XMLVerifier Class

Properties Methods Events Config Settings Errors

The XMLVerifier class provides simplified XML signature validation capabilities.

Syntax

class secureblackbox.XMLVerifier

Remarks

Use this control to validate XML-SIG signatures. XMLVerifier is capable of validating the integrity of the references covered by the signature and the integrity of the signature itself, using the certificate contained in the signature or provided from the user' code.

Note that this component only validates the cryptographic aspects of the signatures, but does not perform any chain of trust validation. As such, it is the task of your code to ensure that the signing certificate is good for its purpose and is trusted in your environment.

If you are looking to validate certificate trust in addition to the cryptographic capabilities, please consider using XAdESVerifier. XAdESVerifier provides full support for advanced signature ecosystem, including revocation and Trusted List checking, timing checks, and chain of trust validation.

Property List

The following is the full list of the properties of the class with short descriptions. Click on the links for further details.


all_signatures_valid	The cumulative validity of all signatures.
auto_validate_signatures	Specifies whether class should validate any present signatures when the document is opened.
cert_count	The number of records in the Cert arrays.
cert_bytes	Returns the raw certificate data in DER format.
cert_ca	Indicates whether the certificate has a CA capability.
cert_ca_key_id	A unique identifier (fingerprint) of the CA certificate's cryptographic key.
cert_cert_type	Returns the type of the entity contained in the Certificate object.
cert_crl_distribution_points	Contains a list of locations of CRL distribution points used to check this certificate's validity.
cert_curve	Specifies the elliptic curve associated with the certificate's public key.
cert_fingerprint	Contains the fingerprint (a hash imprint) of this certificate.
cert_friendly_name	Contains an associated alias (friendly name) of the certificate.
cert_handle	Allows to get or set a 'handle', a unique identifier of the underlying property object.
cert_hash_algorithm	Provides means to set the hash algorithm to be used in the subsequent operation on the certificate (such as generation or key signing).
cert_issuer	The common name of the certificate issuer (CA), typically a company name.
cert_issuer_rdn	A list of Property=Value pairs that uniquely identify the certificate issuer.
cert_key_algorithm	Specifies the public key algorithm of this certificate.
cert_key_bits	Returns the length of the public key in bits.
cert_key_fingerprint	Returns a SHA1 fingerprint of the public key contained in the certificate.
cert_key_usage	Indicates the purposes of the key contained in the certificate, in the form of an OR'ed flag set.
cert_key_valid	Returns True if the certificate's key is cryptographically valid, and False otherwise.
cert_ocsp_locations	Locations of OCSP services that can be used to check this certificate's validity in real time, as recorded by the CA.
cert_ocsp_no_check	Accessor to the value of the certificate's ocsp-no-check extension.
cert_origin	Returns the location that the certificate was taken or loaded from.
cert_policy_i_ds	Contains identifiers (OIDs) of the applicable certificate policies.
cert_private_key_bytes	Returns the certificate's private key in DER-encoded format.
cert_private_key_exists	Indicates whether the certificate has a usable private key associated with it.
cert_private_key_extractable	Indicates whether the private key is extractable (exportable).
cert_public_key_bytes	Contains the certificate's public key in DER format.
cert_qualified	Indicates whether the certificate is qualified.
cert_qualified_statements	Returns a simplified qualified status of the certificate.
cert_qualifiers	A list of qualifiers.
cert_self_signed	Indicates whether the certificate is self-signed (root) or signed by an external CA.
cert_serial_number	Returns the certificate's serial number.
cert_sig_algorithm	Indicates the algorithm that was used by the CA to sign this certificate.
cert_source	Returns the source (location or disposition) of a cryptographic primitive entity, such as a certificate, CRL, or OCSP response.
cert_subject	The common name of the certificate holder, typically an individual's name, a URL, an e-mail address, or a company name.
cert_subject_alternative_name	Returns or sets the value of the Subject Alternative Name extension of the certificate.
cert_subject_key_id	Contains a unique identifier of the certificate's cryptographic key.
cert_subject_rdn	A list of Property=Value pairs that uniquely identify the certificate holder (subject).
cert_valid	Indicates whether or not the signature over the certificate or the request is valid and matches the public key contained in the CA certificate/request.
cert_valid_from	The time point at which the certificate becomes valid, in UTC.
cert_valid_to	The time point at which the certificate expires, in UTC.
data_bytes	Use this property to pass the external data to class in the byte array form.
data_file	A file containing the external data covered by a detached signature.
data_type	Specifies the external data type.
data_uri	Specifies a detached data resource URI.
encoding	Specifies XML encoding.
fips_mode	Reserved.
input_bytes	Use this property to pass the input to class in byte array form.
input_file	A signed XML file.
known_cert_count	The number of records in the KnownCert arrays.
known_cert_bytes	Returns the raw certificate data in DER format.
known_cert_handle	Allows to get or set a 'handle', a unique identifier of the underlying property object.
output_bytes	Use this property to read the output the class object has produced.
output_file	The file where the modified signed document will be saved.
reference_count	The number of records in the Reference arrays.
reference_canonicalization_method	Use this property to specify the canonicalization method for the transform of the reference.
reference_custom_element_id	Specifies a custom identifier (ID) attribute for a referenced (target) element that will be set on signing.
reference_digest_value	Use this property to get or set the value of the digest calculated over the referenced data.
reference_handle	Allows to get or set a 'handle', a unique identifier of the underlying property object.
reference_hash_algorithm	Specifies the hash algorithm to be used.
reference_has_uri	Specifies whether the URI is set (even when it is empty).
reference_id	A user-defined identifier (ID) attribute of this Reference element.
reference_inclusive_namespaces_prefix_list	Use this property to specify InclusiveNamespaces PrefixList for exclusive canonicalization transform of the reference.
reference_reference_type	The Reference's type attribute as defined in XMLDSIG specification.
reference_target_data	Contains the referenced external data when the digest value is not explicitly specified.
reference_target_type	The reference's target type to use.
reference_target_xml_element	This property specifies the referenced XML element.
reference_uri	Use this property to get or set the URL which references the data.
reference_use_base64_transform	Specifies whether Base64 transform is included in transform chain.
reference_use_enveloped_signature_transform	Specifies whether enveloped signature transform is included in transform chain.
reference_use_xpath_filter2_transform	Specifies whether XPath Filter 2.
reference_use_xpath_transform	Specifies whether XPath transform is included in transform chain.
reference_validation_result	The outcome of the cryptographic reference validation.
reference_xpath_expression	Use this property to specify XPath expression for XPath transform of the reference.
reference_xpath_filter2_expressions	Use this property to specify XPointer expression(s) for XPath Filter 2.
reference_xpath_filter2_filters	Use this property to specify XPointer filter(s) for XPath Filter 2.
reference_xpath_filter2_prefix_list	Use this property to specify a prefix list for XPath Filter 2.
reference_xpath_prefix_list	Use this property to specify a prefix list for XPath transform of the reference.
signature_count	The number of records in the Signature arrays.
signature_canonicalization_method	The XML canonicalization method that was used for signing.
signature_compatibility_errors	Returns compatibility errors encountered during validation.
signature_entity_label	Use this property to get the signature entity label.
signature_handle	Allows to get or set a 'handle', a unique identifier of the underlying property object.
signature_hash_algorithm	The hash algorithm used for signing.
signature_issuer_rdn	The Relative Distinguished Name of the signing certificate's issuer.
signature_parent_entity	Use this property to get the parent signature label.
signature_serial_number	The serial number of the signing certificate.
signature_signature_bytes	Returns the binary representation of the XML signature.
signature_signature_type	The signature type to employ when signing the document.
signature_signature_validation_result	The outcome of the cryptographic signature validation.
signature_subject_key_id	Contains the subject key identifier of the signing certificate.
signature_subject_rdn	Contains information about the person owning the signing certificate.
signature_xml_element	Specifies the XML element where to save the signature or containing the signature.

Method List

The following is the full list of the methods of the class with short descriptions. Click on the links for further details.


add_known_namespace	Adds known prefix and correspondent namespace URI.
close	Closes an opened document.
config	Sets or retrieves a configuration setting.
do_action	Performs an additional action.
get_inner_xml	Get the inner XML content of the selected XML element.
get_outer_xml	Get the outer XML content of the selected XML element.
get_signed_data	Returns the part of the XML document that is covered by the signature.
get_text_content	Get the text content of the selected XML element.
open	Opens a document for verifying or removing signatures.
reset	Resets the class settings.
revalidate	Revalidates a signature in accordance with current settings.
select_info	Select signature information for a specific entity.
set_inner_xml	Set the inner XML content of the selected XML element.
set_text_content	Set the text content of the selected XML element.
unsign	Deletes a signature from the document.
verify	Verifies a signed XML document.
verify_detached	Verifies a detached signature over external XML data.

Event List

The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.


on_document_loaded	This event is fired when the document has been loaded into memory.
on_error	Information about errors during signature verification.
on_notification	This event notifies the application about an underlying control flow event.
on_reference_validated	Marks the end of a reference validation.
on_resolve_reference	Asks the application to resolve a reference.
on_signature_found	Signifies the start of signature validation.
on_signature_validated	Marks the completion of the signature validation routine.

Config Settings

The following is a list of config settings for the class with short descriptions. Click on the links for further details.


AddAllDataObjectsTimestamp	Whether to add all data objects timestamp during signing.
ClaimedRolesXML	The XML content of the claimed roles.
ClaimedRoleText	The text of the claimed role.
CommitmentTypeIndicationAllSignedDataObjects[Index]	Specifies the CommitmentTypeIndication's AllSignedDataObjects.
CommitmentTypeIndicationCount	The number of the CommitmentTypeIndication elements.
CommitmentTypeIndicationIdentifier[Index]	Specifies the CommitmentTypeIndication's CommitmentTypeId's Identifier.
CommitmentTypeIndicationIdentifierDescription[Index]	Specifies the CommitmentTypeIndication's CommitmentTypeId's Description.
CommitmentTypeIndicationIdentifierDocumentationReferences[Index]	Specifies the CommitmentTypeIndication's CommitmentTypeId's DocumentationReferences.
CommitmentTypeIndicationIdentifierQualifier[Index]	Specifies the CommitmentTypeIndication's CommitmentTypeId's IdentifierQualifier.
CommitmentTypeIndicationObjectReference[Index]	Specifies the CommitmentTypeIndication's ObjectReference.
CommitmentTypeIndicationQualifiersXML[Index]	The XML content of the CommitmentTypeIndication's Qualifiers.
DataObjectFormatCount	The number of the DataObjectFormat elements.
DataObjectFormatDescription[Index]	Specifies the DataObjectFormat's Description.
DataObjectFormatEncoding[Index]	Specifies the DataObjectFormat's Encoding.
DataObjectFormatMimeType[Index]	Specifies the DataObjectFormat's MimeType.
DataObjectFormatObjectIdentifier[Index]	Specifies the DataObjectFormat's ObjectIdentifier's Identifier.
DataObjectFormatObjectIdentifierDescription[Index]	Specifies the DataObjectFormat's ObjectIdentifier's Description.
DataObjectFormatObjectIdentifierDocumentationReferences[Index]	Specifies the DataObjectFormat's ObjectIdentifier's DocumentationReferences.
DataObjectFormatObjectIdentifierQualifier[Index]	Specifies the DataObjectFormat's ObjectIdentifier's IdentifierQualifier.
DataObjectFormatObjectReference[Index]	Specifies the DataObjectFormat's ObjectReference.
DataType	Specifies the external data type.
DetachedResourceURI	Specifies a detached resource URI.
ExclusiveCanonicalizationPrefix	Specifies the exclusive canonicalization prefix.
HMACKey	The key value for HMAC.
HMACOutputLength	Sets the length of the HMAC output.
HMACSigningUsed	Whether to use HMAC signing.
IDAttributeName	Specifies the custom name of ID attribute.
IDAttributeNamespaceURI	Specifies the custom namespace URI of ID attribute.
IgnoreTimestampFailure	Whether to ignore time-stamping failure during signing.
IncludeKey	Specifies whether to include the signing key to the signature.
IncludeKeyValue	Specifies whether the key value must be included to the signature.
IncludeKnownRevocationInfoToSignature	Whether to include custom revocation info to the signature.
InclusiveNamespacesPrefixList	Specifies the InclusiveNamespaces PrefixList.
InsertBeforeXMLElement	Defines the reference XML element for signature insertion.
KeyInfoCustomXML	The custom XML content for KeyInfo element.
KeyInfoDetails	Specifies the signing key info details to include to the signature.
KeyInfoID	Specifies the ID for KeyInfo element.
KeyName	Contains information about the key used for signing.
ManifestCount	TBD.
ManifestID[i]	TBD.
ManifestObjectIndex[i]	TBD.
ManifestXML[i]	TBD.
NormalizeNewLine	Controls whether newline combinations should be automatically normalized.
ObjectCount	TBD.
ObjectEncoding[i]	TBD.
ObjectID[i]	TBD.
ObjectMimeType[i]	TBD.
ObjectSignaturePropertiesCount	TBD.
ObjectSignaturePropertiesID[i]	TBD.
ObjectSignaturePropertiesObjectIndex[i]	TBD.
ObjectSignaturePropertiesXML[i]	TBD.
ObjectSignaturePropertyCount	TBD.
ObjectSignaturePropertyID[i]	TBD.
ObjectSignaturePropertyPropertiesIndex[i]	TBD.
ObjectSignaturePropertyTarget[i]	TBD.
ObjectSignaturePropertyXML[i]	TBD.
ObjectXML[i]	TBD.
PolicyDescription	signature policy description.
PolicyExplicitText	The explicit text of the user notice.
PolicyUNNumbers	The noticeNumbers part of the NoticeReference CAdES attribute.
PolicyUNOrganization	The organization part of the NoticeReference qualifier.
ProductionPlace	Identifies the place of the signature production.
PSSUsed	Whether to use RSASSA-PSS algorithm.
QualifyingPropertiesID	Specifies the ID for QualifyingProperties element.
QualifyingPropertiesObjectID	Specifies the ID for object with QualifyingProperties element.
QualifyingPropertiesReferenceCount	The number of the QualifyingPropertiesReference elements.
QualifyingPropertiesReferenceID[Index]	Specifies the QualifyingPropertiesReference's ID.
QualifyingPropertiesReferenceURI[Index]	Specifies the QualifyingPropertiesReference's URI.
RefsTimestampType	Specifies references timestamp type to include to the signature.
SignatureCompliance	SIgnature compliance with XMLDSig/EBICS.
SignatureID	Specifies the ID for Signature element.
SignaturePrefix	Specifies the signature prefix.
SignatureValueID	Specifies the ID for SignatureValue element.
SignedInfoID	Specifies the ID for SignedInfo element.
SignedPropertiesID	Specifies the ID for SignedProperties element.
SignedPropertiesReferenceCanonicalizationMethod	Specifies the canonicalization method used in SignedProperties reference.
SignedPropertiesReferenceHashAlgorithm	Specifies the hash algorithm used in SignedProperties reference.
SignedPropertiesReferenceID	Specifies the ID for Reference element that points to SignedProperties element.
SignedPropertiesReferenceInclusiveNamespacesPrefixList	Specifies the InclusiveNamespaces PrefixList used in SignedProperties reference.
SignedPropertiesReferenceIndex	Specifies the index of SignedProperties reference.
SignedSignaturePropertiesID	Specifies the ID for SignedSignatureProperties element.
SigningCertificatesChain	The indicator of which certificates should be/are included as the signing chain.
SigningCertificatesHashAlgorithm	Specifies the hash algorithm used for SigningCertificates.
SigPolicyDescription	signature policy description.
SigPolicyExplicitText	The explicit text of the user notice.
SigPolicyHash	The EPES policy hash.
SigPolicyHashAlgorithm	The hash algorithm that was used to generate the EPES policy hash.
SigPolicyID	The EPES policy ID.
SigPolicyNoticeNumbers	The noticeNumbers part of the NoticeReference CAdES attribute.
SigPolicyNoticeOrganization	The organization part of the NoticeReference qualifier.
SigPolicyURI	The EPES policy URI.
StripWhitespace	Controls whether excessive whitespace characters should be stripped off when loading the document.
TimestampCanonicalizationMethod	Specifies canonicalization method used in timestamp.
TimestampValidationDataDetails	Specifies timestamp validation data details to include to the signature.
UseHMACSigning	Whether to use HMAC signing.
UsePSS	Whether to use RSASSA-PSS algorithm.
ValidationDataRefsDetails	Specifies validation data references details to include to the signature.
ValidationDataRefsHashAlgorithm	Specifies the hash algorithm used in validation data references.
ValidationDataValuesDetails	Specifies validation data values details to include to the signature.
WriteBOM	Specifies whether byte-order mark should be written when saving the document.
XAdESPrefix	Specifies the XAdES prefix.
XAdESv141Prefix	Specifies the XAdES v1.4.1 prefix.
XMLFormatting	Specifies the signature XML formatting.
ASN1UseGlobalTagCache	Controls whether ASN.1 module should use a global object cache.
AssignSystemSmartCardPins	Specifies whether CSP-level PINs should be assigned to CNG keys.
CheckKeyIntegrityBeforeUse	Enables or disable private key integrity check before use.
CookieCaching	Specifies whether a cookie cache should be used for HTTP(S) transports.
Cookies	Gets or sets local cookies for the class.
DefDeriveKeyIterations	Specifies the default key derivation algorithm iteration count.
DNSLocalSuffix	The suffix to assign for TLD names.
EnableClientSideSSLFFDHE	Enables or disables finite field DHE key exchange support in TLS clients.
GlobalCookies	Gets or sets global cookies for all the HTTP transports.
HardwareCryptoUsePolicy	The hardware crypto usage policy.
HttpUserAgent	Specifies the user agent name to be used by all HTTP clients.
HttpVersion	The HTTP version to use in any inner HTTP client classes created.
IgnoreExpiredMSCTLSigningCert	Whether to tolerate the expired Windows Update signing certificate.
ListDelimiter	The delimiter character for multi-element lists.
LogDestination	Specifies the debug log destination.
LogDetails	Specifies the debug log details to dump.
LogFile	Specifies the debug log filename.
LogFilters	Specifies the debug log filters.
LogFlushMode	Specifies the log flush mode.
LogLevel	Specifies the debug log level.
LogMaxEventCount	Specifies the maximum number of events to cache before further action is taken.
LogRotationMode	Specifies the log rotation mode.
MaxASN1BufferLength	Specifies the maximal allowed length for ASN.1 primitive tag data.
MaxASN1TreeDepth	Specifies the maximal depth for processed ASN.1 trees.
OCSPHashAlgorithm	Specifies the hash algorithm to be used to identify certificates in OCSP requests.
OldClientSideRSAFallback	Specifies whether the SSH client should use a SHA1 fallback.
PKICache	Specifies which PKI elements (certificates, CRLs, OCSP responses) should be cached.
PKICachePath	Specifies the file system path where cached PKI data is stored.
ProductVersion	Returns the version of the SecureBlackbox library.
ServerSSLDHKeyLength	Sets the size of the TLS DHE key exchange group.
StaticDNS	Specifies whether static DNS rules should be used.
StaticIPAddress[domain]	Gets or sets an IP address for the specified domain name.
StaticIPAddresses	Gets or sets all the static DNS rules.
Tag	Allows to store any custom data.
TLSSessionGroup	Specifies the group name of TLS sessions to be used for session resumption.
TLSSessionLifetime	Specifies lifetime in seconds of the cached TLS session.
TLSSessionPurgeInterval	Specifies how often the session cache should remove the expired TLS sessions.
UseCRLObjectCaching	Specifies whether reuse of loaded CRL objects is enabled.
UseInternalRandom	Switches between SecureBlackbox-own and platform PRNGs.
UseLegacyAdESValidation	Enables legacy AdES validation mode.
UseOCSPResponseObjectCaching	Specifies whether reuse of loaded OCSP response objects is enabled.
UseOwnDNSResolver	Specifies whether the client classes should use own DNS resolver.
UseSharedSystemStorages	Specifies whether the validation engine should use a global per-process copy of the system certificate stores.
UseSystemNativeSizeCalculation	An internal CryptoAPI access tweak.
UseSystemOAEPAndPSS	Enforces or disables the use of system-driven RSA OAEP and PSS computations.
UseSystemRandom	Enables or disables the use of the OS PRNG.
XMLRDNDescriptorName[OID]	Defines an OID mapping to descriptor names for the certificate's IssuerRDN or SubjectRDN.
XMLRDNDescriptorPriority[OID]	Specifies the priority of descriptor names associated with a specific OID.
XMLRDNDescriptorReverseOrder	Specifies whether to reverse the order of descriptors in RDN.
XMLRDNDescriptorSeparator	Specifies the separator used between descriptors in RDN.

all_signatures_valid Property

The cumulative validity of all signatures.

Syntax

def get_all_signatures_valid() -> bool: ...

all_signatures_valid = property(get_all_signatures_valid, None)

Default Value

FALSE

Remarks

Use this property to check if all the signatures found in the message or document are valid.

This property is read-only.

auto_validate_signatures Property

Specifies whether class should validate any present signatures when the document is opened.

Syntax

def get_auto_validate_signatures() -> bool: ...
def set_auto_validate_signatures(value: bool) -> None: ...

auto_validate_signatures = property(get_auto_validate_signatures, set_auto_validate_signatures)

Default Value

TRUE

Remarks

This setting is switched on by default. You can choose to set this property to false in order to validate the signatures manually on a later stage using the revalidate method.

cert_count Property

The number of records in the Cert arrays.

Syntax

def get_cert_count() -> int: ...

cert_count = property(get_cert_count, None)

Default Value

Remarks

This property controls the size of the following arrays:

cert_bytes
cert_ca
cert_ca_key_id
cert_cert_type
cert_crl_distribution_points
cert_curve
cert_fingerprint
cert_friendly_name
cert_handle
cert_hash_algorithm
cert_issuer
cert_issuer_rdn
cert_key_algorithm
cert_key_bits
cert_key_fingerprint
cert_key_usage
cert_key_valid
cert_ocsp_locations
cert_ocsp_no_check
cert_origin
cert_policy_i_ds
cert_private_key_bytes
cert_private_key_exists
cert_private_key_extractable
cert_public_key_bytes
cert_qualified
cert_qualified_statements
cert_qualifiers
cert_self_signed
cert_serial_number
cert_sig_algorithm
cert_source
cert_subject
cert_subject_alternative_name
cert_subject_key_id
cert_subject_rdn
cert_valid
cert_valid_from
cert_valid_to

The array indices start at 0 and end at cert_count - 1.

This property is read-only.

cert_bytes Property

Returns the raw certificate data in DER format.

Syntax

def get_cert_bytes(cert_index: int) -> bytes: ...

Remarks

Returns the raw certificate data in DER format.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_ca Property

Indicates whether the certificate has a CA capability.

Syntax

def get_cert_ca(cert_index: int) -> bool: ...

Default Value

FALSE

Remarks

Indicates whether the certificate has a CA capability. For the certificate to be considered a CA, it must have its Basic Constraints extension set with the CA indicator enabled.

Set this property when generating a new certificate to have its Basic Constraints extension generated automatically.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_ca_key_id Property

A unique identifier (fingerprint) of the CA certificate's cryptographic key.

Syntax

def get_cert_ca_key_id(cert_index: int) -> bytes: ...

Remarks

A unique identifier (fingerprint) of the CA certificate's cryptographic key.

Authority Key Identifier is a certificate extension which allows identification of certificates belonging to the same issuer, but with different public keys. It is a de-facto standard to include this extension in all certificates to facilitate chain building.

This setting cannot be set when generating a certificate as it always derives from another certificate property. CertificateManager generates this setting automatically if enough information is available to it: for self-signed certificates, this value is copied from the cert_subject_key_id setting, and for lower-level certificates, from the parent certificate's subject key ID extension.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_cert_type Property

Returns the type of the entity contained in the Certificate object.

Syntax

def get_cert_cert_type(cert_index: int) -> int: ...

Default Value

Remarks

Returns the type of the entity contained in the Certificate object.

A Certificate object can contain two types of cryptographic objects: a ready-to-use X.509 certificate, or a certificate request ("an unsigned certificate"). Certificate requests can be upgraded to full certificates by signing them with a CA certificate.

Use the CertificateManager class to load or create new certificate and certificate requests objects.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_crl_distribution_points Property

Contains a list of locations of CRL distribution points used to check this certificate's validity.

Syntax

def get_cert_crl_distribution_points(cert_index: int) -> str: ...

Default Value

Remarks

Contains a list of locations of CRL distribution points used to check this certificate's validity. The list is taken from the respective certificate extension.

Use this property when generating a certificate to provide a list of CRL endpoints that should be made part of the new certificate.

The endpoints are provided as a list of CRLF-separated URLs. Note that this differs from the behaviour used in earlier product versions, where the "|" character was used as the location separator.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_curve Property

Specifies the elliptic curve associated with the certificate's public key.

Syntax

def get_cert_curve(cert_index: int) -> str: ...

Default Value

Remarks

Specifies the elliptic curve associated with the certificate's public key. This setting only applies to certificates containing EC keys.


SB_EC_SECP112R1	`SECP112R1`
SB_EC_SECP112R2	`SECP112R2`
SB_EC_SECP128R1	`SECP128R1`
SB_EC_SECP128R2	`SECP128R2`
SB_EC_SECP160K1	`SECP160K1`
SB_EC_SECP160R1	`SECP160R1`
SB_EC_SECP160R2	`SECP160R2`
SB_EC_SECP192K1	`SECP192K1`
SB_EC_SECP192R1	`SECP192R1`
SB_EC_SECP224K1	`SECP224K1`
SB_EC_SECP224R1	`SECP224R1`
SB_EC_SECP256K1	`SECP256K1`
SB_EC_SECP256R1	`SECP256R1`
SB_EC_SECP384R1	`SECP384R1`
SB_EC_SECP521R1	`SECP521R1`
SB_EC_SECT113R1	`SECT113R1`
SB_EC_SECT113R2	`SECT113R2`
SB_EC_SECT131R1	`SECT131R1`
SB_EC_SECT131R2	`SECT131R2`
SB_EC_SECT163K1	`SECT163K1`
SB_EC_SECT163R1	`SECT163R1`
SB_EC_SECT163R2	`SECT163R2`
SB_EC_SECT193R1	`SECT193R1`
SB_EC_SECT193R2	`SECT193R2`
SB_EC_SECT233K1	`SECT233K1`
SB_EC_SECT233R1	`SECT233R1`
SB_EC_SECT239K1	`SECT239K1`
SB_EC_SECT283K1	`SECT283K1`
SB_EC_SECT283R1	`SECT283R1`
SB_EC_SECT409K1	`SECT409K1`
SB_EC_SECT409R1	`SECT409R1`
SB_EC_SECT571K1	`SECT571K1`
SB_EC_SECT571R1	`SECT571R1`
SB_EC_PRIME192V1	`PRIME192V1`
SB_EC_PRIME192V2	`PRIME192V2`
SB_EC_PRIME192V3	`PRIME192V3`
SB_EC_PRIME239V1	`PRIME239V1`
SB_EC_PRIME239V2	`PRIME239V2`
SB_EC_PRIME239V3	`PRIME239V3`
SB_EC_PRIME256V1	`PRIME256V1`
SB_EC_C2PNB163V1	`C2PNB163V1`
SB_EC_C2PNB163V2	`C2PNB163V2`
SB_EC_C2PNB163V3	`C2PNB163V3`
SB_EC_C2PNB176W1	`C2PNB176W1`
SB_EC_C2TNB191V1	`C2TNB191V1`
SB_EC_C2TNB191V2	`C2TNB191V2`
SB_EC_C2TNB191V3	`C2TNB191V3`
SB_EC_C2ONB191V4	`C2ONB191V4`
SB_EC_C2ONB191V5	`C2ONB191V5`
SB_EC_C2PNB208W1	`C2PNB208W1`
SB_EC_C2TNB239V1	`C2TNB239V1`
SB_EC_C2TNB239V2	`C2TNB239V2`
SB_EC_C2TNB239V3	`C2TNB239V3`
SB_EC_C2ONB239V4	`C2ONB239V4`
SB_EC_C2ONB239V5	`C2ONB239V5`
SB_EC_C2PNB272W1	`C2PNB272W1`
SB_EC_C2PNB304W1	`C2PNB304W1`
SB_EC_C2TNB359V1	`C2TNB359V1`
SB_EC_C2PNB368W1	`C2PNB368W1`
SB_EC_C2TNB431R1	`C2TNB431R1`
SB_EC_NISTP192	`NISTP192`
SB_EC_NISTP224	`NISTP224`
SB_EC_NISTP256	`NISTP256`
SB_EC_NISTP384	`NISTP384`
SB_EC_NISTP521	`NISTP521`
SB_EC_NISTB163	`NISTB163`
SB_EC_NISTB233	`NISTB233`
SB_EC_NISTB283	`NISTB283`
SB_EC_NISTB409	`NISTB409`
SB_EC_NISTB571	`NISTB571`
SB_EC_NISTK163	`NISTK163`
SB_EC_NISTK233	`NISTK233`
SB_EC_NISTK283	`NISTK283`
SB_EC_NISTK409	`NISTK409`
SB_EC_NISTK571	`NISTK571`
SB_EC_GOSTCPTEST	`GOSTCPTEST`
SB_EC_GOSTCPA	`GOSTCPA`
SB_EC_GOSTCPB	`GOSTCPB`
SB_EC_GOSTCPC	`GOSTCPC`
SB_EC_GOSTCPXCHA	`GOSTCPXCHA`
SB_EC_GOSTCPXCHB	`GOSTCPXCHB`
SB_EC_BRAINPOOLP160R1	`BRAINPOOLP160R1`
SB_EC_BRAINPOOLP160T1	`BRAINPOOLP160T1`
SB_EC_BRAINPOOLP192R1	`BRAINPOOLP192R1`
SB_EC_BRAINPOOLP192T1	`BRAINPOOLP192T1`
SB_EC_BRAINPOOLP224R1	`BRAINPOOLP224R1`
SB_EC_BRAINPOOLP224T1	`BRAINPOOLP224T1`
SB_EC_BRAINPOOLP256R1	`BRAINPOOLP256R1`
SB_EC_BRAINPOOLP256T1	`BRAINPOOLP256T1`
SB_EC_BRAINPOOLP320R1	`BRAINPOOLP320R1`
SB_EC_BRAINPOOLP320T1	`BRAINPOOLP320T1`
SB_EC_BRAINPOOLP384R1	`BRAINPOOLP384R1`
SB_EC_BRAINPOOLP384T1	`BRAINPOOLP384T1`
SB_EC_BRAINPOOLP512R1	`BRAINPOOLP512R1`
SB_EC_BRAINPOOLP512T1	`BRAINPOOLP512T1`
SB_EC_CURVE25519	`CURVE25519`
SB_EC_CURVE448	`CURVE448`

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_fingerprint Property

Contains the fingerprint (a hash imprint) of this certificate.

Syntax

def get_cert_fingerprint(cert_index: int) -> str: ...

Default Value

Remarks

Contains the fingerprint (a hash imprint) of this certificate.

While there is no formal standard defining what a fingerprint is, a SHA1 hash of the certificate's DER-encoded body is typically used.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_friendly_name Property

Contains an associated alias (friendly name) of the certificate.

Syntax

def get_cert_friendly_name(cert_index: int) -> str: ...

Default Value

Remarks

Contains an associated alias (friendly name) of the certificate. The friendly name is not a property of a certificate: it is maintained by the certificate media rather than being included in its DER representation. Windows certificate stores are one example of media that does support friendly names.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_handle Property

Allows to get or set a 'handle', a unique identifier of the underlying property object.

Syntax

def get_cert_handle(cert_index: int) -> int: ...

Default Value

Remarks

Allows to get or set a 'handle', a unique identifier of the underlying property object. Use this property to assign objects of the same type in a quicker manner, without copying them fieldwise.

When you pass a handle of one object to another, the source object is copied to the destination rather than assigned. It is safe to get rid of the original object after such operation. pdfSigner.setSigningCertHandle(certMgr.getCertHandle());

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_hash_algorithm Property

Provides means to set the hash algorithm to be used in the subsequent operation on the certificate (such as generation or key signing).

Syntax

def get_cert_hash_algorithm(cert_index: int) -> str: ...

Default Value

Remarks

Provides means to set the hash algorithm to be used in the subsequent operation on the certificate (such as generation or key signing). It is not a property of a certificate; use cert_sig_algorithm to find out the hash algorithm that is part of the certificate signature.


SB_HASH_ALGORITHM_SHA1	`SHA1`
SB_HASH_ALGORITHM_SHA224	`SHA224`
SB_HASH_ALGORITHM_SHA256	`SHA256`
SB_HASH_ALGORITHM_SHA384	`SHA384`
SB_HASH_ALGORITHM_SHA512	`SHA512`
SB_HASH_ALGORITHM_MD2	`MD2`
SB_HASH_ALGORITHM_MD4	`MD4`
SB_HASH_ALGORITHM_MD5	`MD5`
SB_HASH_ALGORITHM_RIPEMD160	`RIPEMD160`
SB_HASH_ALGORITHM_CRC32	`CRC32`
SB_HASH_ALGORITHM_SSL3	`SSL3`
SB_HASH_ALGORITHM_GOST_R3411_1994	`GOST1994`
SB_HASH_ALGORITHM_WHIRLPOOL	`WHIRLPOOL`
SB_HASH_ALGORITHM_POLY1305	`POLY1305`
SB_HASH_ALGORITHM_SHA3_224	`SHA3_224`
SB_HASH_ALGORITHM_SHA3_256	`SHA3_256`
SB_HASH_ALGORITHM_SHA3_384	`SHA3_384`
SB_HASH_ALGORITHM_SHA3_512	`SHA3_512`
SB_HASH_ALGORITHM_BLAKE2S_128	`BLAKE2S_128`
SB_HASH_ALGORITHM_BLAKE2S_160	`BLAKE2S_160`
SB_HASH_ALGORITHM_BLAKE2S_224	`BLAKE2S_224`
SB_HASH_ALGORITHM_BLAKE2S_256	`BLAKE2S_256`
SB_HASH_ALGORITHM_BLAKE2B_160	`BLAKE2B_160`
SB_HASH_ALGORITHM_BLAKE2B_256	`BLAKE2B_256`
SB_HASH_ALGORITHM_BLAKE2B_384	`BLAKE2B_384`
SB_HASH_ALGORITHM_BLAKE2B_512	`BLAKE2B_512`
SB_HASH_ALGORITHM_SHAKE_128	`SHAKE_128`
SB_HASH_ALGORITHM_SHAKE_256	`SHAKE_256`
SB_HASH_ALGORITHM_SHAKE_128_LEN	`SHAKE_128_LEN`
SB_HASH_ALGORITHM_SHAKE_256_LEN	`SHAKE_256_LEN`

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_issuer Property

The common name of the certificate issuer (CA), typically a company name.

Syntax

def get_cert_issuer(cert_index: int) -> str: ...

Default Value

Remarks

The common name of the certificate issuer (CA), typically a company name. This is part of a larger set of credentials available via cert_issuer_rdn.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_issuer_rdn Property

A list of Property=Value pairs that uniquely identify the certificate issuer.

Syntax

def get_cert_issuer_rdn(cert_index: int) -> str: ...

Default Value

Remarks

A list of Property=Value pairs that uniquely identify the certificate issuer.

Example: /C=US/O=Nationwide CA/CN=Web Certification Authority

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_key_algorithm Property

Specifies the public key algorithm of this certificate.

Syntax

def get_cert_key_algorithm(cert_index: int) -> str: ...

Default Value

"0"

Remarks

Specifies the public key algorithm of this certificate.


SB_CERT_ALGORITHM_ID_RSA_ENCRYPTION	`rsaEncryption`
SB_CERT_ALGORITHM_MD2_RSA_ENCRYPTION	`md2withRSAEncryption`
SB_CERT_ALGORITHM_MD5_RSA_ENCRYPTION	`md5withRSAEncryption`
SB_CERT_ALGORITHM_SHA1_RSA_ENCRYPTION	`sha1withRSAEncryption`
SB_CERT_ALGORITHM_ID_DSA	`id-dsa`
SB_CERT_ALGORITHM_ID_DSA_SHA1	`id-dsa-with-sha1`
SB_CERT_ALGORITHM_DH_PUBLIC	`dhpublicnumber`
SB_CERT_ALGORITHM_SHA224_RSA_ENCRYPTION	`sha224WithRSAEncryption`
SB_CERT_ALGORITHM_SHA256_RSA_ENCRYPTION	`sha256WithRSAEncryption`
SB_CERT_ALGORITHM_SHA384_RSA_ENCRYPTION	`sha384WithRSAEncryption`
SB_CERT_ALGORITHM_SHA512_RSA_ENCRYPTION	`sha512WithRSAEncryption`
SB_CERT_ALGORITHM_ID_RSAPSS	`id-RSASSA-PSS`
SB_CERT_ALGORITHM_ID_RSAOAEP	`id-RSAES-OAEP`
SB_CERT_ALGORITHM_RSASIGNATURE_RIPEMD160	`ripemd160withRSA`
SB_CERT_ALGORITHM_ID_ELGAMAL	`elGamal`
SB_CERT_ALGORITHM_SHA1_ECDSA	`ecdsa-with-SHA1`
SB_CERT_ALGORITHM_RECOMMENDED_ECDSA	`ecdsa-recommended`
SB_CERT_ALGORITHM_SHA224_ECDSA	`ecdsa-with-SHA224`
SB_CERT_ALGORITHM_SHA256_ECDSA	`ecdsa-with-SHA256`
SB_CERT_ALGORITHM_SHA384_ECDSA	`ecdsa-with-SHA384`
SB_CERT_ALGORITHM_SHA512_ECDSA	`ecdsa-with-SHA512`
SB_CERT_ALGORITHM_EC	`id-ecPublicKey`
SB_CERT_ALGORITHM_SPECIFIED_ECDSA	`ecdsa-specified`
SB_CERT_ALGORITHM_GOST_R3410_1994	`id-GostR3410-94`
SB_CERT_ALGORITHM_GOST_R3410_2001	`id-GostR3410-2001`
SB_CERT_ALGORITHM_GOST_R3411_WITH_R3410_1994	`id-GostR3411-94-with-GostR3410-94`
SB_CERT_ALGORITHM_GOST_R3411_WITH_R3410_2001	`id-GostR3411-94-with-GostR3410-2001`
SB_CERT_ALGORITHM_SHA1_ECDSA_PLAIN	`ecdsa-plain-SHA1`
SB_CERT_ALGORITHM_SHA224_ECDSA_PLAIN	`ecdsa-plain-SHA224`
SB_CERT_ALGORITHM_SHA256_ECDSA_PLAIN	`ecdsa-plain-SHA256`
SB_CERT_ALGORITHM_SHA384_ECDSA_PLAIN	`ecdsa-plain-SHA384`
SB_CERT_ALGORITHM_SHA512_ECDSA_PLAIN	`ecdsa-plain-SHA512`
SB_CERT_ALGORITHM_RIPEMD160_ECDSA_PLAIN	`ecdsa-plain-RIPEMD160`
SB_CERT_ALGORITHM_WHIRLPOOL_RSA_ENCRYPTION	`whirlpoolWithRSAEncryption`
SB_CERT_ALGORITHM_ID_DSA_SHA224	`id-dsa-with-sha224`
SB_CERT_ALGORITHM_ID_DSA_SHA256	`id-dsa-with-sha256`
SB_CERT_ALGORITHM_SHA3_224_RSA_ENCRYPTION	`id-rsassa-pkcs1-v1_5-with-sha3-224`
SB_CERT_ALGORITHM_SHA3_256_RSA_ENCRYPTION	`id-rsassa-pkcs1-v1_5-with-sha3-256`
SB_CERT_ALGORITHM_SHA3_384_RSA_ENCRYPTION	`id-rsassa-pkcs1-v1_5-with-sha3-384`
SB_CERT_ALGORITHM_SHA3_512_RSA_ENCRYPTION	`id-rsassa-pkcs1-v1_5-with-sha3-512`
SB_CERT_ALGORITHM_SHA3_224_ECDSA	`id-ecdsa-with-sha3-224`
SB_CERT_ALGORITHM_SHA3_256_ECDSA	`id-ecdsa-with-sha3-256`
SB_CERT_ALGORITHM_SHA3_384_ECDSA	`id-ecdsa-with-sha3-384`
SB_CERT_ALGORITHM_SHA3_512_ECDSA	`id-ecdsa-with-sha3-512`
SB_CERT_ALGORITHM_SHA3_224_ECDSA_PLAIN	`id-ecdsa-plain-with-sha3-224`
SB_CERT_ALGORITHM_SHA3_256_ECDSA_PLAIN	`id-ecdsa-plain-with-sha3-256`
SB_CERT_ALGORITHM_SHA3_384_ECDSA_PLAIN	`id-ecdsa-plain-with-sha3-384`
SB_CERT_ALGORITHM_SHA3_512_ECDSA_PLAIN	`id-ecdsa-plain-with-sha3-512`
SB_CERT_ALGORITHM_ID_DSA_SHA3_224	`id-dsa-with-sha3-224`
SB_CERT_ALGORITHM_ID_DSA_SHA3_256	`id-dsa-with-sha3-256`
SB_CERT_ALGORITHM_BLAKE2S_128_RSA_ENCRYPTION	`id-rsassa-pkcs1-v1_5-with-blake2s128`
SB_CERT_ALGORITHM_BLAKE2S_160_RSA_ENCRYPTION	`id-rsassa-pkcs1-v1_5-with-blake2s160`
SB_CERT_ALGORITHM_BLAKE2S_224_RSA_ENCRYPTION	`id-rsassa-pkcs1-v1_5-with-blake2s224`
SB_CERT_ALGORITHM_BLAKE2S_256_RSA_ENCRYPTION	`id-rsassa-pkcs1-v1_5-with-blake2s256`
SB_CERT_ALGORITHM_BLAKE2B_160_RSA_ENCRYPTION	`id-rsassa-pkcs1-v1_5-with-blake2b160`
SB_CERT_ALGORITHM_BLAKE2B_256_RSA_ENCRYPTION	`id-rsassa-pkcs1-v1_5-with-blake2b256`
SB_CERT_ALGORITHM_BLAKE2B_384_RSA_ENCRYPTION	`id-rsassa-pkcs1-v1_5-with-blake2b384`
SB_CERT_ALGORITHM_BLAKE2B_512_RSA_ENCRYPTION	`id-rsassa-pkcs1-v1_5-with-blake2b512`
SB_CERT_ALGORITHM_BLAKE2S_128_ECDSA	`id-ecdsa-with-blake2s128`
SB_CERT_ALGORITHM_BLAKE2S_160_ECDSA	`id-ecdsa-with-blake2s160`
SB_CERT_ALGORITHM_BLAKE2S_224_ECDSA	`id-ecdsa-with-blake2s224`
SB_CERT_ALGORITHM_BLAKE2S_256_ECDSA	`id-ecdsa-with-blake2s256`
SB_CERT_ALGORITHM_BLAKE2B_160_ECDSA	`id-ecdsa-with-blake2b160`
SB_CERT_ALGORITHM_BLAKE2B_256_ECDSA	`id-ecdsa-with-blake2b256`
SB_CERT_ALGORITHM_BLAKE2B_384_ECDSA	`id-ecdsa-with-blake2b384`
SB_CERT_ALGORITHM_BLAKE2B_512_ECDSA	`id-ecdsa-with-blake2b512`
SB_CERT_ALGORITHM_BLAKE2S_128_ECDSA_PLAIN	`id-ecdsa-plain-with-blake2s128`
SB_CERT_ALGORITHM_BLAKE2S_160_ECDSA_PLAIN	`id-ecdsa-plain-with-blake2s160`
SB_CERT_ALGORITHM_BLAKE2S_224_ECDSA_PLAIN	`id-ecdsa-plain-with-blake2s224`
SB_CERT_ALGORITHM_BLAKE2S_256_ECDSA_PLAIN	`id-ecdsa-plain-with-blake2s256`
SB_CERT_ALGORITHM_BLAKE2B_160_ECDSA_PLAIN	`id-ecdsa-plain-with-blake2b160`
SB_CERT_ALGORITHM_BLAKE2B_256_ECDSA_PLAIN	`id-ecdsa-plain-with-blake2b256`
SB_CERT_ALGORITHM_BLAKE2B_384_ECDSA_PLAIN	`id-ecdsa-plain-with-blake2b384`
SB_CERT_ALGORITHM_BLAKE2B_512_ECDSA_PLAIN	`id-ecdsa-plain-with-blake2b512`
SB_CERT_ALGORITHM_ID_DSA_BLAKE2S_224	`id-dsa-with-blake2s224`
SB_CERT_ALGORITHM_ID_DSA_BLAKE2S_256	`id-dsa-with-blake2s256`
SB_CERT_ALGORITHM_EDDSA_ED25519	`id-Ed25519`
SB_CERT_ALGORITHM_EDDSA_ED448	`id-Ed448`
SB_CERT_ALGORITHM_EDDSA_ED25519_PH	`id-Ed25519ph`
SB_CERT_ALGORITHM_EDDSA_ED448_PH	`id-Ed448ph`
SB_CERT_ALGORITHM_EDDSA	`id-EdDSA`
SB_CERT_ALGORITHM_EDDSA_SIGNATURE	`id-EdDSA-sig`

Use the cert_key_bits, cert_curve, and cert_public_key_bytes properties to get more details about the key the certificate contains.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_key_bits Property

Returns the length of the public key in bits.

Syntax

def get_cert_key_bits(cert_index: int) -> int: ...

Default Value

Remarks

Returns the length of the public key in bits.

This value indicates the length of the principal cryptographic parameter of the key, such as the length of the RSA modulus or ECDSA field. The key data returned by the cert_public_key_bytes or cert_private_key_bytes property would typically contain auxiliary values, and therefore be longer.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_key_fingerprint Property

Returns a SHA1 fingerprint of the public key contained in the certificate.

Syntax

def get_cert_key_fingerprint(cert_index: int) -> str: ...

Default Value

Remarks

Returns a SHA1 fingerprint of the public key contained in the certificate.

Note that the key fingerprint is different from the certificate fingerprint accessible via the cert_fingerprint property. The key fingeprint uniquely identifies the public key, and so can be the same for multiple certificates containing the same key.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_key_usage Property

Indicates the purposes of the key contained in the certificate, in the form of an OR'ed flag set.

Syntax

def get_cert_key_usage(cert_index: int) -> int: ...

Default Value

Remarks

Indicates the purposes of the key contained in the certificate, in the form of an OR'ed flag set.

This value is a bit mask of the following values:


ckuUnknown	`0x00000`	Unknown key usage
ckuDigitalSignature	`0x00001`	Digital signature
ckuNonRepudiation	`0x00002`	Non-repudiation
ckuKeyEncipherment	`0x00004`	Key encipherment
ckuDataEncipherment	`0x00008`	Data encipherment
ckuKeyAgreement	`0x00010`	Key agreement
ckuKeyCertSign	`0x00020`	Certificate signing
ckuCRLSign	`0x00040`	Revocation signing
ckuEncipherOnly	`0x00080`	Encipher only
ckuDecipherOnly	`0x00100`	Decipher only
ckuServerAuthentication	`0x00200`	Server authentication
ckuClientAuthentication	`0x00400`	Client authentication
ckuCodeSigning	`0x00800`	Code signing
ckuEmailProtection	`0x01000`	Email protection
ckuTimeStamping	`0x02000`	Timestamping
ckuOCSPSigning	`0x04000`	OCSP signing
ckuSmartCardLogon	`0x08000`	Smartcard logon
ckuKeyPurposeClientAuth	`0x10000`	Kerberos - client authentication
ckuKeyPurposeKDC	`0x20000`	Kerberos - KDC

Set this property before generating the certificate to propagate the key usage flags to the new certificate.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_key_valid Property

Returns True if the certificate's key is cryptographically valid, and False otherwise.

Syntax

def get_cert_key_valid(cert_index: int) -> bool: ...

Default Value

FALSE

Remarks

Returns True if the certificate's key is cryptographically valid, and False otherwise.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_ocsp_locations Property

Locations of OCSP services that can be used to check this certificate's validity in real time, as recorded by the CA.

Syntax

def get_cert_ocsp_locations(cert_index: int) -> str: ...

Default Value

Remarks

Locations of OCSP services that can be used to check this certificate's validity in real time, as recorded by the CA.

Set this property before calling the certificate manager's generate method to propagate it to the new certificate.

The OCSP locations are provided as a list of CRLF-separated URLs. Note that this differs from the behaviour used in earlier product versions, where the "|" character was used as the location separator.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_ocsp_no_check Property

Accessor to the value of the certificate's ocsp-no-check extension.

Syntax

def get_cert_ocsp_no_check(cert_index: int) -> bool: ...

Default Value

FALSE

Remarks

Accessor to the value of the certificate's ocsp-no-check extension.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_origin Property

Returns the location that the certificate was taken or loaded from.

Syntax

def get_cert_origin(cert_index: int) -> int: ...

Default Value

Remarks

Returns the location that the certificate was taken or loaded from.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_policy_i_ds Property

Contains identifiers (OIDs) of the applicable certificate policies.

Syntax

def get_cert_policy_i_ds(cert_index: int) -> str: ...

Default Value

Remarks

Contains identifiers (OIDs) of the applicable certificate policies.

The Certificate Policies extension identifies a sequence of policies under which the certificate has been issued, and which regulate its usage.

Set this property when generating a certificate to propagate the policies information to the new certificate.

The policies are provided as a list of CRLF-separated entries. Note that this differs from the behaviour used in earlier product versions, where the "|" character was used as the policy element separator.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_private_key_bytes Property

Returns the certificate's private key in DER-encoded format.

Syntax

def get_cert_private_key_bytes(cert_index: int) -> bytes: ...

Remarks

Returns the certificate's private key in DER-encoded format. It is normal for this property to be empty if the private key is non-exportable, which, for example, is typical for certificates originating from hardware security devices.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_private_key_exists Property

Indicates whether the certificate has a usable private key associated with it.

Syntax

def get_cert_private_key_exists(cert_index: int) -> bool: ...

Default Value

FALSE

Remarks

Indicates whether the certificate has a usable private key associated with it. If it is set to True, the certificate can be used for private key operations, such as signing or decryption.

This property is independent from cert_private_key_bytes, and can be set to True even if the former is empty. This would imply that the private key is non-exportable, but still can be used for cryptographic operations.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_private_key_extractable Property

Indicates whether the private key is extractable (exportable).

Syntax

def get_cert_private_key_extractable(cert_index: int) -> bool: ...

Default Value

FALSE

Remarks

Indicates whether the private key is extractable (exportable).

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_public_key_bytes Property

Contains the certificate's public key in DER format.

Syntax

def get_cert_public_key_bytes(cert_index: int) -> bytes: ...

Remarks

Contains the certificate's public key in DER format.

This typically would contain an ASN.1-encoded public key value. The exact format depends on the type of the public key contained in the certificate.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_qualified Property

Indicates whether the certificate is qualified.

Syntax

def get_cert_qualified(cert_index: int) -> bool: ...

Default Value

FALSE

Remarks

Indicates whether the certificate is qualified.

This property is set to True if the certificate is confirmed by a Trusted List to be qualified.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_qualified_statements Property

Returns a simplified qualified status of the certificate.

Syntax

def get_cert_qualified_statements(cert_index: int) -> int: ...

Default Value

Remarks

Returns a simplified qualified status of the certificate.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_qualifiers Property

A list of qualifiers.

Syntax

def get_cert_qualifiers(cert_index: int) -> str: ...

Default Value

Remarks

A list of qualifiers.

Contains a comma-separated list of qualifier aliases for the certificate, for example QCP-n-qscd,QCWithSSCD.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_self_signed Property

Indicates whether the certificate is self-signed (root) or signed by an external CA.

Syntax

def get_cert_self_signed(cert_index: int) -> bool: ...

Default Value

FALSE

Remarks

Indicates whether the certificate is self-signed (root) or signed by an external CA.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_serial_number Property

Returns the certificate's serial number.

Syntax

def get_cert_serial_number(cert_index: int) -> bytes: ...

Remarks

Returns the certificate's serial number.

The serial number is a binary string that uniquely identifies a certificate among others issued by the same CA. According to the X.509 standard, the (issuer, serial number) pair should be globally unique to facilitate chain building.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_sig_algorithm Property

Indicates the algorithm that was used by the CA to sign this certificate.

Syntax

def get_cert_sig_algorithm(cert_index: int) -> str: ...

Default Value

Remarks

Indicates the algorithm that was used by the CA to sign this certificate.

A signature algorithm typically combines hash and public key algorithms together, such as sha256WithRSAEncryption or ecdsa-with-SHA256.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_source Property

Returns the source (location or disposition) of a cryptographic primitive entity, such as a certificate, CRL, or OCSP response.

Syntax

def get_cert_source(cert_index: int) -> int: ...

Default Value

Remarks

Returns the source (location or disposition) of a cryptographic primitive entity, such as a certificate, CRL, or OCSP response.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_subject Property

The common name of the certificate holder, typically an individual's name, a URL, an e-mail address, or a company name.

Syntax

def get_cert_subject(cert_index: int) -> str: ...

Default Value

Remarks

The common name of the certificate holder, typically an individual's name, a URL, an e-mail address, or a company name. This is part of a larger set of credentials available via cert_subject_rdn.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_subject_alternative_name Property

Returns or sets the value of the Subject Alternative Name extension of the certificate.

Syntax

def get_cert_subject_alternative_name(cert_index: int) -> str: ...

Default Value

Remarks

Returns or sets the value of the Subject Alternative Name extension of the certificate.

Subject alternative names are used to provide additional names that are impractical to store in the main cert_subject_rdn field. For example, it is often used to store all the domain names that a TLS certificate is authorized to protect.

The alternative names are provided as a list of CRLF-separated entries. Note that this differs from the behaviour used in earlier product versions, where the "|" character was used as the element separator.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_subject_key_id Property

Contains a unique identifier of the certificate's cryptographic key.

Syntax

def get_cert_subject_key_id(cert_index: int) -> bytes: ...

Remarks

Contains a unique identifier of the certificate's cryptographic key.

Subject Key Identifier is a certificate extension which allows a specific public key to be associated with a certificate holder. Typically, subject key identifiers of CA certificates are recorded as respective CA key identifiers in the subordinate certificates that they issue, which facilitates chain building.

The cert_subject_key_id and cert_ca_key_id properties of self-signed certificates typically contain identical values, as in that specific case, the issuer and the subject are the same entity.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_subject_rdn Property

A list of Property=Value pairs that uniquely identify the certificate holder (subject).

Syntax

def get_cert_subject_rdn(cert_index: int) -> str: ...

Default Value

Remarks

A list of Property=Value pairs that uniquely identify the certificate holder (subject).

Depending on the purpose of the certificate and the policies of the CA that issued it, the values included in the subject record may differ drastically and contain business or personal names, web URLs, email addresses, and other data.

Example: /C=US/O=Oranges and Apples, Inc./OU=Accounts Receivable/1.2.3.4.5=Value with unknown OID/CN=Margaret Watkins.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_valid Property

Indicates whether or not the signature over the certificate or the request is valid and matches the public key contained in the CA certificate/request.

Syntax

def get_cert_valid(cert_index: int) -> bool: ...

Default Value

FALSE

Remarks

Indicates whether or not the signature over the certificate or the request is valid and matches the public key contained in the CA certificate/request.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_valid_from Property

The time point at which the certificate becomes valid, in UTC.

Syntax

def get_cert_valid_from(cert_index: int) -> str: ...

Default Value

Remarks

The time point at which the certificate becomes valid, in UTC.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

cert_valid_to Property

The time point at which the certificate expires, in UTC.

Syntax

def get_cert_valid_to(cert_index: int) -> str: ...

Default Value

Remarks

The time point at which the certificate expires, in UTC.

The cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the cert_count property.

This property is read-only.

data_bytes Property

Use this property to pass the external data to class in the byte array form.

Syntax

def get_data_bytes() -> bytes: ...
def set_data_bytes(value: bytes) -> None: ...

data_bytes = property(get_data_bytes, set_data_bytes)

Remarks

Assign a byte array containing the external data to be processed to this property.

data_file Property

A file containing the external data covered by a detached signature.

Syntax

def get_data_file() -> str: ...
def set_data_file(value: str) -> None: ...

data_file = property(get_data_file, set_data_file)

Default Value

Remarks

In the case of a detached signature, use this property to provide the external data to the class from a file. Alternatively, provide the data via data_stream.

data_type Property

Specifies the external data type.

Syntax

def get_data_type() -> int: ...
def set_data_type(value: int) -> None: ...

data_type = property(get_data_type, set_data_type)

Default Value

Remarks

Use this property to specify the type of the external data (either data_file, data_stream or data_bytes properties) for class.

data_uri Property

Specifies a detached data resource URI.

Syntax

def get_data_uri() -> str: ...
def set_data_uri(value: str) -> None: ...

data_uri = property(get_data_uri, set_data_uri)

Default Value

Remarks

Specifies a URI used for data being signed, usually the data filename if stored along with a detached signature.

encoding Property

Specifies XML encoding.

Syntax

def get_encoding() -> str: ...
def set_encoding(value: str) -> None: ...

encoding = property(get_encoding, set_encoding)

Default Value

Remarks

Use this property to specify the encoding to apply to the XML documents.

fips_mode Property

Reserved.

Syntax

def get_fips_mode() -> bool: ...
def set_fips_mode(value: bool) -> None: ...

fips_mode = property(get_fips_mode, set_fips_mode)

Default Value

FALSE

Remarks

This property is reserved for future use.

input_bytes Property

Use this property to pass the input to class in byte array form.

Syntax

def get_input_bytes() -> bytes: ...
def set_input_bytes(value: bytes) -> None: ...

input_bytes = property(get_input_bytes, set_input_bytes)

Remarks

Assign a byte array containing the data to be processed to this property.

input_file Property

A signed XML file.

Syntax

def get_input_file() -> str: ...
def set_input_file(value: str) -> None: ...

input_file = property(get_input_file, set_input_file)

Default Value

Remarks

Provide a path to the signed XML document in this property.

known_cert_count Property

The number of records in the KnownCert arrays.

Syntax

def get_known_cert_count() -> int: ...
def set_known_cert_count(value: int) -> None: ...

known_cert_count = property(get_known_cert_count, set_known_cert_count)

Default Value

Remarks

This property controls the size of the following arrays:

known_cert_bytes
known_cert_handle

The array indices start at 0 and end at known_cert_count - 1.

known_cert_bytes Property

Returns the raw certificate data in DER format.

Syntax

def get_known_cert_bytes(known_cert_index: int) -> bytes: ...

Remarks

Returns the raw certificate data in DER format.

The known_cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the known_cert_count property.

This property is read-only.

known_cert_handle Property

Allows to get or set a 'handle', a unique identifier of the underlying property object.

Syntax

def get_known_cert_handle(known_cert_index: int) -> int: ...
def set_known_cert_handle(known_cert_index: int, value: int) -> None: ...

Default Value

Remarks

Allows to get or set a 'handle', a unique identifier of the underlying property object. Use this property to assign objects of the same type in a quicker manner, without copying them fieldwise.

The known_cert_index parameter specifies the index of the item in the array. The size of the array is controlled by the known_cert_count property.

output_bytes Property

Use this property to read the output the class object has produced.

Syntax

def get_output_bytes() -> bytes: ...

output_bytes = property(get_output_bytes, None)

Remarks

Read the contents of this property after the operation has completed to read the produced output. This property will only be set if the output_file and output_stream properties had not been assigned.

This property is read-only.

output_file Property

The file where the modified signed document will be saved.

Syntax

def get_output_file() -> str: ...
def set_output_file(value: str) -> None: ...

output_file = property(get_output_file, set_output_file)

Default Value

Remarks

Provide the full path to the file where the modified signed document should be saved.

reference_count Property

The number of records in the Reference arrays.

Syntax

def get_reference_count() -> int: ...

reference_count = property(get_reference_count, None)

Default Value

Remarks

This property controls the size of the following arrays:

reference_canonicalization_method
reference_custom_element_id
reference_digest_value
reference_handle
reference_hash_algorithm
reference_has_uri
reference_id
reference_inclusive_namespaces_prefix_list
reference_reference_type
reference_target_data
reference_target_type
reference_target_xml_element
reference_uri
reference_use_base64_transform
reference_use_enveloped_signature_transform
reference_use_xpath_filter2_transform
reference_use_xpath_transform
reference_validation_result
reference_xpath_expression
reference_xpath_filter2_expressions
reference_xpath_filter2_filters
reference_xpath_filter2_prefix_list
reference_xpath_prefix_list

The array indices start at 0 and end at reference_count - 1.

This property is read-only.

reference_canonicalization_method Property

Use this property to specify the canonicalization method for the transform of the reference.

Syntax

def get_reference_canonicalization_method(reference_index: int) -> int: ...

Default Value

Remarks

Use this property to specify the canonicalization method for the transform of the reference. Use cxcmNone value to not to include canonicalization transform in transform chain. See XML-Signature Syntax and Processing specification for details.


cxcmNone	`0`
cxcmCanon	`1`
cxcmCanonComment	`2`
cxcmExclCanon	`3`
cxcmExclCanonComment	`4`
cxcmMinCanon	`5`
cxcmCanon_v1_1	`6`
cxcmCanonComment_v1_1	`7`

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_custom_element_id Property

Specifies a custom identifier (ID) attribute for a referenced (target) element that will be set on signing.

Syntax

def get_reference_custom_element_id(reference_index: int) -> str: ...

Default Value

Remarks

Specifies a custom identifier (ID) attribute for a referenced (target) element that will be set on signing. Used when the referenced element doesn't have an ID and URI property is empty.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_digest_value Property

Use this property to get or set the value of the digest calculated over the referenced data.

Syntax

def get_reference_digest_value(reference_index: int) -> bytes: ...

Remarks

Use this property to get or set the value of the digest calculated over the referenced data.

This property is optional and should be set only if you don't provide the actual data via TargetData or URI. If the data is set, then you don't need to set DigestValue since it will be calculated automatically.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_handle Property

Allows to get or set a 'handle', a unique identifier of the underlying property object.

Syntax

def get_reference_handle(reference_index: int) -> int: ...

Default Value

Remarks

Allows to get or set a 'handle', a unique identifier of the underlying property object. Use this property to assign objects of the same type in a quicker manner, without copying them fieldwise.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_hash_algorithm Property

Specifies the hash algorithm to be used.

Syntax

def get_reference_hash_algorithm(reference_index: int) -> str: ...

Default Value

"SHA256"

Remarks

Specifies the hash algorithm to be used.

Supported values:


SB_HASH_ALGORITHM_MD5	`MD5`
SB_HASH_ALGORITHM_SHA1	`SHA1`
SB_HASH_ALGORITHM_SHA224	`SHA224`
SB_HASH_ALGORITHM_SHA256	`SHA256`
SB_HASH_ALGORITHM_SHA384	`SHA384`
SB_HASH_ALGORITHM_SHA512	`SHA512`
SB_HASH_ALGORITHM_RIPEMD160	`RIPEMD160`
SB_HASH_ALGORITHM_GOST_R3411_1994	`GOST1994`
SB_HASH_ALGORITHM_WHIRLPOOL	`WHIRLPOOL`
SB_HASH_ALGORITHM_SHA3_256	`SHA3_256`
SB_HASH_ALGORITHM_SHA3_384	`SHA3_384`
SB_HASH_ALGORITHM_SHA3_512	`SHA3_512`

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_has_uri Property

Specifies whether the URI is set (even when it is empty).

Syntax

def get_reference_has_uri(reference_index: int) -> bool: ...

Default Value

TRUE

Remarks

Specifies whether the URI is set (even when it is empty).

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_id Property

A user-defined identifier (ID) attribute of this Reference element.

Syntax

def get_reference_id(reference_index: int) -> str: ...

Default Value

Remarks

A user-defined identifier (ID) attribute of this Reference element.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_inclusive_namespaces_prefix_list Property

Use this property to specify InclusiveNamespaces PrefixList for exclusive canonicalization transform of the reference.

Syntax

def get_reference_inclusive_namespaces_prefix_list(reference_index: int) -> str: ...

Default Value

Remarks

Use this property to specify InclusiveNamespaces PrefixList for exclusive canonicalization transform of the reference. See XML-Signature Syntax and Processing specification for details.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_reference_type Property

The Reference's type attribute as defined in XMLDSIG specification.

Syntax

def get_reference_reference_type(reference_index: int) -> str: ...

Default Value

Remarks

The Reference's type attribute as defined in XMLDSIG specification.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_target_data Property

Contains the referenced external data when the digest value is not explicitly specified.

Syntax

def get_reference_target_data(reference_index: int) -> bytes: ...

Remarks

Contains the referenced external data when the digest value is not explicitly specified.

This property is optional and should only be set if you reference the external data via URI, and you don't provide the digest value explicitly via DigestValue.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_target_type Property

The reference's target type to use.

Syntax

def get_reference_target_type(reference_index: int) -> int: ...

Default Value

Remarks

The reference's target type to use.

Use this property to specify the reference's target type to use when forming the signature.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_target_xml_element Property

This property specifies the referenced XML element.

Syntax

def get_reference_target_xml_element(reference_index: int) -> str: ...

Default Value

Remarks

This property specifies the referenced XML element. Used when the URI property is not set. In this case, the URI value is generated based on the ID of the referenced (target) XML element. If the URI property is set, this property is ignored until the ResolveReference event.

Supported values are:


""	an empty string indicates the Document element.
"#id"	indicates an XML element with specified Id.
XPointer expression	indicates an XML element selected using XPointer expression. Use the add_known_namespace method to specify Prefixes and NamespaceURIs For example: "/root/data[1]" - indicates the second "data" element under the document element with a name "root" "//ns1:data" - indicates a data element. "ns1" prefix should be defined via add_known_namespace method.
Node name	indicates an XML element selected using its NodeName. For example: "data" - indicates an XML element with node name "data".

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_uri Property

Use this property to get or set the URL which references the data.

Syntax

def get_reference_uri(reference_index: int) -> str: ...

Default Value

Remarks

Use this property to get or set the URL which references the data. If the data is external, the application must set either TargetData or DigestValue. If TargetData is set, the digest is calculated automatically unless it is explicitly set by the application via DigestValue.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_use_base64_transform Property

Specifies whether Base64 transform is included in transform chain.

Syntax

def get_reference_use_base64_transform(reference_index: int) -> bool: ...

Default Value

FALSE

Remarks

Specifies whether Base64 transform is included in transform chain.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_use_enveloped_signature_transform Property

Specifies whether enveloped signature transform is included in transform chain.

Syntax

def get_reference_use_enveloped_signature_transform(reference_index: int) -> bool: ...

Default Value

FALSE

Remarks

Specifies whether enveloped signature transform is included in transform chain.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_use_xpath_filter2_transform Property

Specifies whether XPath Filter 2.

Syntax

def get_reference_use_xpath_filter2_transform(reference_index: int) -> bool: ...

Default Value

FALSE

Remarks

Specifies whether XPath Filter 2.0 transform is included in transform chain.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_use_xpath_transform Property

Specifies whether XPath transform is included in transform chain.

Syntax

def get_reference_use_xpath_transform(reference_index: int) -> bool: ...

Default Value

FALSE

Remarks

Specifies whether XPath transform is included in transform chain.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_validation_result Property

The outcome of the cryptographic reference validation.

Syntax

def get_reference_validation_result(reference_index: int) -> bool: ...

Default Value

FALSE

Remarks

The outcome of the cryptographic reference validation.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_xpath_expression Property

Use this property to specify XPath expression for XPath transform of the reference.

Syntax

def get_reference_xpath_expression(reference_index: int) -> str: ...

Default Value

Remarks

Use this property to specify XPath expression for XPath transform of the reference.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_xpath_filter2_expressions Property

Use this property to specify XPointer expression(s) for XPath Filter 2.

Syntax

def get_reference_xpath_filter2_expressions(reference_index: int) -> str: ...

Default Value

Remarks

Use this property to specify XPointer expression(s) for XPath Filter 2.0 transform of the reference.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_xpath_filter2_filters Property

Use this property to specify XPointer filter(s) for XPath Filter 2.

Syntax

def get_reference_xpath_filter2_filters(reference_index: int) -> str: ...

Default Value

Remarks

Use this property to specify XPointer filter(s) for XPath Filter 2.0 transform of the reference. The prefix list is comma-separated.

Supported values:


"intersect"	Intersect filter computes the intersection of the selected subtrees with the filter node-set.
"subtract"	Subtract filter computes the subtraction of the selected subtrees with the filter node-set.
"union"	Union filter computes the union of the selected subtrees with the filter node-set.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_xpath_filter2_prefix_list Property

Use this property to specify a prefix list for XPath Filter 2.

Syntax

def get_reference_xpath_filter2_prefix_list(reference_index: int) -> str: ...

Default Value

Remarks

Use this property to specify a prefix list for XPath Filter 2.0 transform of the reference. The prefix list is space-separated. Namespace URIs that are used are taken from XPathNamespaces property.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

reference_xpath_prefix_list Property

Use this property to specify a prefix list for XPath transform of the reference.

Syntax

def get_reference_xpath_prefix_list(reference_index: int) -> str: ...

Default Value

Remarks

Use this property to specify a prefix list for XPath transform of the reference. The prefix list is space-separated. Namespace URIs that are used are taken from XPathNamespaces property.

The reference_index parameter specifies the index of the item in the array. The size of the array is controlled by the reference_count property.

This property is read-only.

signature_count Property

The number of records in the Signature arrays.

Syntax

def get_signature_count() -> int: ...

signature_count = property(get_signature_count, None)

Default Value

Remarks

This property controls the size of the following arrays:

signature_canonicalization_method
signature_compatibility_errors
signature_entity_label
signature_handle
signature_hash_algorithm
signature_issuer_rdn
signature_parent_entity
signature_serial_number
signature_signature_bytes
signature_signature_type
signature_signature_validation_result
signature_subject_key_id
signature_subject_rdn
signature_xml_element

The array indices start at 0 and end at signature_count - 1.

This property is read-only.

signature_canonicalization_method Property

The XML canonicalization method that was used for signing.

Syntax

def get_signature_canonicalization_method(signature_index: int) -> int: ...

Default Value

Remarks

The XML canonicalization method that was used for signing.

Supported canonicalization methods:


cxcmNone	`0`
cxcmCanon	`1`
cxcmCanonComment	`2`
cxcmExclCanon	`3`
cxcmExclCanonComment	`4`
cxcmMinCanon	`5`
cxcmCanon_v1_1	`6`
cxcmCanonComment_v1_1	`7`

The signature_index parameter specifies the index of the item in the array. The size of the array is controlled by the signature_count property.

This property is read-only.

signature_compatibility_errors Property

Returns compatibility errors encountered during validation.

Syntax

def get_signature_compatibility_errors(signature_index: int) -> int: ...

Default Value

Remarks

Returns compatibility errors encountered during validation.

Use this property to get specific compatibility errors encountered during validation. Unlike chain validation details, compatibility errors indicate violations by the signature of the assumed signature level/profile. For example, BES signatures are required to contain the signing time attribute. A prospective BES signature without such attribute will invoke a compatibility error.

The signature_index parameter specifies the index of the item in the array. The size of the array is controlled by the signature_count property.

This property is read-only.

signature_entity_label Property

Use this property to get the signature entity label.

Syntax

def get_signature_entity_label(signature_index: int) -> str: ...

Default Value

Remarks

Use this property to get the signature entity label.

This property returns a string label that uniquely identifies the signature. The label can be used to establish the signature target in the SignatureFound event or to select the signing chain via the SelectInfo method.

The signature_index parameter specifies the index of the item in the array. The size of the array is controlled by the signature_count property.

This property is read-only.

signature_handle Property

Allows to get or set a 'handle', a unique identifier of the underlying property object.

Syntax

def get_signature_handle(signature_index: int) -> int: ...

Default Value

Remarks

Allows to get or set a 'handle', a unique identifier of the underlying property object. Use this property to assign objects of the same type in a quicker manner, without copying them fieldwise.

The signature_index parameter specifies the index of the item in the array. The size of the array is controlled by the signature_count property.

This property is read-only.

signature_hash_algorithm Property

The hash algorithm used for signing.

Syntax

def get_signature_hash_algorithm(signature_index: int) -> str: ...

Default Value

"Unknown"

Remarks

The hash algorithm used for signing.


SB_HASH_ALGORITHM_MD5	`MD5`
SB_HASH_ALGORITHM_SHA1	`SHA1`
SB_HASH_ALGORITHM_SHA224	`SHA224`
SB_HASH_ALGORITHM_SHA256	`SHA256`
SB_HASH_ALGORITHM_SHA384	`SHA384`
SB_HASH_ALGORITHM_SHA512	`SHA512`
SB_HASH_ALGORITHM_RIPEMD160	`RIPEMD160`
SB_HASH_ALGORITHM_GOST_R3411_1994	`GOST1994`
SB_HASH_ALGORITHM_WHIRLPOOL	`WHIRLPOOL`
SB_HASH_ALGORITHM_SHA3_256	`SHA3_256`
SB_HASH_ALGORITHM_SHA3_384	`SHA3_384`
SB_HASH_ALGORITHM_SHA3_512	`SHA3_512`

The signature_index parameter specifies the index of the item in the array. The size of the array is controlled by the signature_count property.

This property is read-only.

signature_issuer_rdn Property

The Relative Distinguished Name of the signing certificate's issuer.

Syntax

def get_signature_issuer_rdn(signature_index: int) -> str: ...

Default Value

Remarks

The Relative Distinguished Name of the signing certificate's issuer.

A collection of information, in the form of [OID, Value] pairs, about the company that issued the signing certificate.

The signature_index parameter specifies the index of the item in the array. The size of the array is controlled by the signature_count property.

This property is read-only.

signature_parent_entity Property

Use this property to get the parent signature label.

Syntax

def get_signature_parent_entity(signature_index: int) -> str: ...

Default Value

Remarks

Use this property to get the parent signature label.

This property contains the unique entity label of the current signature's parent object - typically a higher-level signature or a timestamp.

The signature_index parameter specifies the index of the item in the array. The size of the array is controlled by the signature_count property.

This property is read-only.

signature_serial_number Property

The serial number of the signing certificate.

Syntax

def get_signature_serial_number(signature_index: int) -> bytes: ...

Remarks

The serial number of the signing certificate.

The signature_index parameter specifies the index of the item in the array. The size of the array is controlled by the signature_count property.

This property is read-only.

signature_signature_bytes Property

Returns the binary representation of the XML signature.

Syntax

def get_signature_signature_bytes(signature_index: int) -> bytes: ...

Remarks

Returns the binary representation of the XML signature.

The signature_index parameter specifies the index of the item in the array. The size of the array is controlled by the signature_count property.

This property is read-only.

signature_signature_type Property

The signature type to employ when signing the document.

Syntax

def get_signature_signature_type(signature_index: int) -> int: ...

Default Value

Remarks

The signature type to employ when signing the document.

This property specifies the signature type to be used when signing the document.

Supported values:


cxstDetached	`1`	Specifies whether a detached signature should be produced. I.e., a signature which is kept separately from the signed document.
cxstEnveloping	`2`	Specifies whether an enveloping signature should be produced.
cxstEnveloped	`4`	Specifies whether an enveloped signature should be produced.

The signature_index parameter specifies the index of the item in the array. The size of the array is controlled by the signature_count property.

This property is read-only.

signature_signature_validation_result Property

The outcome of the cryptographic signature validation.

Syntax

def get_signature_signature_validation_result(signature_index: int) -> int: ...

Default Value

Remarks

The outcome of the cryptographic signature validation.

The following signature validity values are supported:


svtValid	`0`	The signature is valid
svtUnknown	`1`	Signature validity is unknown
svtCorrupted	`2`	The signature is corrupted
svtSignerNotFound	`3`	Failed to acquire the signing certificate. The signature cannot be validated.
svtFailure	`4`	General failure
svtReferenceCorrupted	`5`	Reference corrupted (XML-based signatures only)

The signature_index parameter specifies the index of the item in the array. The size of the array is controlled by the signature_count property.

This property is read-only.

signature_subject_key_id Property

Contains the subject key identifier of the signing certificate.

Syntax

def get_signature_subject_key_id(signature_index: int) -> bytes: ...

Remarks

Contains the subject key identifier of the signing certificate.

Subject Key Identifier is a (non-critical) X.509 certificate extension which allows the identification of certificates containing a particular public key. In SecureBlackbox, the unique identifier is represented by a SHA-1 hash of the bit string of the subject public key.

The signature_index parameter specifies the index of the item in the array. The size of the array is controlled by the signature_count property.

This property is read-only.

signature_subject_rdn Property

Contains information about the person owning the signing certificate.

Syntax

def get_signature_subject_rdn(signature_index: int) -> str: ...

Default Value

Remarks

Contains information about the person owning the signing certificate. Only certificates with given subject information will be enumerated during the search operation. Information is stored in the form of [Object Identifier, Value] pairs.

The signature_index parameter specifies the index of the item in the array. The size of the array is controlled by the signature_count property.

This property is read-only.

signature_xml_element Property

Specifies the XML element where to save the signature or containing the signature.

Syntax

def get_signature_xml_element(signature_index: int) -> str: ...

Default Value

Remarks

Specifies the XML element where to save the signature or containing the signature.

This property specifies the XML element where to save the electronic signature or that contains the signature to be validated.

Supported values are:


""	an empty string indicates the Document element
"#id"	indicates an XML element with specified Id
XPath expression	indicates an XML element selected using XPath expression. Use add_known_namespace method to specify Prefixes and NamespaceURIs For example: "/root/data[1]" - indicates the second "data" element under the document element with a name "root" "//ns1:data" - indicates a data element. "ns1" prefix should be defined via add_known_namespace method.
Node name	indicates an XML element selected using its NodeName. For example: "data" - indicates an XML element with node name "data".

The signature_index parameter specifies the index of the item in the array. The size of the array is controlled by the signature_count property.

This property is read-only.

add_known_namespace Method

Adds known prefix and correspondent namespace URI.

Syntax

def add_known_namespace(prefix: str, uri: str) -> None: ...

Remarks

Use this method to add a known prefix and namespace URI that are used in XPath expression within XMLElement/XMLNode property, and within TargetXMLElement and XPathPrefixList properties of the references.

close Method

Closes an opened document.

Syntax

def close(save_changes: bool) -> None: ...

Remarks

Use this method to close a previously opened document. Set SaveChanges to true to apply any changes made.

config Method

Sets or retrieves a configuration setting.

Syntax

def config(configuration_string: str) -> str: ...

Remarks

config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

do_action Method

Performs an additional action.

Syntax

def do_action(action_id: str, action_params: str) -> str: ...

Remarks

do_action is a generic method available in every class. It is used to perform an additional action introduced after the product major release. The list of actions is not fixed, and may be flexibly extended over time.

The unique identifier (case insensitive) of the action is provided in the ActionID parameter.

ActionParams contains the value of a single parameter, or a list of multiple parameters for the action in the form of PARAM1=VALUE1;PARAM2=VALUE2;....

Common ActionIDs:


Action	Parameters	Returned value	Description
ResetTrustedListCache	none	none	Clears the cached list of trusted lists.
ResetCertificateCache	none	none	Clears the cached certificates.
ResetCRLCache	none	none	Clears the cached CRLs.
ResetOCSPResponseCache	none	none	Clears the cached OCSP responses.

get_inner_xml Method

Get the inner XML content of the selected XML element.

Syntax

def get_inner_xml(xpath: str) -> str: ...

Remarks

Call this method to get the inner XML content of the selected XML element.

get_outer_xml Method

Get the outer XML content of the selected XML element.

Syntax

def get_outer_xml(xpath: str) -> str: ...

Remarks

Call this method to get the outer XML content of the selected XML element.

get_signed_data Method

Returns the part of the XML document that is covered by the signature.

Syntax

def get_signed_data(sig_label: str, ref_index: int) -> None: ...

Remarks

Use this method to retrieve the part of the XML document or data that is covered by the SigLabel signature and referenced by RefIndex reference.

The output can be collected in one of the following ways: either by passing the destination path or stream via output_file and output_stream respectively, or by reading the resulting data bytes from the output_bytes property after the operation completes.

get_text_content Method

Get the text content of the selected XML element.

Syntax

def get_text_content(xpath: str) -> str: ...

Remarks

Call this method to get the text content of the selected XML element.

open Method

Opens a document for verifying or removing signatures.

Syntax

def open() -> None: ...

Remarks

Use this method to open a document for verifying or removing signatures. When finished, call close to complete or discard the operation.

reset Method

Resets the class settings.

Syntax

def reset() -> None: ...

Remarks

reset is a generic method available in every class.

revalidate Method

Revalidates a signature in accordance with current settings.

Syntax

def revalidate(sig_label: str, detached: bool) -> None: ...

Remarks

Use this method to re-validate a signature in the opened XML document.

select_info Method

Select signature information for a specific entity.

Syntax

def select_info(entity_label: str, info_type: int, clear_selection: bool) -> None: ...

Remarks

Use this method to select (or filter) signature-related information for a specific signature element.

Provide the unique label of the entity that you are interested in via the EntityLabel parameter. Use one of the following filters, or their combination, to specify what information you are interested in:


sitEntity	`1`	Select the current entity
sitParentEntity	`2`	Select the parent entity of the current entity
sitTimestamps	`4`	Select all timestamps covering the current entity
sitSignatures	`8`	Select all signatures covering the current entity
sitSigningChain	`16`	Select the signing chain of the current entity
sitEmbeddedCertificates	`256`	Select all certificates embedded in the current entity
sitEmbeddedCRLs	`512`	Select all CRLs embedded in the current entity
sitEmbeddedOCSPs	`1024`	Select all OCSP responses embedded in the current entity
sitEmbeddedRevInfo	`1792`	Select the whole pack of embedded revocation information (certificates, CRLs and OCSPs)
sitUsedCertificates	`4096`	Select all the certificates used to validate this entity's chain
sitUsedCRLs	`8192`	Select all the CRLs used to validate this entity's chain
sitUsedOCSPs	`16384`	Select all the OCSP responses used to validate this entity's chain
sitUsedRevInfo	`28672`	Select the whole pack of revocation information used to validate this entity's chain (certificates, CRLs, OCSP responses)
sitAttributes	`65536`	Select this entity's CMS attributes
sitReferences	`131072`	Select this entity's XML references
sitSignedParts	`262144`	Select this entity's signed parts

Following the call, the relevant pieces of information will be copied to the respective component properties (Certificates, CRLs, OCSPs). Note that you can accumulate information in the properties by making repeated calls to select_info and keeping ClearSelection set to false.

This method is useful if you would like to read/display detailed information about a particular signature or timestamp.

set_inner_xml Method

Set the inner XML content of the selected XML element.

Syntax

def set_inner_xml(xpath: str, value: str) -> None: ...

Remarks

Call this method to set the inner XML content of the selected XML element.

set_text_content Method

Set the text content of the selected XML element.

Syntax

def set_text_content(xpath: str, value: str) -> None: ...

Remarks

Call this method to set the text content of the selected XML element.

unsign Method

Deletes a signature from the document.

Syntax

def unsign(sig_label: str) -> None: ...

Remarks

Use this method to delete an existing signature from the document. Use SigLabel parameter to specify the signature to be removed.

verify Method

Verifies a signed XML document.

Syntax

def verify() -> None: ...

Remarks

Call this method to verify the signature embedded in the document. Pass the document via input_stream or input_file property. Use verify_detached to verify the external data in case of a detached signature.

verify_detached Method

Verifies a detached signature over external XML data.

Syntax

def verify_detached() -> None: ...

Remarks

Call this method to verify a signature over external (detached) data provided via data_stream or data_file.

on_document_loaded Event

This event is fired when the document has been loaded into memory.

Syntax

class XMLVerifierDocumentLoadedEventParams(object):
  @property
  def cancel() -> bool: ...
  @cancel.setter
  def cancel(value) -> None: ...

# In class XMLVerifier:
@property
def on_document_loaded() -> Callable[[XMLVerifierDocumentLoadedEventParams], None]: ...
@on_document_loaded.setter
def on_document_loaded(event_hook: Callable[[XMLVerifierDocumentLoadedEventParams], None]) -> None: ...

Remarks

The handler for this event is a good place to check document properties, which may be useful when preparing the signature, for example, the document format.

Set Cancel to true to terminate document processing on this stage.

on_error Event

Information about errors during signature verification.

Syntax

class XMLVerifierErrorEventParams(object):
  @property
  def error_code() -> int: ...

  @property
  def description() -> str: ...

# In class XMLVerifier:
@property
def on_error() -> Callable[[XMLVerifierErrorEventParams], None]: ...
@on_error.setter
def on_error(event_hook: Callable[[XMLVerifierErrorEventParams], None]) -> None: ...

Remarks

The event is fired in case of exceptional conditions during verification.

ErrorCode contains an error code and Description contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to XML.

on_notification Event

This event notifies the application about an underlying control flow event.

Syntax

class XMLVerifierNotificationEventParams(object):
  @property
  def event_id() -> str: ...

  @property
  def event_param() -> str: ...

# In class XMLVerifier:
@property
def on_notification() -> Callable[[XMLVerifierNotificationEventParams], None]: ...
@on_notification.setter
def on_notification(event_hook: Callable[[XMLVerifierNotificationEventParams], None]) -> None: ...

Remarks

The class fires this event to let the application know about some event, occurrence, or milestone in the class. For example, it may fire to report completion of the document processing. The list of events being reported is not fixed, and may be flexibly extended over time.

The unique identifier of the event is provided in the EventID parameter. EventParam contains any parameters accompanying the occurrence. Depending on the type of the class, the exact action it is performing, or the document being processed, one or both may be omitted.

This class can fire this event with the following EventID values:


DocumentLoaded	Notifies the application that the document has been loaded. This is a backward-compatibility-only notification. Use OnDocumentLoaded event instead.
SignaturesLoaded	Notifies the application that the component has finished loading signatures.
RetrieveQualifyingProperties	TBD
BeforeTimestamp	This event is fired before a timestamp is requested from the timestamping authority. Use the event handler to modify TSA and HTTP settings.
TimestampError	This event is only fired if the class failed to obtain a timestamp from the timestamping authority. The EventParam parameter contains extended error info.
TimestampRequest	A timestamp is requested from the custom timestamping authority. This event is only fired if timestamp_server was set to a virtual:// URI. The EventParam parameter contains the TSP request (or the plain hash, depending on the value provided to timestamp_server), in base16, that needs to be sent to the TSA. Use the event handler to send the request to the TSA. Upon receiving the response, assign it, in base16, to the TimestampResponse configuration property.

on_reference_validated Event

Marks the end of a reference validation.

Syntax

class XMLVerifierReferenceValidatedEventParams(object):
  @property
  def reference_index() -> int: ...

  @property
  def id() -> str: ...

  @property
  def uri() -> str: ...

  @property
  def ref_type() -> str: ...

  @property
  def digest_valid() -> bool: ...

# In class XMLVerifier:
@property
def on_reference_validated() -> Callable[[XMLVerifierReferenceValidatedEventParams], None]: ...
@on_reference_validated.setter
def on_reference_validated(event_hook: Callable[[XMLVerifierReferenceValidatedEventParams], None]) -> None: ...

Remarks

The class fires this event to report completion of a reference validation. A reference is a building block of a signature as it binds signature coverage to a particular piece of the document.

on_resolve_reference Event

Asks the application to resolve a reference.

Syntax

class XMLVerifierResolveReferenceEventParams(object):
  @property
  def reference_index() -> int: ...

  @property
  def uri() -> str: ...

# In class XMLVerifier:
@property
def on_resolve_reference() -> Callable[[XMLVerifierResolveReferenceEventParams], None]: ...
@on_resolve_reference.setter
def on_resolve_reference(event_hook: Callable[[XMLVerifierResolveReferenceEventParams], None]) -> None: ...

Remarks

This event is fired when the control could not automatically resolve a reference and requires custom treatment.

URI contains a reference to the data.

ReferenceIndex specifies the index of the reference to process.

Based on the reference's URI the event handler should set either TargetXMLElement or TargetData property of the reference.

on_signature_found Event

Signifies the start of signature validation.

Syntax

class XMLVerifierSignatureFoundEventParams(object):
  @property
  def index() -> int: ...

  @property
  def entity_label() -> str: ...

  @property
  def issuer_rdn() -> str: ...

  @property
  def serial_number() -> bytes: ...

  @property
  def subject_key_id() -> bytes: ...

  @property
  def cert_found() -> bool: ...

  @property
  def validate_signature() -> bool: ...
  @validate_signature.setter
  def validate_signature(value) -> None: ...

  @property
  def validate_chain() -> bool: ...
  @validate_chain.setter
  def validate_chain(value) -> None: ...

# In class XMLVerifier:
@property
def on_signature_found() -> Callable[[XMLVerifierSignatureFoundEventParams], None]: ...
@on_signature_found.setter
def on_signature_found(event_hook: Callable[[XMLVerifierSignatureFoundEventParams], None]) -> None: ...

Remarks

This event tells the application that signature validation is about to start, and provides the details about the signer's certificate via its IssuerRDN, SerialNumber, and SubjectKeyID parameters. It fires for every signature located in the verified document or message.

The CertFound parameter is set to True if the class has found the needed certificate in one of the known locations, and to False otherwise, in which case you must provide it manually via the known_certificates property.

Signature validation consists of two independent stages: cryptographic signature validation and chain validation. Separate validation results are reported for each, with the and properties respectively.

Use the ValidateSignature and ValidateChain parameters to tell the verifier which stages to include in the validation.

on_signature_validated Event

Marks the completion of the signature validation routine.

Syntax

class XMLVerifierSignatureValidatedEventParams(object):
  @property
  def index() -> int: ...

  @property
  def entity_label() -> str: ...

  @property
  def issuer_rdn() -> str: ...

  @property
  def serial_number() -> bytes: ...

  @property
  def subject_key_id() -> bytes: ...

  @property
  def validation_result() -> int: ...

  @property
  def cancel() -> bool: ...
  @cancel.setter
  def cancel(value) -> None: ...

# In class XMLVerifier:
@property
def on_signature_validated() -> Callable[[XMLVerifierSignatureValidatedEventParams], None]: ...
@on_signature_validated.setter
def on_signature_validated(event_hook: Callable[[XMLVerifierSignatureValidatedEventParams], None]) -> None: ...

Remarks

This event is fired upon the completion of the signature validation routine, and reports the respective validation result.

Use the IssuerRDN, SerialNumber, and/or SubjectKeyID parameters to identify the signing certificate.

ValidationResult is set to 0 if the validation has been successful, or to a non-zero value in case of a validation failure.


svtValid	`0`	The signature is valid
svtUnknown	`1`	Signature validity is unknown
svtCorrupted	`2`	The signature is corrupted
svtSignerNotFound	`3`	Failed to acquire the signing certificate. The signature cannot be validated.
svtFailure	`4`	General failure
svtReferenceCorrupted	`5`	Reference corrupted (XML-based signatures only)

XMLVerifier Config Settings

The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the config method.

XMLVerifier Config Settings

AddAllDataObjectsTimestamp: Whether to add all data objects timestamp during signing.

If this property is set to True, the all data objects timestamp (xades:AllDataObjectsTimeStamp element) will be added.

ClaimedRolesXML: The XML content of the claimed roles.

Use this property to get/specify the XML content of the claimed roles element.

ClaimedRoleText: The text of the claimed role.

Use this property to get/specify the text of the first claimed role.

CommitmentTypeIndicationAllSignedDataObjects[Index]: Specifies the CommitmentTypeIndication's AllSignedDataObjects.

This property contains if the CommitmentTypeIndication's AllSignedDataObjects element is present that indicates that all the signed data objects share the same commitment. Index value could be omitted for the first CommitmentTypeIndication element.

CommitmentTypeIndicationCount: The number of the CommitmentTypeIndication elements.

Returns the number of the xades:CommitmentTypeIndication elements available.

CommitmentTypeIndicationIdentifier[Index]: Specifies the CommitmentTypeIndication's CommitmentTypeId's Identifier.

This property contains an identifier indicating the type of commitment made by the signer in the CommitmentTypeIndication's CommitmentTypeId's Identifier element. Index value could be omitted for the first CommitmentTypeIndication element.

CommitmentTypeIndicationIdentifierDescription[Index]: Specifies the CommitmentTypeIndication's CommitmentTypeId's Description.

This property contains an identifier's description indicating the type of commitment made by the signer in the CommitmentTypeIndication's CommitmentTypeId's Description element. Index value could be omitted for the first CommitmentTypeIndication element.

CommitmentTypeIndicationIdentifierDocumentationReferences[Index]: Specifies the CommitmentTypeIndication's CommitmentTypeId's DocumentationReferences.

This property contains an identifier's documentation references indicating the type of commitment made by the signer in the CommitmentTypeIndication's CommitmentTypeId's DocumentationReferences element. Index value could be omitted for the first CommitmentTypeIndication element.

CommitmentTypeIndicationIdentifierQualifier[Index]: Specifies the CommitmentTypeIndication's CommitmentTypeId's IdentifierQualifier.

This property contains an identifier qualifier indicating the type of commitment made by the signer in the CommitmentTypeIndication's CommitmentTypeId's IdentifierQualifier element. Index value could be omitted for the first CommitmentTypeIndication element.

CommitmentTypeIndicationObjectReference[Index]: Specifies the CommitmentTypeIndication's ObjectReference.

This property contains the CommitmentTypeIndication's ObjectReference elements that refer to one or several ds:Reference elements of the ds:SignedInfo corresponding with one data object qualified by this property. Index value could be omitted for the first CommitmentTypeIndication element.

CommitmentTypeIndicationQualifiersXML[Index]: The XML content of the CommitmentTypeIndication's Qualifiers.

This property contains the CommitmentTypeIndication's Qualifiers elements XML content. Index value could be omitted for the first CommitmentTypeIndication element.

DataObjectFormatCount: The number of the DataObjectFormat elements.

Returns the number of the xades:DataObjectFormat elements available.

DataObjectFormatDescription[Index]: Specifies the DataObjectFormat's Description.

This property contains textual information related to the signed data object in the DataObjectFormat's Description element. Index value could be omitted for the first DataObjectFormat element.

DataObjectFormatEncoding[Index]: Specifies the DataObjectFormat's Encoding.

This property contains an indication of the encoding format of the signed data object in the DataObjectFormat's Encoding element. Index value could be omitted for the first DataObjectFormat element.

DataObjectFormatMimeType[Index]: Specifies the DataObjectFormat's MimeType.

This property contains an indication of the MIME type of the signed data object in the DataObjectFormat's MimeType element. Index value could be omitted for the first DataObjectFormat element.

DataObjectFormatObjectIdentifier[Index]: Specifies the DataObjectFormat's ObjectIdentifier's Identifier.

This property contains an identifier indicating the type of the signed data object in the DataObjectFormat's ObjectIdentifier's Identifier element. Index value could be omitted for the first DataObjectFormat element.

DataObjectFormatObjectIdentifierDescription[Index]: Specifies the DataObjectFormat's ObjectIdentifier's Description.

This property contains an identifier's description indicating the type of the signed data object in the DataObjectFormat's ObjectIdentifier's Description element. Index value could be omitted for the first DataObjectFormat element.

DataObjectFormatObjectIdentifierDocumentationReferences[Index]: Specifies the DataObjectFormat's ObjectIdentifier's DocumentationReferences.

This property contains an identifier's documentation references indicating the type of the signed data object in the DataObjectFormat's ObjectIdentifier's DocumentationReferences element. Index value could be omitted for the first DataObjectFormat element.

DataObjectFormatObjectIdentifierQualifier[Index]: Specifies the DataObjectFormat's ObjectIdentifier's IdentifierQualifier.

This property contains an identifier qualifier indicating the type of the signed data object in the DataObjectFormat's ObjectIdentifier's IdentifierQualifier element. Index value could be omitted for the first DataObjectFormat element.

DataObjectFormatObjectReference[Index]: Specifies the DataObjectFormat's ObjectReference.

This property contains the DataObjectFormat's ObjectReference element that reference the ds:Reference element of the ds:Signature corresponding with the data object qualified by this property.

For example, if the corresponding ds:Reference element has an Id "reference-id-1", then you should set this property to "#reference-id-1" value.

Index value could be omitted for the first DataObjectFormat element.

DataType: Specifies the external data type.

Use this property to specify the type of the external data (either data_file, data_stream or data_bytes properties) for class.

The following data types are supported:


"" or "XML"		an XML document (by default).
"data"		a binary data.

DetachedResourceURI: Specifies a detached resource URI.

Specifies a URI of the provided data, usually the data filename if stored along with a detached signature.

ExclusiveCanonicalizationPrefix: Specifies the exclusive canonicalization prefix.

Specifies the prefix for the ec:InclusiveNamespaces element for the exclusive canonicalization.

Default value is "ec". In this case "ec:" prefix will be used.

Special values:


"#default" or ""	indicates that the prefix will be omitted.
"#auto"	indicates that the prefix will be auto-detected based on the parent nodes.

HMACKey: The key value for HMAC.

Use this property to set the HMAC key. The component uses base16 (hex) encoding for this configuration value.

HMACOutputLength: Sets the length of the HMAC output.

Use this property to configure the length of the HMAC output, in bytes.

HMACSigningUsed: Whether to use HMAC signing.

Set this property to true to make the component perform signing using HMAC method, rather than asymmetric cryptography. TBD

IDAttributeName: Specifies the custom name of ID attribute.

This property contains the custom name of identifier (ID) attribute. Used to identify the target XML element when reference URI has "#id_name" value or when ID attribute should be auto-generated for a target XML element.

IDAttributeNamespaceURI: Specifies the custom namespace URI of ID attribute.

This property contains the custom namespace URI of identifier (ID) attribute. Used to identify the target XML element when reference URI has "#id_name" value or when ID attribute should be auto-generated for a target XML element.

IgnoreTimestampFailure: Whether to ignore time-stamping failure during signing.

If this property is set to True, any failure during time-stamping process will be ignored.

IncludeKey: Specifies whether to include the signing key to the signature.

Set this property to True to include the public part of the signing key to the signature.

IncludeKeyValue: Specifies whether the key value must be included to the signature.

Set this property to True if the key value (its public part) should be included to the signature.

IncludeKnownRevocationInfoToSignature: Whether to include custom revocation info to the signature.

This property specifies whether revocation pieces provided via KnownCertificates, KnownCRLs, and KnownOCSPs properties should be included into the signature. This property lets you include custom validation elements to the signature in addition to the ones comprising the signing chain.

InclusiveNamespacesPrefixList: Specifies the InclusiveNamespaces PrefixList.

Use this property to read/specify InclusiveNamespaces PrefixList for exclusive canonicalization transform of SignedInfo element. See XML-Signature Syntax and Processing specification for details.

InsertBeforeXMLElement: Defines the reference XML element for signature insertion.

Use this property to specify XML element before which the signature should be inserted, but it must be under the element specified by the new_sig_xml_element property.

Supported values are:


""	an empty string indicates the Document element
"#id"	indicates an XML element with specified Id
XPath expression	indicates an XML element selected using XPath expression. Use add_known_namespace method to specify Prefixes and NamespaceURIs For example: "/root/data[1]" - indicates the second "data" element under the document element with a name "root" "//ns1:data" - indicates a data element. "ns1" prefix should be defined via add_known_namespace method.
Node name	indicates an XML element selected using its NodeName. For example: "data" - indicates an XML element with node name "data".

KeyInfoCustomXML: The custom XML content for KeyInfo element.

Use this property to specify the custom XML content of the ds:KeyInfo element.

The empty elements in the custom XML content act as a placeholder for auto-generated elements.

For example to change the order of ds:KeyValue and ds:X509Data auto-generated elements use the value: "<X509Data/><KeyValue/>"

KeyInfoDetails: Specifies the signing key info details to include to the signature.

Contains a comma-separated list of values that specifies which signing key info details to include to the signature.

Supported values are:


certificate		Base64-encoded [X509v3] certificate is placed to the signature
issuerserial		X.509 issuer distinguished name/serial number pair are placed to the signature
subjectname		X.509 subject distinguished name is placed to the signature
ski		Base64 encoded plain (i.e. non-DER-encoded) value of a X509 V.3 SubjectKeyIdentifier extension is placed to the signature
crl		Base64-encoded certificate revocation list (CRL) is placed to the signature

KeyInfoID: Specifies the ID for KeyInfo element.

This property contains the identifier (ID) attribute of the ds:KeyInfo element.

KeyName: Contains information about the key used for signing.

The KeyName element contains a string value (with significant whitespaces) which may be used by the signer to communicate a key identifier to the recipient. Typically, the KeyName element contains an identifier related to the key pair used to sign the message, but it may contain other protocol-related information that indirectly identifies a key pair. Common uses of the KeyName include simple string names for keys, a key index, a distinguished name (DN), an email address, etc.

ManifestCount: TBD.

TBD

ManifestID[i]: TBD.

TBD

ManifestObjectIndex[i]: TBD.

TBD

ManifestXML[i]: TBD.

TBD

NormalizeNewLine: Controls whether newline combinations should be automatically normalized.

If set to true (the default value), the component will normalize any non-compliant newline characters to match those appropriate for the operating system.

ObjectCount: TBD.

TBD

ObjectEncoding[i]: TBD.

TBD

ObjectID[i]: TBD.

TBD

ObjectMimeType[i]: TBD.

TBD

ObjectSignaturePropertiesCount: TBD.

TBD

ObjectSignaturePropertiesID[i]: TBD.

TBD

ObjectSignaturePropertiesObjectIndex[i]: TBD.

TBD

ObjectSignaturePropertiesXML[i]: TBD.

TBD

ObjectSignaturePropertyCount: TBD.

TBD

ObjectSignaturePropertyID[i]: TBD.

TBD

ObjectSignaturePropertyPropertiesIndex[i]: TBD.

TBD

ObjectSignaturePropertyTarget[i]: TBD.

TBD

ObjectSignaturePropertyXML[i]: TBD.

TBD

ObjectXML[i]: TBD.

TBD

PolicyDescription: signature policy description.

This property specifies the Description of the signature policy.

PolicyExplicitText: The explicit text of the user notice.

Use this property to specify the explicit text of the user notice to be displayed when the signature is verified.

PolicyUNNumbers: The noticeNumbers part of the NoticeReference CAdES attribute.

Defines the "noticeNumbers" part of the NoticeReference signature policy qualifier for CAdES-EPES.

PolicyUNOrganization: The organization part of the NoticeReference qualifier.

Defines the "organization" part of the NoticeReference signature policy qualifier for CAdES-EPES.

ProductionPlace: Identifies the place of the signature production.

The signature production place in JSON format that was included or to be included into the signature.

Sample value: '{"addressCountry": "UK", "addressLocality": "London", "postalCode": "N1 7GU", "streetAddress": "20-22 Wenlock Road"}'

PSSUsed: Whether to use RSASSA-PSS algorithm.

Although the RSASSA-PSS algorithm provides better security than a classic RSA scheme (PKCS#1-1.5), please take into account that RSASSA-PSS is a relatively new algorithm which may not be understood by older implementations. This is an alias for UsePSS.

QualifyingPropertiesID: Specifies the ID for QualifyingProperties element.

This property contains the identifier (ID) attribute of the xades:QualifyingProperties element.

QualifyingPropertiesObjectID: Specifies the ID for object with QualifyingProperties element.

This property contains the identifier (ID) attribute of the ds:Object element that contains xades:QualifyingProperties element.

QualifyingPropertiesReferenceCount: The number of the QualifyingPropertiesReference elements.

Returns the number of the xades:QualifyingPropertiesReference elements available.

QualifyingPropertiesReferenceID[Index]: Specifies the QualifyingPropertiesReference's ID.

This property contains an identifier (ID) attribute of the xades:QualifyingPropertiesReference element. Index value could be omitted for the first QualifyingPropertiesReference element.

QualifyingPropertiesReferenceURI[Index]: Specifies the QualifyingPropertiesReference's URI.

This property contains an URI attribute of the xades:QualifyingPropertiesReference element. Index value could be omitted for the first QualifyingPropertiesReference element.

RefsTimestampType: Specifies references timestamp type to include to the signature.

Contains a comma-separated list of values that specifies which references timestamp type to include to the signature when signature upgraded to XAdES-X or XAdES-E-X form.

Supported values are:


SigAndRefs		SigAndRefs timestamp
RefsOnly		RefsOnly timestamp

SignatureCompliance: SIgnature compliance with XMLDSig/EBICS.

Specifies whether the signature is compliant with W3C's XMLDSig, or with EBICS (Electronic Banking Internet Communication Standard).

Supported values are:


""		The same as "XML-DSig".
XML-DSig		The W3C's XMLDSig-compliant signature (by default).
EBICS		Electronic Banking Internet Communication Standard (EBICS) compliant signature. On signing the version is autodetected based on the document element.
EBICS_H3		Electronic Banking Internet Communication Standard (EBICS) compliant signature. The version is H3.
EBICS_H4		Electronic Banking Internet Communication Standard (EBICS) compliant signature. The version is H4.
EBICS_H5		Electronic Banking Internet Communication Standard (EBICS) compliant signature. The version is H5.

SignatureID: Specifies the ID for Signature element.

This property contains the identifier (ID) attribute of the ds:Signature element.

SignaturePrefix: Specifies the signature prefix.

Specifies the prefix for the Signature elements.

Default value is "ds". In this case "ds:" prefix will be used.

Special values:


"#default" or ""	indicates that the prefix will be omitted.
"#auto"	indicates that the prefix will be auto-detected based on the parent nodes.

SignatureValueID: Specifies the ID for SignatureValue element.

This property contains the identifier (ID) attribute of the ds:SignatureValue element.

SignedInfoID: Specifies the ID for SignedInfo element.

This property contains the identifier (ID) attribute of the ds:SignedInfo element.

SignedPropertiesID: Specifies the ID for SignedProperties element.

This property contains the identifier (ID) attribute of the xades:SignedProperties element.

SignedPropertiesReferenceCanonicalizationMethod: Specifies the canonicalization method used in SignedProperties reference.

Use this property to specify the canonicalization method for the canonicalization transform of the ds:Reference element that points to xades:SignedProperties element. Use cxcmNone value to not to include canonicalization transform in transform chain.


cxcmNone	`0`
cxcmCanon	`1`
cxcmCanonComment	`2`
cxcmExclCanon	`3`
cxcmExclCanonComment	`4`
cxcmMinCanon	`5`
cxcmCanon_v1_1	`6`
cxcmCanonComment_v1_1	`7`

SignedPropertiesReferenceHashAlgorithm: Specifies the hash algorithm used in SignedProperties reference.

Use this property to specify the hash algorithm to be used for the ds:Reference element that points to xades:SignedProperties element.

Supported values:


SB_HASH_ALGORITHM_MD5	`MD5`
SB_HASH_ALGORITHM_SHA1	`SHA1`
SB_HASH_ALGORITHM_SHA224	`SHA224`
SB_HASH_ALGORITHM_SHA256	`SHA256`
SB_HASH_ALGORITHM_SHA384	`SHA384`
SB_HASH_ALGORITHM_SHA512	`SHA512`
SB_HASH_ALGORITHM_RIPEMD160	`RIPEMD160`
SB_HASH_ALGORITHM_GOST_R3411_1994	`GOST1994`
SB_HASH_ALGORITHM_WHIRLPOOL	`WHIRLPOOL`
SB_HASH_ALGORITHM_SHA3_256	`SHA3_256`
SB_HASH_ALGORITHM_SHA3_384	`SHA3_384`
SB_HASH_ALGORITHM_SHA3_512	`SHA3_512`

The default value is empty string, in this case, the hash algorithm specified in hash_algorithm property is used.

SignedPropertiesReferenceID: Specifies the ID for Reference element that points to SignedProperties element.

This property contains the identifier (ID) attribute of the ds:Reference element that points to xades:SignedProperties element.

SignedPropertiesReferenceInclusiveNamespacesPrefixList: Specifies the InclusiveNamespaces PrefixList used in SignedProperties reference.

Use this property to specify InclusiveNamespaces PrefixList for exclusive canonicalization transform of the ds:Reference element that points to xades:SignedProperties element.

SignedPropertiesReferenceIndex: Specifies the index of SignedProperties reference.

Use this property to specify the reference's index for the ds:Reference element that points to xades:SignedProperties element.

SignedSignaturePropertiesID: Specifies the ID for SignedSignatureProperties element.

This property contains the identifier (ID) attribute of the xades:SignedSignatureProperties element.

SigningCertificatesChain: The indicator of which certificates should be/are included as the signing chain.

Use this property to check or set the indices of the signing chain included in the signature. The none and all placeholders are supported.

SigningCertificatesHashAlgorithm: Specifies the hash algorithm used for SigningCertificates.

Use this property to specify the hash algorithm to be used for xades:SigningCertificates element.

Supported values:


SB_HASH_ALGORITHM_MD5	`MD5`
SB_HASH_ALGORITHM_SHA1	`SHA1`
SB_HASH_ALGORITHM_SHA224	`SHA224`
SB_HASH_ALGORITHM_SHA256	`SHA256`
SB_HASH_ALGORITHM_SHA384	`SHA384`
SB_HASH_ALGORITHM_SHA512	`SHA512`
SB_HASH_ALGORITHM_RIPEMD160	`RIPEMD160`
SB_HASH_ALGORITHM_GOST_R3411_1994	`GOST1994`
SB_HASH_ALGORITHM_WHIRLPOOL	`WHIRLPOOL`
SB_HASH_ALGORITHM_SHA3_256	`SHA3_256`
SB_HASH_ALGORITHM_SHA3_384	`SHA3_384`
SB_HASH_ALGORITHM_SHA3_512	`SHA3_512`

The default value is empty string, in this case, the hash algorithm specified in hash_algorithm property is used.

SigPolicyDescription: signature policy description.

This property specifies the Description of the signature policy (an alias for PolicyDescription).

SigPolicyExplicitText: The explicit text of the user notice.

Use this property to specify the explicit text of the user notice to be displayed when the signature is verified (an alias for PolicyExplicitText);

SigPolicyHash: The EPES policy hash.

Use this configuration setting to provide the EPES policy hash.

SigPolicyHashAlgorithm: The hash algorithm that was used to generate the EPES policy hash.

Use this setting to provide the hash algorithm that was used to generate the policy hash.

SigPolicyID: The EPES policy ID.

The EPES signature policy identifier, in dotted OID format (1.2.3.4.5).

SigPolicyNoticeNumbers: The noticeNumbers part of the NoticeReference CAdES attribute.

Defines the "noticeNumbers" part of the NoticeReference signature policy qualifier for CAdES-EPES (an alias for PolicyUNNumbers).

SigPolicyNoticeOrganization: The organization part of the NoticeReference qualifier.

Defines the "organization" part of the NoticeReference signature policy qualifier for CAdES-EPES (an alias for PolicyUNOrganization).

SigPolicyURI: The EPES policy URI.

Assign the EPES policy URI to this setting.

StripWhitespace: Controls whether excessive whitespace characters should be stripped off when loading the document.

Set this property to true to have the component eliminate excessive whitespace from the document on loading.

TimestampCanonicalizationMethod: Specifies canonicalization method used in timestamp.

Use this property to specify the canonicalization method used in timestamp.


cxcmNone	`0`
cxcmCanon	`1`
cxcmCanonComment	`2`
cxcmExclCanon	`3`
cxcmExclCanonComment	`4`
cxcmMinCanon	`5`
cxcmCanon_v1_1	`6`
cxcmCanonComment_v1_1	`7`

TimestampValidationDataDetails: Specifies timestamp validation data details to include to the signature.

Contains a comma-separated list of values that specifies which validation data values details to include to the signature when xades:TimeStampValidationData element added.

Supported values are:


certificate		Base64-encoded [X509v3] certificates
crl		Base64-encoded certificate revocation lists (CRL)
ocsp		OCSP responses

UseHMACSigning: Whether to use HMAC signing.

Set this property to true to make the component perform signing using HMAC method, rather than asymmetric cryptography.

UsePSS: Whether to use RSASSA-PSS algorithm.

ValidationDataRefsDetails: Specifies validation data references details to include to the signature.

Contains a comma-separated list of values that specifies which validation data references details to include to the signature when signature upgraded to XAdES-C or XAdES-E-C form.

Supported values are:


certificate		References to X.509 certificates
crl		References to certificate revocation lists (CRL)
ocsp		References to OCSP responses

ValidationDataRefsHashAlgorithm: Specifies the hash algorithm used in validation data references.

Use this property to specify the hash algorithm used to compute hashes for validation data references.

Supported values:


SB_HASH_ALGORITHM_MD5	`MD5`
SB_HASH_ALGORITHM_SHA1	`SHA1`
SB_HASH_ALGORITHM_SHA224	`SHA224`
SB_HASH_ALGORITHM_SHA256	`SHA256`
SB_HASH_ALGORITHM_SHA384	`SHA384`
SB_HASH_ALGORITHM_SHA512	`SHA512`
SB_HASH_ALGORITHM_RIPEMD160	`RIPEMD160`
SB_HASH_ALGORITHM_GOST_R3411_1994	`GOST1994`
SB_HASH_ALGORITHM_WHIRLPOOL	`WHIRLPOOL`
SB_HASH_ALGORITHM_SHA3_256	`SHA3_256`
SB_HASH_ALGORITHM_SHA3_384	`SHA3_384`
SB_HASH_ALGORITHM_SHA3_512	`SHA3_512`

The default value is empty string, in this case, the hash algorithm specified in hash_algorithm property is used.

ValidationDataValuesDetails: Specifies validation data values details to include to the signature.

Contains a comma-separated list of values that specifies which validation data values details to include to the signature when signature upgraded to XAdES-X-L or XAdES-E-X-L form.

Supported values are:


certificate		Base64-encoded [X509v3] certificates
crl		Base64-encoded certificate revocation lists (CRL)
ocsp		OCSP responses

WriteBOM: Specifies whether byte-order mark should be written when saving the document.

Set this property to False to disable writing byte-order mark (BOM) when saving the XML document in Unicode encoding.

XAdESPrefix: Specifies the XAdES prefix.

Specifies the prefix for the XAdES elements.

Default value is "xades". In this case "xades:" prefix will be used.

Special values:


"#default" or ""	indicates that the prefix will be omitted.
"#auto"	indicates that the prefix will be auto-detected based on the parent nodes.

XAdESv141Prefix: Specifies the XAdES v1.4.1 prefix.

Specifies the prefix for the XAdES v1.4.1 elements.

Default value is "xadesv141". In this case "xadesv141:" prefix will be used.

Special values:


"#default" or ""	indicates that the prefix will be omitted.
"#auto"	indicates that the prefix will be auto-detected based on the parent nodes.

XMLFormatting: Specifies the signature XML formatting.

Use this property to specify how the signature should be formatted.

Supported values:


"" or "none"		no formatting (by default).
"auto"		enables auto-formatting, equivalent to: "indent: 1; indent-char: tab; base64-max-length: 64; starting-level: node"

Custom values, contains a list of value pairs ("name:value") separated by comma or semicolon:


indent		specifies indentation level (default is 1)
indent-char		specifies indentation character: "space" or "tab" (default)
base64-max-length		specifies max length of base64 encoded data, such as signature value, certificate data and etc. (default is 64)
starting-level		specifies starting indentation level: non-negative integer or "node" - detected based on parent node, or "root" - detected based on number of parent nodes to a document element (default is "node").
indent-before-main		specifies if whitespace characters should be inserted before a main (ds:Signature) element: "auto" (default), "yes" or "no"

For more preciese formatting use OnFormatText and OnFormatElement events.

Base Config Settings

ASN1UseGlobalTagCache: Controls whether ASN.1 module should use a global object cache.

This is a performance setting. It is unlikely that you will ever need to adjust it.

AssignSystemSmartCardPins: Specifies whether CSP-level PINs should be assigned to CNG keys.

This is a low-level tweak for certain cryptographic providers. It is unlikely that you will ever need to adjust it.

CheckKeyIntegrityBeforeUse: Enables or disable private key integrity check before use.

This global property enables or disables private key material check before each signing operation. This slows down performance a bit, but prevents a selection of attacks on RSA keys where keys with unknown origins are used.

You can switch this property off to improve performance if your project only uses known, good private keys.

CookieCaching: Specifies whether a cookie cache should be used for HTTP(S) transports.

Set this property to enable or disable cookies caching for the class.

Supported values are:


off		No caching (default)
local		Local caching
global		Global caching

Cookies: Gets or sets local cookies for the class.

Use this property to get cookies from the internal cookie storage of the class and/or restore them back between application sessions.

DefDeriveKeyIterations: Specifies the default key derivation algorithm iteration count.

This global property sets the default number of iterations for all supported key derivation algorithms. Note that you can provide the required number of iterations by using properties of the relevant key generation component; this global setting is used in scenarios where specific iteration count is not or cannot be provided.

DNSLocalSuffix: The suffix to assign for TLD names.

Use this global setting to adjust the default suffix to assign to top-level domain names. The default is .local.

EnableClientSideSSLFFDHE: Enables or disables finite field DHE key exchange support in TLS clients.

This global property enables or disables support for finite field DHE key exchange methods in TLS clients. FF DHE is a slower algorithm if compared to EC DHE; enabling it may result in slower connections.

This setting only applies to sessions negotiated with TLS version 1.3.

GlobalCookies: Gets or sets global cookies for all the HTTP transports.

Use this property to get cookies from the GLOBAL cookie storage or restore them back between application sessions. These cookies will be used by all the classes that have its CookieCaching property set to "global".

HardwareCryptoUsePolicy: The hardware crypto usage policy.

This global setting controls the hardware cryptography usage policy: auto, enable, or disable.

HttpUserAgent: Specifies the user agent name to be used by all HTTP clients.

This global setting defines the User-Agent field of the HTTP request provides information about the software that initiates the request. This value will be used by all the HTTP clients including the ones used internally in other classes.

HttpVersion: The HTTP version to use in any inner HTTP client components created.

Set this property to 1.0 or 1.1 to indicate the HTTP version that any internal HTTP clients should use.

IgnoreExpiredMSCTLSigningCert: Whether to tolerate the expired Windows Update signing certificate.

It is not uncommon for Microsoft Windows Update Certificate Trust List to be signed with an expired Microsoft certificate. Setting this global property to true makes SBB ignore the expired factor and take the Trust List into account.

ListDelimiter: The delimiter character for multi-element lists.

Allows to set the delimiter for any multi-entry values returned by the component as a string object, such as file lists. For most of the components, this property is set to a newline sequence.

LogDestination: Specifies the debug log destination.

Contains a comma-separated list of values that specifies where debug log should be dumped.

Supported values are:


file		File
console		Console
systemlog		System Log (supported for Android only)
debugger		Debugger (supported for VCL for Windows and .Net)

LogDetails: Specifies the debug log details to dump.

Contains a comma-separated list of values that specifies which debug log details to dump.

Supported values are:


time		Current time
level		Level
package		Package name
module		Module name
class		Class name
method		Method name
threadid		Thread Id
contenttype		Content type
content		Content
all		All details

LogFile: Specifies the debug log filename.

Use this property to provide a path to the log file.

LogFilters: Specifies the debug log filters.

Contains a comma-separated list of value pairs ("name:value") that describe filters.

Supported filter names are:


exclude-package		Exclude a package specified in the value
exclude-module		Exclude a module specified in the value
exclude-class		Exclude a class specified in the value
exclude-method		Exclude a method specified in the value
include-package		Include a package specified in the value
include-module		Include a module specified in the value
include-class		Include a class specified in the value
include-method		Include a method specified in the value

LogFlushMode: Specifies the log flush mode.

Use this property to set the log flush mode. The following values are defined:


none		No flush (caching only)
immediate		Immediate flush (real-time logging)
maxcount		Flush cached entries upon reaching LogMaxEventCount entries in the cache.

LogLevel: Specifies the debug log level.

Use this property to provide the desired debug log level.

Supported values are:


none		None (by default)
fatal		Severe errors that cause premature termination.
error		Other runtime errors or unexpected conditions.
warning		Use of deprecated APIs, poor use of API, 'almost' errors, other runtime situations that are undesirable or unexpected, but not necessarily "wrong".
info		Interesting runtime events (startup/shutdown).
debug		Detailed information on flow of through the system.
trace		More detailed information.

LogMaxEventCount: Specifies the maximum number of events to cache before further action is taken.

Use this property to specify the log event number threshold. This threshold may have different effects, depending on the rotation setting and/or the flush mode.

The default value of this setting is 100.

LogRotationMode: Specifies the log rotation mode.

Use this property to set the log rotation mode. The following values are defined:


none		No rotation
deleteolder		Delete older entries from the cache upon reaching LogMaxEventCount
keepolder		Keep older entries in the cache upon reaching LogMaxEventCount (newer entries are discarded)

MaxASN1BufferLength: Specifies the maximal allowed length for ASN.1 primitive tag data.

This global property limits the maximal allowed length for ASN.1 tag data for non-content-carrying structures, such as certificates, CRLs, or timestamps. It does not affect structures that can carry content, such as CMS/CAdES messages. This is a security property aiming at preventing DoS attacks.

MaxASN1TreeDepth: Specifies the maximal depth for processed ASN.1 trees.

This global property limits the maximal depth of ASN.1 trees that the component can handle without throwing an error. This is a security property aiming at preventing DoS attacks.

OCSPHashAlgorithm: Specifies the hash algorithm to be used to identify certificates in OCSP requests.

This global setting defines the hash algorithm to use in OCSP requests during chain validation. Some OCSP responders can only use older algorithms, in which case setting this property to SHA1 may be helpful.

OldClientSideRSAFallback: Specifies whether the SSH client should use a SHA1 fallback.

Tells the SSH client to use a legacy ssh-rsa authentication even if the server indicates support for newer algorithms, such as rsa-sha-256. This is a backward-compatibility tweak.

PKICache: Specifies which PKI elements (certificates, CRLs, OCSP responses) should be cached.

The PKICache setting specifies which Public Key Infrastructure (PKI) elements should be cached to optimize performance and reduce retrieval times. It supports comma-separated values to indicate the specific types of PKI data that should be cached.

Supported Values:


certificate	Enables caching of certificates.
crl	Enables caching of Certificate Revocation Lists (CRLs).
ocsp	Enables caching of OCSP (Online Certificate Status Protocol) responses.

Example (default value): PKICache=certificate,crl,ocsp In this example, the component caches certificates, CRLs, and OCSP responses.

PKICachePath: Specifies the file system path where cached PKI data is stored.

The PKICachePath setting defines the file system path where cached PKI data (e.g., certificates, CRLs, OCSP responses and Trusted Lists) will be stored. This allows the system to persistently save and retrieve PKI cache data, even across application restarts.

The default value is an empty string - no cached PKI data is stored on disk.

Example: PKICachePath=C:\Temp\cache In this example, the cached PKI data is stored in the C:\Temp\cache directory.

ProductVersion: Returns the version of the SecureBlackbox library.

This property returns the long version string of the SecureBlackbox library being used (major.minor.build.revision).

ServerSSLDHKeyLength: Sets the size of the TLS DHE key exchange group.

Use this property to adjust the length, in bits, of the DHE prime to be used by the TLS server.

StaticDNS: Specifies whether static DNS rules should be used.

Set this property to enable or disable static DNS rules for the class. Works only if UseOwnDNSResolver is set to true.

Supported values are:


none		No static DNS rules (default)
local		Local static DNS rules
global		Global static DNS rules

StaticIPAddress[domain]: Gets or sets an IP address for the specified domain name.

Use this property to get or set an IP address for the specified domain name in the internal (of the class) or global DNS rules storage depending on the StaticDNS value. The type of the IP address (IPv4 or IPv6) is determined automatically. If both addresses are available, they are devided by the | (pipe) character.

StaticIPAddresses: Gets or sets all the static DNS rules.

Use this property to get static DNS rules from the current rules storage or restore them back between application sessions. If StaticDNS of the class is set to "local", the property returns/restores the rules from/to the internal storage of the class. If StaticDNS of the class is set to "global", the property returns/restores the rules from/to the GLOBAL storage. The rules list is returned and accepted in JSON format.

Tag: Allows to store any custom data.

Use this config property to store any custom data.

TLSSessionGroup: Specifies the group name of TLS sessions to be used for session resumption.

Use this property to limit the search of chached TLS sessions to the specified group. Sessions from other groups will be ignored. By default, all sessions are cached with an empty group name and available to all the classes.

TLSSessionLifetime: Specifies lifetime in seconds of the cached TLS session.

Use this property to specify how much time the TLS session should be kept in the session cache. After this time, the session expires and will be automatically removed from the cache. Default value is 300 seconds (5 minutes).

TLSSessionPurgeInterval: Specifies how often the session cache should remove the expired TLS sessions.

Use this property to specify the time interval of purging the expired TLS sessions from the session cache. Default value is 60 seconds (1 minute).

UseCRLObjectCaching: Specifies whether reuse of loaded CRL objects is enabled.

This setting enables or disables the caching of CRL objects. When set to true (the default value), the system checks if a CRL object is already loaded in memory before attempting to load a new instance. If the object is found, the existing instance is reused, and its reference count is incremented to track its usage. When the reference count reaches zero, indicating that no references to the object remain, the system will free the object from memory. This setting enhances performance by minimizing unnecessary object instantiation and promotes efficient memory management, particularly in scenarios where CRL objects are frequently used.

UseInternalRandom: Switches between SecureBlackbox-own and platform PRNGs.

Allows to switch between internal/native PRNG implementation and the one provided by the platform.

UseLegacyAdESValidation: Enables legacy AdES validation mode.

Use this setting to switch the AdES component to the validation approach that was used in SBB 2020/SBB 2022 (less attention to temporal details).

UseOCSPResponseObjectCaching: Specifies whether reuse of loaded OCSP response objects is enabled.

This setting enables or disables the caching of OCSP response objects. When set to true (the default value), the system checks if a OCSP response object is already loaded in memory before attempting to load a new instance. If the object is found, the existing instance is reused, and its reference count is incremented to track its usage. When the reference count reaches zero, indicating that no references to the object remain, the system will free the object from memory. This setting enhances performance by minimizing unnecessary object instantiation and promotes efficient memory management, particularly in scenarios where OCSP response objects are frequently used.

UseOwnDNSResolver: Specifies whether the client components should use own DNS resolver.

Set this global property to false to force all the client components to use the DNS resolver provided by the target OS instead of using own one.

UseSharedSystemStorages: Specifies whether the validation engine should use a global per-process copy of the system certificate stores.

Set this global property to false to make each validation run use its own copy of system certificate stores.

UseSystemNativeSizeCalculation: An internal CryptoAPI access tweak.

This is an internal setting. Please do not use it unless instructed by the support team.

UseSystemOAEPAndPSS: Enforces or disables the use of system-driven RSA OAEP and PSS computations.

This global setting defines who is responsible for performing RSA-OAEP and RSA-PSS computations where the private key is stored in a Windows system store and is exportable. If set to true, SBB will delegate the computations to Windows via a CryptoAPI call. Otherwise, it will export the key material and perform the computations using its own OAEP/PSS implementation.

This setting only applies to certificates originating from a Windows system store.

UseSystemRandom: Enables or disables the use of the OS PRNG.

Use this global property to enable or disable the use of operating system-driven pseudorandom number generation.

XMLRDNDescriptorName[OID]: Defines an OID mapping to descriptor names for the certificate's IssuerRDN or SubjectRDN.

This property defines custom mappings between Object Identifiers (OIDs) and descriptor names. This mapping specifies how the certificate's issuer and subject information (ds:IssuerRDN and ds:SubjectRDN elements respectively) are represented in XML signatures.

The property accepts comma-separated values where the first descriptor name is used when the OID is mapped, and subsequent values act as aliases for parsing.

Syntax: Config("XMLRDNDescriptorName[OID]=PrimaryName,Alias1,Alias2");

Where:

OID: The Object Identifier from the certificate's IssuerRDN or SubjectRDN that you want to map.

PrimaryName: The main descriptor name used in the XML signature when the OID is encountered.

Alias1, Alias2, ...: Optional alternative names recognized during parsing.

Usage Examples:

Map OID 2.5.4.5 to SERIALNUMBER: Config("XMLRDNDescriptorName[2.5.4.5]=SERIALNUMBER");

Map OID 1.2.840.113549.1.9.1 to E, with aliases EMAIL and EMAILADDRESS: Config("XMLRDNDescriptorName[1.2.840.113549.1.9.1]=E,EMAIL,EMAILADDRESS");

XMLRDNDescriptorPriority[OID]: Specifies the priority of descriptor names associated with a specific OID.

This property specifies the priority of descriptor names associated with a specific OID that allows to reorder descriptors in the ds:IssuerRDN and ds:SubjectRDN elements during signing.

XMLRDNDescriptorReverseOrder: Specifies whether to reverse the order of descriptors in RDN.

Specifies whether to reverse the order of descriptors in the ds:IssuerRDN and ds:SubjectRDN elements during XML signing. By default, this property is set to true (as specified in RFC 2253, 2.1).

XMLRDNDescriptorSeparator: Specifies the separator used between descriptors in RDN.

Specifies the separator used between descriptors in the ds:IssuerRDN and ds:SubjectRDN elements during XML signing. By default, this property is set to ", " value.

XMLVerifier Errors

1048577	Invalid parameter (`SB_ERROR_INVALID_PARAMETER`)
1048578	Invalid configuration (`SB_ERROR_INVALID_SETUP`)
1048579	Invalid state (`SB_ERROR_INVALID_STATE`)
1048580	Invalid value (`SB_ERROR_INVALID_VALUE`)
1048581	Private key not found (`SB_ERROR_NO_PRIVATE_KEY`)
1048582	Cancelled by the user (`SB_ERROR_CANCELLED_BY_USER`)
1048583	The file was not found (`SB_ERROR_NO_SUCH_FILE`)
1048584	Unsupported feature or operation (`SB_ERROR_UNSUPPORTED_FEATURE`)
1048585	General error (`SB_ERROR_GENERAL_ERROR`)
39845889	The input file does not exist (`SB_ERROR_XML_INPUTFILE_NOT_EXISTS`)
39845890	Data file does not exist (`SB_ERROR_XML_DATAFILE_NOT_EXISTS`)
39845892	Unsupported hash algorithm (`SB_ERROR_XML_UNSUPPORTED_HASH_ALGORITHM`)
39845893	Unsupported key type (`SB_ERROR_XML_UNSUPPORTED_KEY_TYPE`)
39845895	Unsupported encryption algorithm (`SB_ERROR_XML_INVALID_ENCRYPTION_METHOD`)
39845896	XML element not found (`SB_ERROR_XML_NOT_FOUND`)
39845897	XML element has no ID (`SB_ERROR_XML_NO_ELEMENT_ID`)