Hi,
We want our documents to be LTV-enabled, as they currently show the "Signature is not LTV enabled and will expire after ..." message.
As I understand, the requirement to have an LTV-enabled PDF is that it needs to contain all the necessary revocation information inside the signature PKCS7 itself. That means either the CRLs or the OCSP responses for all non-root certificates. For various reasons we want to embed the OCSP responses without using DSS.
To achieve that, we build the OCSP request with all the certificates in the chain except for the root, and embed the response in the PKCS7.
- The OCSP request opened with openssl is:
OCSP Request Data:
Version: 1 (0x0)
Requestor List:
Certificate ID:
Hash Algorithm: sha1
Issuer Name Hash: 1BCC2117979CDF874B9088E8A378DF36121CEBEA
Issuer Key Hash: 3A6E6518E756D2E4F32DDDA57C726DFF30E18627
Serial Number: 753007D08019634DB9
Certificate ID:
Hash Algorithm: sha1
Issuer Name Hash: BB14B271438F3E200C0D15A3D475FEEBE109EE3F
Issuer Key Hash: B76A026D2CD9B036B32B6C05AA345E06EDB2B99B
Serial Number: 8C6A45F533AA3746
Certificate ID:
Hash Algorithm: sha1
Issuer Name Hash: 0CD7FC8124202E8D338840FB507B9D3DE46DB768
Issuer Key Hash: E89BCD7E86629B7A4D8C00973985CF1C7890703A
Serial Number: 26F4AA13F0560872
Request Extensions:
OCSP Nonce:
041088AF2BC66C7E3F4FC78B11004B7A5294
OCSP Response Data:
OCSP Response Status: successful (0x0)
Response Type: Basic OCSP Response
Version: 1 (0x0)
Responder Id: 67233203D98339EA9C94F22A7EA665B9B1F2A309
Produced At: Dec 11 15:09:55 2018 GMT
Responses:
Certificate ID:
Hash Algorithm: sha1
Issuer Name Hash: 1BCC2117979CDF874B9088E8A378DF36121CEBEA
Issuer Key Hash: 3A6E6518E756D2E4F32DDDA57C726DFF30E18627
Serial Number: 753007D08019634DB9
Cert Status: good
This Update: Dec 11 15:09:55 2018 GMT
Next Update: Dec 12 15:09:54 2018 GMT
Certificate ID:
Hash Algorithm: sha1
Issuer Name Hash: BB14B271438F3E200C0D15A3D475FEEBE109EE3F
Issuer Key Hash: B76A026D2CD9B036B32B6C05AA345E06EDB2B99B
Serial Number: 8C6A45F533AA3746
Cert Status: good
This Update: Dec 11 15:09:55 2018 GMT
Next Update: Dec 12 15:09:54 2018 GMT
Certificate ID:
Hash Algorithm: sha1
Issuer Name Hash: 0CD7FC8124202E8D338840FB507B9D3DE46DB768
Issuer Key Hash: E89BCD7E86629B7A4D8C00973985CF1C7890703A
Serial Number: 26F4AA13F0560872
Cert Status: good
This Update: Dec 11 15:09:55 2018 GMT
Next Update: Dec 21 15:09:54 2018 GMT
Response Extensions:
OCSP Nonce:
041088AF2BC66C7E3F4FC78B11004B7A5294
Signature Algorithm: sha256WithRSAEncryption
45:88:53:31:2d:8a:7d:32:84:14:1f:33:4e:9f:db:a2:be:7e:
2b:b3:e9:90:39:7c:24:d4:89:ea:2d:34:5c:6b:80:7e:3b:d6:
d1:0c:7a:d9:bd:55:f3:a3:a2:ba:0a:83:ad:42:fe:48:f8:8a:
77:24:9c:9b:db:ec:25:13:dc:a7:74:fe:e5:8b:8d:b0:3d:cb:
11:74:2d:6a:c0:9f:96:f5:c4:dd:b2:44:57:96:0a:ed:22:4f:
9c:53:b0:ac:96:d8:84:69:3e:65:02:1b:f8:63:11:f9:07:3c:
08:d0:e4:28:70:d5:ca:a4:8f:7c:30:6e:d1:f1:47:e0:15:1f:
44:bc:d6:1f:26:54:27:b4:b4:06:08:1f:03:66:bc:e0:e1:a1:
b0:f3:b1:6d:55:b9:c0:40:5e:83:33:65:d4:89:82:05:1b:0b:
4e:fa:2d:13:a5:c3:95:f8:db:6d:2b:cc:97:eb:7a:29:5e:60:
12:f2:42:f2:96:ce:03:96:ea:6e:5c:41:d3:28:49:e3:10:c4:
f5:47:5f:0b:b2:b8:ac:16:43:ee:27:d0:b2:a7:92:de:78:26:
7d:25:ec:93:8f:79:66:b3:09:e0:dd:71:ab:9a:f2:67:0b:c4:
b8:e8:5e:f1:ae:70:b3:29:42:dc:f1:61:bc:7b:83:e4:24:44:
28:b0:df:29
Which matches with the three levels (excluding the root) for the certificate used. When opening the signature a message appears saying "Signature is not LTV enabled and will expire after 2020/08/05 14:33:03 +01'00'".
As expected under the Revocation tab for the root certificate the message shown is "The selected certificate is either a trust anchor or is a certificate above the trust anchor in the certificate chain (...). No revocation checks are done for such certificates, they are inherently considered trustworthy.", and the certificate at 0+1 says "as verified using the Online Certificate Status Protocol (OCSP) response that was embedded in the signature". The problem seems to be with the other two certificates below that one, that are seemingly not embedded and their details show "as verified using the Online Certificate Status Protocol (OCSP) response that is contained in the local cache", which should be the reason as to why the document is not LTV enabled for Adobe.
Extracting the /Sig node shows, again, that the OCSP response containing information for the three certificates is available.
Looking at section 3.4 of the Acrobat Security Administration Guide https://www.adobe.com/content/dam/acom/en/devnet/acrobat/pdfs/acrobat_security_admin_90.pd f the procedure is to first check the signature looking for the OCSP, so using the local cache means it was not found in the signature.
Also as suggested inadd revocation info (ocsp response) in the signatures lack of the nextUpdate field could also be a reason, but it is present for the three responses.
I have uploaded a sample pdf here Dropbox - file.pdf , thank you.