pdfCloseAndSignFileEx

BOOL32 __stdcall pdfCloseAndSignFile(PPDF IPDF, const char* CertFile, const char* Password, const char* Reason, const char* Location);
BOOL32 __stdcall pdfCloseAndSignFileEx(PPDF IPDF, const char* OpenPwd, const char* OwnerPwd, int32_t KeyLen, int32_t Restrict, const char* CertFile, const char* Password, const char* Reason, const char* Location);

function pdfCloseAndSignFile(const IPDF: PPDF; const CertFile, Password, Reason, Location: PAnsiChar): LongBool; stdcall;
function pdfCloseAndSignFileEx(const IPDF: PPDF; const OpenPwd, OwnerPwd: PAnsiChar; KeyLen, Restrict: Integer; const CertFile, Password, Reason, Location: PAnsiChar): LongBool; stdcall;

Purpose. The one-shot, in-process signing path: close the document, computing a real detached PKCS#7/CMS signature from a local PFX certificate file, and write the signed PDF. Ex additionally applies document encryption in the same pass.

Description. Genuinely real, complete signing logic (CloseAndSign): if no signature field exists yet, one is synthesized automatically (an invisible /FT /Sig widget on the last page). The document is serialized to memory, the /ByteRange placeholder and following /Contents <hex> gap are located via raw byte search (careful to skip past any earlier /Contents N 0 R page-content reference and find the *signature dictionary's* /Contents), the real byte offsets are computed and written back into the /ByteRange array (space-padded to the placeholder's exact reserved width — the file layout doesn't shift size), the signed byte ranges (file bytes excluding the hex gap itself) are handed to SignDetachedPKCS7 (a real CMS/PKCS#7 builder reading the PFX certificate+key), and the resulting signature is hex-encoded and patched into the /Contents gap (zero-padded if shorter than the reserved width; fails outright if the real signature is larger than the reserved placeholder). pdfCloseAndSignFileEx genuinely combines signing with encryption in one pass — per an explicit comment, when a password is supplied, encryption is armed *before* serialization so SerializeTo encrypts stream bodies while leaving the signature's /Contents hex string in the clear (this engine only ever encrypts stream bodies, never string objects — which is exactly the PDF spec's required "signature /Contents is never itself encrypted" rule, so it holds automatically here without special-casing); SetEncryption is documented as a no-op when the document is a PDF/A conformance level (self-guarding, not the caller's responsibility).

Parameters.

Return value. True on a fully successful sign+write; False on any failure along the pipeline (no pages, serialization failure, /ByteRange//Contents placeholder not found, signature larger than its reserved space, file write failure).

C# (P/Invoke)

[return: MarshalAs(UnmanagedType.Bool)]