings {
  get {...}
}

@property (nonatomic,readwrite,assign,getter=TLSAutoValidateCertificates,setter=setTLSAutoValidateCertificates:) BOOL TLSAutoValidateCertificates;

- (BOOL)TLSAutoValidateCertificates;
- (void)setTLSAutoValidateCertificates :(BOOL)newTLSAutoValidateCertificates;

@property (nonatomic,readwrite,assign,getter=TLSBaseConfiguration,setter=setTLSBaseConfiguration:) int TLSBaseConfiguration;

- (int)TLSBaseConfiguration;
- (void)setTLSBaseConfiguration :(int)newTLSBaseConfiguration;

@property (nonatomic,readwrite,assign,getter=TLSCiphersuites,setter=setTLSCiphersuites:) NSString* TLSCiphersuites;

- (NSString*)TLSCiphersuites;
- (void)setTLSCiphersuites :(NSString*)newTLSCiphersuites;

@property (nonatomic,readwrite,assign,getter=TLSECCurves,setter=setTLSECCurves:) NSString* TLSECCurves;

- (NSString*)TLSECCurves;
- (void)setTLSECCurves :(NSString*)newTLSECCurves;

@property (nonatomic,readwrite,assign,getter=TLSExtensions,setter=setTLSExtensions:) NSString* TLSExtensions;

- (NSString*)TLSExtensions;
- (void)setTLSExtensions :(NSString*)newTLSExtensions;

@property (nonatomic,readwrite,assign,getter=TLSForceResumeIfDestinationChanges,setter=setTLSForceResumeIfDestinationChanges:) BOOL TLSForceResumeIfDestinationChanges;

- (BOOL)TLSForceResumeIfDestinationChanges;
- (void)setTLSForceResumeIfDestinationChanges :(BOOL)newTLSForceResumeIfDestinationChanges;

@property (nonatomic,readwrite,assign,getter=TLSPreSharedIdentity,setter=setTLSPreSharedIdentity:) NSString* TLSPreSharedIdentity;

- (NSString*)TLSPreSharedIdentity;
- (void)setTLSPreSharedIdentity :(NSString*)newTLSPreSharedIdentity;

@property (nonatomic,readwrite,assign,getter=TLSPreSharedKey,setter=setTLSPreSharedKey:) NSString* TLSPreSharedKey;

- (NSString*)TLSPreSharedKey;
- (void)setTLSPreSharedKey :(NSString*)newTLSPreSharedKey;

@property (nonatomic,readwrite,assign,getter=TLSPreSharedKeyCiphersuite,setter=setTLSPreSharedKeyCiphersuite:) NSString* TLSPreSharedKeyCiphersuite;

- (NSString*)TLSPreSharedKeyCiphersuite;
- (void)setTLSPreSharedKeyCiphersuite :(NSString*)newTLSPreSharedKeyCiphersuite;

@property (nonatomic,readwrite,assign,getter=TLSRenegotiationAttackPreventionMode,setter=setTLSRenegotiationAttackPreventionMode:) int TLSRenegotiationAttackPreventionMode;

- (int)TLSRenegotiationAttackPreventionMode;
- (void)setTLSRenegotiationAttackPreventionMode :(int)newTLSRenegotiationAttackPreventionMode;

@property (nonatomic,readwrite,assign,getter=TLSRevocationCheck,setter=setTLSRevocationCheck:) int TLSRevocationCheck;

- (int)TLSRevocationCheck;
- (void)setTLSRevocationCheck :(int)newTLSRevocationCheck;

@property (nonatomic,readwrite,assign,getter=TLSSSLOptions,setter=setTLSSSLOptions:) int TLSSSLOptions;

- (int)TLSSSLOptions;
- (void)setTLSSSLOptions :(int)newTLSSSLOptions;

@property (nonatomic,readwrite,assign,getter=TLSTLSMode,setter=setTLSTLSMode:) int TLSTLSMode;

- (int)TLSTLSMode;
- (void)setTLSTLSMode :(int)newTLSTLSMode;

@property (nonatomic,readwrite,assign,getter=TLSUseExtendedMasterSecret,setter=setTLSUseExtendedMasterSecret:) BOOL TLSUseExtendedMasterSecret;

- (BOOL)TLSUseExtendedMasterSecret;
- (void)setTLSUseExtendedMasterSecret :(BOOL)newTLSUseExtendedMasterSecret;

@property (nonatomic,readwrite,assign,getter=TLSUseSessionResumption,setter=setTLSUseSessionResumption:) BOOL TLSUseSessionResumption;

- (BOOL)TLSUseSessionResumption;
- (void)setTLSUseSessionResumption :(BOOL)newTLSUseSessionResumption;

@property (nonatomic,readwrite,assign,getter=TLSVersions,setter=setTLSVersions:) int TLSVersions;

- (int)TLSVersions;
- (void)setTLSVersions :(int)newTLSVersions;

 

Default Value

""

Remarks

Use this property to tune up the TLS layer parameters.

TrustedCertificates Property (CertificateValidator Module)

A list of trusted certificates for chain validation.

Syntax

• Swift
• Objective-C

public var trustedCertificates: Array<Certificate> {
  get {...}
}

@property (nonatomic,readwrite,assign,getter=trustedCertCount,setter=setTrustedCertCount:) int trustedCertCount;

- (int)trustedCertCount;
- (void)setTrustedCertCount :(int)newTrustedCertCount;

- (NSData*)trustedCertBytes:(int)trustedCertIndex;

- (long long)trustedCertHandle:(int)trustedCertIndex;
- (void)setTrustedCertHandle:(int)trustedCertIndex :(long long)newTrustedCertHandle;

Default Value

""

Remarks

Use this property to supply a list of trusted certificates that might be needed for chain validation. An example of a scenario where you might want to do that is when root CA certificates are absent from the standard system locations (or when there are no standard system locations), and therefore should be supplied to the component manually.

The purpose of this certificate collection is largely the same as that of the Windows Trusted Root Certification Authorities system store.

Use this property with extreme care as it directly affects chain verifiability; a wrong certificate added to the trusted list may result in bad chains being accepted, and forfeited signatures being recognized as genuine. Only add certificates that originate from the parties that you know and trust.

UsedCertificates Property (CertificateValidator Module)

Contains a list of certificates used during the chain validation routine.

Syntax

• Swift
• Objective-C

public var usedCertificates: Array<Certificate> {
  get {...}
}

@property (nonatomic,readonly,assign,getter=usedCertCount) int usedCertCount;

- (int)usedCertCount;

- (NSData*)usedCertBytes:(int)usedCertIndex;

- (BOOL)usedCertCA:(int)usedCertIndex;

- (NSData*)usedCertCAKeyID:(int)usedCertIndex;

- (NSString*)usedCertCRLDistributionPoints:(int)usedCertIndex;

- (NSString*)usedCertCurve:(int)usedCertIndex;

- (NSData*)usedCertFingerprint:(int)usedCertIndex;

- (NSString*)usedCertFriendlyName:(int)usedCertIndex;

- (long long)usedCertHandle:(int)usedCertIndex;

- (NSString*)usedCertHashAlgorithm:(int)usedCertIndex;

- (NSString*)usedCertIssuer:(int)usedCertIndex;

- (NSString*)usedCertIssuerRDN:(int)usedCertIndex;

- (NSString*)usedCertKeyAlgorithm:(int)usedCertIndex;

- (int)usedCertKeyBits:(int)usedCertIndex;

- (NSData*)usedCertKeyFingerprint:(int)usedCertIndex;

- (int)usedCertKeyUsage:(int)usedCertIndex;

- (BOOL)usedCertKeyValid:(int)usedCertIndex;

- (NSString*)usedCertOCSPLocations:(int)usedCertIndex;

- (BOOL)usedCertOCSPNoCheck:(int)usedCertIndex;

- (int)usedCertOrigin:(int)usedCertIndex;

- (NSString*)usedCertPolicyIDs:(int)usedCertIndex;

- (NSData*)usedCertPrivateKeyBytes:(int)usedCertIndex;

- (BOOL)usedCertPrivateKeyExists:(int)usedCertIndex;

- (BOOL)usedCertPrivateKeyExtractable:(int)usedCertIndex;

- (NSData*)usedCertPublicKeyBytes:(int)usedCertIndex;

- (int)usedCertQualifiedStatements:(int)usedCertIndex;

- (BOOL)usedCertSelfSigned:(int)usedCertIndex;

- (NSData*)usedCertSerialNumber:(int)usedCertIndex;

- (NSString*)usedCertSigAlgorithm:(int)usedCertIndex;

- (NSString*)usedCertSubject:(int)usedCertIndex;

- (NSString*)usedCertSubjectAlternativeName:(int)usedCertIndex;

- (NSData*)usedCertSubjectKeyID:(int)usedCertIndex;

- (NSString*)usedCertSubjectRDN:(int)usedCertIndex;

- (NSString*)usedCertValidFrom:(int)usedCertIndex;

- (NSString*)usedCertValidTo:(int)usedCertIndex;

Default Value

""

Remarks

Use this property to access the list of certificates that were used during the chain validation.

UsedCRLs Property (CertificateValidator Module)

Contains a list of CRLs used during the chain validation routine.

Syntax

• Swift
• Objective-C

public var usedCRLs: Array<CRL> {
  get {...}
}

@property (nonatomic,readonly,assign,getter=usedCRLCount) int usedCRLCount;

- (int)usedCRLCount;

- (NSData*)usedCRLBytes:(int)usedCRLIndex;

- (long long)usedCRLHandle:(int)usedCRLIndex;

- (NSString*)usedCRLIssuer:(int)usedCRLIndex;

- (NSString*)usedCRLIssuerRDN:(int)usedCRLIndex;

- (NSString*)usedCRLLocation:(int)usedCRLIndex;

- (NSString*)usedCRLNextUpdate:(int)usedCRLIndex;

- (NSString*)usedCRLThisUpdate:(int)usedCRLIndex;

Default Value

""

Remarks

Use this property to access the list of CRLs that were used during the chain validation.

UseDefaultTSLs Property (CertificateValidator Module)

Enables or disables the use of the default TSLs.

Syntax

• Swift
• Objective-C

public var useDefaultTSLs: Bool {
  get {...}
  set {...}
}

@property (nonatomic,readwrite,assign,getter=useDefaultTSLs,setter=setUseDefaultTSLs:) BOOL useDefaultTSLs;

- (BOOL)useDefaultTSLs;
- (void)setUseDefaultTSLs :(BOOL)newUseDefaultTSLs;

Default Value

False

Remarks

Use this property to tell the validator to use (or not to use) the default TSLs (Trust Service status Lists). The result of this check reported in Qualified property.

The following default TSLs are used: EU (European Union) TSL.

UsedOCSPs Property (CertificateValidator Module)

Contains a list of OCSP responses used during the chain validation routine.

Syntax

• Swift
• Objective-C

public var usedOCSPs: Array<OCSPResponse> {
  get {...}
}

@property (nonatomic,readonly,assign,getter=usedOCSPCount) int usedOCSPCount;

- (int)usedOCSPCount;

- (NSData*)usedOCSPBytes:(int)usedOCSPIndex;

- (long long)usedOCSPHandle:(int)usedOCSPIndex;

- (NSString*)usedOCSPIssuer:(int)usedOCSPIndex;

- (NSString*)usedOCSPIssuerRDN:(int)usedOCSPIndex;

- (NSString*)usedOCSPLocation:(int)usedOCSPIndex;

- (NSString*)usedOCSPProducedAt:(int)usedOCSPIndex;

Default Value

""

Remarks

Use this property to access the list of OCSP responses that were used during the chain validation.

UseSystemCertificates Property (CertificateValidator Module)

Enables or disables the use of the system certificates.

Syntax

• Swift
• Objective-C

public var useSystemCertificates: Bool {
  get {...}
  set {...}
}

@property (nonatomic,readwrite,assign,getter=useSystemCertificates,setter=setUseSystemCertificates:) BOOL useSystemCertificates;

- (BOOL)useSystemCertificates;
- (void)setUseSystemCertificates :(BOOL)newUseSystemCertificates;

Default Value

False

Remarks

Use this property to tell the validator to use (or not to use) the system certificates. In many cases it is beneficial to switch this property on, as the operating system certificate configuration provides a representative trust framework.

ValidationLog Property (CertificateValidator Module)

Contains the complete log of the certificate validation routine.

Syntax

• Swift
• Objective-C

public var validationLog: String {
  get {...}
}

@property (nonatomic,readonly,assign,getter=validationLog) NSString* validationLog;

- (NSString*)validationLog;

Default Value

""

Remarks

Use this property to access the chain validation log produced by the class. The log can be very useful when investigating issues with chain validation, as it contains a step-by-step trace of the entire validation procedure.

This property is read-only.

ValidationMoment Property (CertificateValidator Module)

The time point at which chain validity is to be established.

Syntax

• Swift
• Objective-C

public var validationMoment: String {
  get {...}
  set {...}
}

@property (nonatomic,readwrite,assign,getter=validationMoment,setter=setValidationMoment:) NSString* validationMoment;

- (NSString*)validationMoment;
- (void)setValidationMoment :(NSString*)newValidationMoment;

Default Value

""

Remarks

Use this property to specify the moment in time at which chain validity should be established. The time is in UTC. Leave the setting empty to stick to the current moment.

The validity of the same chain may differ depending on the time point chosen due to temporal changes in subchain validities and revocation statuses.

Config Method (CertificateValidator Module)

Sets or retrieves a configuration setting.

Syntax

• Swift
• Objective-C

public func config(configurationString: String) throws -> String

- (NSString*)config:(NSString*)configurationString;

Remarks

Config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

DoAction Method (CertificateValidator Module)

Performs an additional action.

Syntax

• Swift
• Objective-C

public func doAction(actionID: String, actionParams: String) throws -> String

- (NSString*)doAction:(NSString*)actionID :(NSString*)actionParams;

Remarks

DoAction is a generic method available in every class. It is used to perform an additional action introduced after the product major release. The list of actions is not fixed, and may be flexibly extended over time.

The unique identifier (case insensitive) of the action is provided in the ActionID parameter.

ActionParams contains the value of a single parameter, or a list of multiple parameters for the action in the form of PARAM1=VALUE1;PARAM2=VALUE2;....

GetQualifiedStatus Method (CertificateValidator Module)

Obtains the qualified information for Certificate .

Syntax

• Swift
• Objective-C

public func getQualifiedStatus() throws -> Void

- (void)getQualifiedStatus;

Remarks

Use this method to obtain a fresh qualified status for the certificate.

GetTSLProperty Method (CertificateValidator Module)

Returns a specific TSL property.

Syntax

• Swift
• Objective-C

public func getTSLProperty(propName: String, language: String) throws -> String

- (NSString*)getTSLProperty:(NSString*)propName :(NSString*)language;

Remarks

Use this method to obtain the value of a specific TSL property. Use the Language parameter to specify the language identifier (e.g. it) in which you would like to have the property returned (if supported by the TSL). Leave the parameter empty to return the value in the default language.

Please find a list of common TSL properties below:

• VersionIdentifier
• SequenceNumber
• Type
• SchemeName
• SchemeOperatorName
• SchemeOperatorAddress
• SchemeInformationURI
• StatusDeterminationApproach
• SchemeTypeCommunityRules
• SchemeTerritory
• Policies
• LegalNotices
• HistoricalInformationPeriod
• ListIssueDateTime
• NextUpdate
• DistributionPoints
• SchemeExtensions
• TSPXML
• TSPName
• TSPTradeName
• TSPInformationURI
• TSPAddress
• TSPInformationExtensions
• TSPServiceXML
• TSPServiceTypeIdentifier
• TSPServiceName
• TSPServiceStatus
• TSPServiceStatusStartingTime
• TSPSchemeServiceDefinitionURI
• TSPServiceDefinitionURI
• TSPServiceSupplyPoints
• TSPServiceInformationExtensions
• TSPServiceQualifiers
• TSPAdditionalServiceInformation
• TSPHistoryInstance
• TSPHistoryInstanceXML
• TSPHistoryInstanceServiceTypeIdentifier
• TSPHistoryInstanceServiceName
• TSPHistoryInstanceServiceStatus
• TSPHistoryInstanceServiceStatusStartingTime
• TSPHistoryInstanceServiceInformationExtensions
• TSPHistoryInstanceQualifiers
• TSPHistoryInstanceAdditionalServiceInformation

RefreshCache Method (CertificateValidator Module)

Refreshes the certificate cache.

Syntax

• Swift
• Objective-C

public func refreshCache() throws -> Void

- (void)refreshCache;

Remarks

Use this method to remove obsolete information from the validation cache (only makes sense if CacheValidationResults is on).

ResetCache Method (CertificateValidator Module)

Clears all data contained in the validation cache.

Syntax

• Swift
• Objective-C

public func resetCache() throws -> Void

- (void)resetCache;

Remarks

Use this method to clear the validation cache (only makes sense if CacheValidationResults is on).

Terminate Method (CertificateValidator Module)

Terminates the validation process.

Syntax

• Swift
• Objective-C

public func terminate() throws -> Void

- (void)terminate;

Remarks

Call this method if you would like to stop the validation process.

Validate Method (CertificateValidator Module)

Validates the certificate chain.

Syntax

• Swift
• Objective-C

public func validate() throws -> Int32

- (int)validate;

Remarks

Use this method to validate the certificate chain that starts with Certificate.

The chain validation is a multi-step process which includes validation of each certificate in the chain up to the trusted anchor. The ultimate goal of this process is to establish the integrity of the chain and its trustworthiness.

Depending on the component tuneup, the validation process may differ drastically, even for the same certificate: it may be more or less rigorous, may include or exclude revocation checks, and may be more or less tolerant to minor chain issues.

When this process is completed, the final decision on the validity of the checked certificate is returned from this method, and also saved in ChainValidationResult property. Another property, ChainValidationDetails, provides insight into the reasons that contributed to that decision. Use ValidationLog to get a detailed step-by-step log of the entire validation process.

ValidateForSMIME Method (CertificateValidator Module)

Validates an e-mail signing certificate.

Syntax

• Swift
• Objective-C

public func validateForSMIME(emailAddress: String) throws -> Int32

- (int)validateForSMIME:(NSString*)emailAddress;

Remarks

Use this method to validate an e-mail security certificate.

This is a variant of Validate method that performs some additional e-mail specific checks, imposed by e-mail certificate rules. This method returns the overall chain validation result.

ValidateForSSL Method (CertificateValidator Module)

Validates a server-side SSL/TLS certificate.

Syntax

• Swift
• Objective-C

public func validateForSSL(url: String, ipAddress: String) throws -> Int32

- (int)validateForSSL:(NSString*)URL :(NSString*)IPAddress;

Remarks

Use this method to validate a server-side SSL/TLS certificate.

This is a variant of Validate method that performs some additional TLS-specific checks. It is important that you provide a correct URL or IPAddress for the check to return a reasonable and justified result.

This method returns the overall result of the chain validation.

AfterCertificateProcessing Event (CertificateValidator Module)

Marks the end of a single certificate processing step.

Syntax

• Swift
• Objective-C

func onAfterCertificateProcessing(cert: String, validity: Int32, validationDetails: Int32)

- (void)onAfterCertificateProcessing:(NSString*)cert :(int)validity :(int)validationDetails;

Remarks

This event is fired when the class has finished processing Cert, and returns its Validity status and ValidationDetails.

'Processing' consists of one or more 'validations' (with one CA certificate each), completion of each of which is reported via AfterCertificateValidation events. If a certificate is signed by a single CA (which is a typical case), processing is synonymous to validation.

You can influence the validation process by altering the provided validation outcome, such as changing the invalid status to valid. This can be done via InterimValidationResult and InterimValidationDetails properties.

Validity status:

Validation details:

AfterCertificateValidation Event (CertificateValidator Module)

Marks the end of a single certificate validation step.

Syntax

• Swift
• Objective-C

func onAfterCertificateValidation(cert: String, caCert: String, validity: Int32, validationDetails: Int32)

- (void)onAfterCertificateValidation:(NSString*)cert :(NSString*)CACert :(int)validity :(int)validationDetails;

Remarks

This event is fired when the class has finished validation of Cert with CACert, and returns its Validity status and ValidationDetails.

'Validation', in this context, means a single validation of a certificate with its CA certificate. For certificates with multiple CAs, validations are grouped into 'processings.' Each processing, therefore, is a set of validations of the same certificate with all its CAs.

You can influence the validation process by altering the provided validation outcome, such as changing the invalid status to valid. This can be done via InterimValidationResult and InterimValidationDetails properties.

Validity status:

Validation details:

BeforeCACertificateDownload Event (CertificateValidator Module)

Fires when a CA certificate is about to be downloaded.

Syntax

• Swift
• Objective-C

func onBeforeCACertificateDownload(cert: String, location: String)

- (void)onBeforeCACertificateDownload:(NSString*)cert :(NSString*)location;

Remarks

This event is fired when a CA certificate that is needed to validate Cert is about to be downloaded from Location.

BeforeCertificateProcessing Event (CertificateValidator Module)

Reports the start of certificate processing.

Syntax

• Swift
• Objective-C

func onBeforeCertificateProcessing(cert: String, validity: Int32, validationDetails: Int32)

- (void)onBeforeCertificateProcessing:(NSString*)cert :(int)validity :(int)validationDetails;

Remarks

This event is fired when the class is about to start the processing of Cert.

'Processing' consists of one or more 'validations' (with one CA certificate each), completion of each of which is reported via AfterCertificateValidation events. If a certificate is signed by a single CA (which is a typical case), processing is synonymous to validation.

The firing of AfterCertificateProcessing marks the end of the certificate processing.

Validity and ValidationDetails specify the current validation status.

Validity status:

Validation details:

BeforeCertificateValidation Event (CertificateValidator Module)

Reports the start of certificate validation.

Syntax

• Swift
• Objective-C

func onBeforeCertificateValidation(cert: String, caCert: String)

- (void)onBeforeCertificateValidation:(NSString*)cert :(NSString*)CACert;

Remarks

This event is fired when the class is about to start validating Cert with CACert.

A 'validation' is a single step of validating a certificate with its CA certificate. A row of consecutive validations of the same certificate with different CAs are grouped into 'processings.'

The firing of AfterCertificateValidation marks the end of the certificate validation step.

BeforeCRLDownload Event (CertificateValidator Module)

Fires when a CRL is about to be downloaded.

Syntax

• Swift
• Objective-C

func onBeforeCRLDownload(cert: String, caCert: String, location: String)

- (void)onBeforeCRLDownload:(NSString*)cert :(NSString*)CACert :(NSString*)location;

Remarks

This event is fired when a CRL (Certificate Revocation List) needed to validate Cert is going to be downloaded from Location.

BeforeOCSPDownload Event (CertificateValidator Module)

Fires when a certificate's OCSP status is about to be requested.

Syntax

• Swift
• Objective-C

func onBeforeOCSPDownload(cert: String, caCert: String, location: String)

- (void)onBeforeOCSPDownload:(NSString*)cert :(NSString*)CACert :(NSString*)location;

Remarks

This event is fired when the validator is about to request a fresh revocation status from an OCSP responder.

CACertificateDownloaded Event (CertificateValidator Module)

Marks the success of a certificate download.

Syntax

• Swift
• Objective-C

func onCACertificateDownloaded(cert: String, location: String)

- (void)onCACertificateDownloaded:(NSString*)cert :(NSString*)location;

Remarks

This event is fired when a CA certificate has been successfully downloaded from Location. This event is preceded with BeforeCACertificateDownload event.

CACertificateNeeded Event (CertificateValidator Module)

Requests a missing certificate from the user.

Syntax

• Swift
• Objective-C

func onCACertificateNeeded(cert: String)

- (void)onCACertificateNeeded:(NSString*)cert;

Remarks

This event is fired when a CA certificate that is needed to validate Cert is not found at any of the available locations. If you have access to the missing certificate, please add it to the KnownCertificates collection to make it available to the validator.

When this event fires, the CurrentCertificate property is assigned with the certificate being validated. It is the CA that issued that certificate that the validator is looking for.

CRLDownloaded Event (CertificateValidator Module)

Marks the success of a CRL download.

Syntax

• Swift
• Objective-C

func onCRLDownloaded(cert: String, caCert: String, location: String)

- (void)onCRLDownloaded:(NSString*)cert :(NSString*)CACert :(NSString*)location;

Remarks

This event is fired when a CRL containing the validation information for Cert has been successfully downloaded from Location. This event is always preceded with BeforeCRLDownload event.

CRLNeeded Event (CertificateValidator Module)

Requests a missing CRL from the user.

Syntax

• Swift
• Objective-C

func onCRLNeeded(cert: String, caCert: String)

- (void)onCRLNeeded:(NSString*)cert :(NSString*)CACert;

Remarks

This event is fired when a CRL that is needed to validate Cert is not found at any of the available locations. If you have access to the missing CRL, please add it to the KnownCRLs collection to make it available to the validator.

When this event fires, the CurrentCertificate and CurrentCACertificate properties are assigned with the certificate being validated and its issuer certificate.

Error Event (CertificateValidator Module)

Information about errors during certificate validation.

Syntax

• Swift
• Objective-C

func onError(errorCode: Int32, description: String)

- (void)onError:(int)errorCode :(NSString*)description;

Remarks

The event is fired in case of exceptional conditions during certificate processing or online information retrieval.

ErrorCode contains an error code and Description contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the corresponding section.

Notification Event (CertificateValidator Module)

This event notifies the application about an underlying control flow event.

Syntax

• Swift
• Objective-C

func onNotification(eventID: String, eventParam: String)

- (void)onNotification:(NSString*)eventID :(NSString*)eventParam;

Remarks

The class fires this event to let the application know about some event, occurrence, or milestone in the class. For example, it may fire to report completion of the document processing. The list of events being reported is not fixed, and may be flexibly extended over time.

The unique identifier of the event is provided in the EventID parameter. EventParam contains any parameters accompanying the occurrence. Depending on the type of the class, the exact action it is performing, or the document being processed, one or both may be omitted.

This class can fire this event with the following EventID values:

OCSPDownloaded Event (CertificateValidator Module)

Marks the success of an OCSP request.

Syntax

• Swift
• Objective-C

func onOCSPDownloaded(cert: String, caCert: String, location: String)

- (void)onOCSPDownloaded:(NSString*)cert :(NSString*)CACert :(NSString*)location;

Remarks

This event is fired when an OCSP response containing the validation information for Cert has been successfully downloaded from Location. This event is always preceded with BeforeOCSPDownload event.

TLSCertNeeded Event (CertificateValidator Module)

Fires when a remote TLS party requests a client certificate.

Syntax

• Swift
• Objective-C

func onTLSCertNeeded(host: String, caNames: String)

- (void)onTLSCertNeeded:(NSString*)host :(NSString*)CANames;

Remarks

This event fires to notify the implementation that a remote TLS server has requested a client certificate. The Host parameter identifies the host that makes a request, and the CANames parameter (optional, according to the TLS spec) advises on the accepted issuing CAs.

Use the TLSClientChain property in response to this event to provide the requested certificate. Please make sure the client certificate includes the associated private key. Note that you may set the certificates before the connection without waiting for this event to fire.

This event is preceded by the TLSHandshake event for the given host and, if the certificate was accepted, succeeded by the TLSEstablished event.

TLSCertValidate Event (CertificateValidator Module)

This event is fired upon receipt of the TLS server's certificate, allowing the user to control its acceptance.

Syntax

• Swift
• Objective-C

func onTLSCertValidate(serverHost: String, serverIP: String, accept: inout Bool)

- (void)onTLSCertValidate:(NSString*)serverHost :(NSString*)serverIP :(int*)accept;

Remarks

This event is fired during a TLS handshake. Use the TLSServerChain property to access the certificate chain. In general, classes may contact a number of TLS endpoints during their work, depending on their configuration.

Accept is assigned in accordance with the outcome of the internal validation check performed by the class, and can be adjusted if needed.

TLSEstablished Event (CertificateValidator Module)

Fires when a TLS handshake with Host successfully completes.

Syntax

• Swift
• Objective-C

func onTLSEstablished(host: String, version: String, ciphersuite: String, connectionId: Data, abort: inout Bool)

- (void)onTLSEstablished:(NSString*)host :(NSString*)version :(NSString*)ciphersuite :(NSData*)connectionId :(int*)abort;

Remarks

The class uses this event to notify the application about a successful completion of a TLS handshake.

The Version, Ciphersuite, and ConnectionId parameters indicate the security parameters of the new connection. Use the Abort parameter if you need to terminate the connection at this stage.

TLSHandshake Event (CertificateValidator Module)

Fires when a new TLS handshake is initiated, before the handshake commences.

Syntax

• Swift
• Objective-C

func onTLSHandshake(host: String, abort: inout Bool)

- (void)onTLSHandshake:(NSString*)host :(int*)abort;

Remarks

The class uses this event to notify the application about the start of a new TLS handshake to Host. If the handshake is successful, this event will be followed by the TLSEstablished event. If the server chooses to request a client certificate, the TLSCertNeeded event will also be fired.

TLSShutdown Event (CertificateValidator Module)

Reports the graceful closure of a TLS connection.

Syntax

• Swift
• Objective-C

func onTLSShutdown(host: String)

- (void)onTLSShutdown:(NSString*)host;

Remarks

This event notifies the application about the closure of an earlier established TLS connection. Note that only graceful connection closures are reported.

Certificate Type

Provides details of an individual X.509 certificate.

Remarks

This type provides access to X.509 certificate details.

Fields

Constructors

public init(stream: )

Loads the X.509 certificate from a stream. Stream is a stream containing the certificate data.

public init()

Creates a new object with default field values.

CRL Type

Represents a Certificate Revocation List.

Remarks

CRLs store information about revoked certificates, i.e., certificates that have been identified as invalid by their issuing certificate authority (CA) for any number of reasons.

Each CRL object lists certificates from a single CA and identifies them by their serial numbers. A CA may or may not publish a CRL, may publish several CRLs, or may publish the same CRL in multiple locations.

Unlike OCSP responses, CRLs only list certificates that have been revoked. They do not list certificates that are still valid.

Fields

Constructors

public init()

Creates an empty CRL object.

OCSPResponse Type

Represents a single OCSP response originating from an OCSP responder.

Remarks

OCSP is a protocol that allows verification of certificate status in real-time, and is an alternative to Certificate Revocation Lists (CRLs).

An OCSP response is a snapshot of the certificate status at a given time.

Fields

Constructors

public init()

Creates an empty OCSP response object.

ProxySettings Type

A container for proxy server settings.

Remarks

This type exposes a collection of properties for tuning up the proxy server configuration.

Fields

Constructors

public init()

Creates a new ProxySettings object.

QualifiedInfo Type

This component is a container for X.509 qualified information.

Remarks

Use this property to access the qualified information for the validated certificate.

Fields

Constructors

public init()

Creates a new QualifiedInfo object.

SocketSettings Type

A container for the socket settings.

Remarks

This type is a container for socket-layer parameters.

Fields

Constructors

public init()

Creates a new SocketSettings object.

TLSSettings Type

A container for TLS connection settings.

Remarks

The TLS (Transport Layer Security) protocol provides security for information exchanged over insecure connections such as TCP/IP.

Fields

Constructors

public init()

Creates a new TLSSettings object.

Config Settings (CertificateValidator Module)

CertificateValidator Config Settings

TrustedLists Config Settings

Base Config Settings

Trappable Errors (CertificateValidator Module)

CertificateValidator Errors