Class DocumentSignatureValidationOptions
- Namespace
- DocToolkit
- Assembly
- DocToolkit.Primitives.dll
Options for ValidateSignatures.
public sealed class DocumentSignatureValidationOptions- Inheritance
-
DocumentSignatureValidationOptions
- Inherited Members
Remarks
There is deliberately no way to enable revocation checking or certificate downloads here — see DocumentSignatureValidationReport's remarks. If a future version adds an opt-in online check, it will be a new, explicitly named option, not a change to what this type's current defaults mean.
There is deliberately no way to trust an internal certificate authority here either — an
earlier draft of this type had one (AdditionalTrustedCertificates) and it was removed
before release. Measured directly: OfficeIMO's underlying ExtraCertificates option
supplies certificates only for chain-building (resolving a missing intermediate), not
for chain-trust — passing a document's own issuing CA through it left
CertificateChainStatus at Failed, identically to
not passing it at all. Shipping that property with documentation claiming it worked would have
been exactly the kind of "present but wrong" answer about signature validity this feature
exists to avoid. To trust an internal CA, install it in the trust store this machine's chain
building already consults, and use ValidateCertificateTrust to opt entirely out
of chain checking if that is not available.
Properties
ValidateCertificateTrust
Whether to check the signing certificate's chain against this machine's local trust store. Purely local — chain building against an already-present store needs no network access. Default true.
public bool ValidateCertificateTrust { get; set; }