What signature validation trusts and uses: the certificates a signer's chain must reach, other certificates that may complete a chain, the time at which certificates must be valid, revocation data, and whether revocation data may be fetched.
public sealed class PdfSignatureValidationOptions
ISO 32000-2 §12.8.1 ("the signer's certificate shall be determined and verified by the signature handler to match with any of the validation parameters") and §12.8.3.3.1 ("the policy of how to establish trusted identity lists ... is up to the validation signature handler"); RFC 5280 §6.1 for the trust anchors and the validation time; §12.8.3.4.6 to §12.8.3.4.8 for revocation (RFC 5280 §6.3, RFC 6960). Nothing is trusted by default and nothing is fetched: the operating system's certificate store is not consulted, no certificate is downloaded, and revocation is checked with the data the signatures, the document security store and these options carry until OnlineRevocationClient is set.
kind:method, kind:property, kind:ctor. Press Esc to clear.CertificateRevocationListsGets or sets DER-encoded certificate revocation lists (RFC 5280 §5) to check certificates against, besides those the signatures and the document security store carry. Empty by default.ExtraCertificatesGets or sets other certificates that may complete a chain the signature does not carry in full (intermediates from a document security store or a local cache). They are not trusted. Empty by default.OcspResponsesGets or sets DER-encoded OCSP responses (OCSPResponse, RFC 6960 §4.2.1) to check certificates against, besides those the signatures and the document security store carry. Empty by default.OnlineRevocationClientGets or sets the client revocation data is fetched through when the document and these options hold none that applies: an OCSP request to the responder a certificate's authority information access names (RFC 6960 Appendix A.1, HTTP POST), else the CRL at its CRL distribution point (RFC 5280 §4.2.1.13). null (the default) fetches nothing.RequireRevocationStatusGets or sets a value indicating whether a certificate whose revocation status no CRL or OCSP response establishes makes the signature Indeterminate (RevocationUnknown). Off by default: missing revocation data is shown in Revocations but not reported as a problem.TrustAnchorsGets or sets the trust anchors: a signer's certificate chain is trusted when it reaches one of them, whether a root or an intermediate. Empty by default, so no chain is trusted until anchors are given.ValidationTimeGets or sets the time at which every certificate of a chain must be within its validity period; null (the default) for the time validation runs.UseOnlineRevocation(HttpClient?)Sets OnlineRevocationClient: revocation data is fetched through httpClient.