StreamSec Tools 4.x includes a complete X.509 / PKIX and CMS stack for Embarcadero Delphi ^TM, used both on its own and as the certificate engine behind our TLS and S/MIME support. Like the rest of the library it is a clean-room implementation with an OS-independent trust model.

CERTIFICATES AND PKIX

• X.509 certificate generation and RFC 5280 path validation, using independent trust lists
• Certificate Revocation Lists (CRL) and Authority Information Access (AIA) chasing
• OCSP client and responder, including RFC 5019 lightweight mode and OCSP stapling
• PKCS#10 certificate requests

KEYS AND FILE FORMATS

• PKCS#12 (PFX), PKCS#8 and CAPI / XML key formats
• PEM and DER encoding, plus a BER parser
• PBES2 key protection including scrypt, and PBMAC1 (RFC 9879) integrity for PKCS#12

CMS / S-MIME

• Signed and enveloped CMS (PKCS#7) messages, including S/MIME for Indy 10
• Key-agreement recipients (ECDH, RFC 5753) and key transport
• Post-quantum recipients using ML-KEM and composite KEM

POST-QUANTUM CERTIFICATES

• ML-DSA (FIPS-204) and SLH-DSA (FIPS-205) certificates and signatures
• Composite ML-DSA certificates, PKCS#8 and PKCS#12

See also TLS, or return to the StreamSec Tools 4.x overview.