Fix Embedded OCSP Response Not Recognized for PDF LTV Validation
Question details
The user needs to resolve an issue where a PDF digital signature is not recognized as Long-Term Validation (LTV) enabled because the PDF viewer fails to read the embedded OCSP responses.
- Product
- Device & OS
- not provided
- Scenario
- Validating digital signatures in a PDF document for long-term archiving and compliance.
- Observed behavior
- Acrobat reports that the signature is not LTV enabled and validates certificates from the local cache instead of utilizing the embedded OCSP response data.
Ensure you have access to a PDF inspection tool or a specialized digital signature software that allows you to view the Document Security Store (DSS) and signature dictionary structures.
Verify and Correct Embedded OCSP Responses
Ensure that all required OCSP responses are properly embedded, completely structured, and accurately linked to the correct certificates in the chain.
When OCSP responses are embedded directly into a signature, Acrobat strictly checks their formatting. If the data is incomplete or unstructured, the application abandons the embedded data and searches the local system cache for revocation information.
Use a PDF inspection utility to open the document's internal structure. Locate the signature dictionary to verify that the OCSP responses are actually present in the file.
Check the embedded responses to confirm they contain valid issuer hashes, serial numbers, nonces, and strict 'Next Update' values. Missing values will cause validation to fail.
Ensure each embedded OCSP response is explicitly associated with its corresponding certificate in the chain so the PDF reader can correctly map the revocation data.
Utilize a Document Security Store (DSS) for LTV
Implement a DSS to embed revocation information, which is the modern standard and more reliable method for enabling LTV in PDFs.
Manage and Validate PDF Signatures with WPS Office
WPS Office provides a comprehensive PDF toolkit that allows you to easily view, sign, and manage digital signatures in your PDF documents without dealing with complex underlying structures.
- 1. Open your PDF document: Launch WPS Office and open the PDF file containing the digital signatures you want to inspect or manage.
- 2. Access the Protect tab: Navigate to the 'Protect' tab on the top ribbon to access the security, encryption, and digital signature features.
- 3. Verify the signatures: Click on 'Verify Signature' or open the signature panel on the sidebar to check the validity, certification status, and integrity of the signed document.
Frequently Asked Questions
What does 'LTV enabled' mean in a PDF document?
LTV (Long-Term Validation) means that all the necessary information to validate a digital signature—such as the certificate chain and revocation statuses (OCSP/CRL)—is embedded directly within the PDF file itself. This ensures the signature can be verified years later, even if the original certificate authorities are no longer online.
Why does my PDF viewer use the local cache instead of embedded OCSP responses?
PDF viewers like Acrobat fall back to the local system cache if the embedded OCSP responses are incomplete, improperly formatted, missing a 'Next Update' value, or not correctly linked to the specific certificates in the signature chain.
What is the difference between embedding OCSP in the signature versus using a DSS?
Embedding OCSP directly in the signature dictionary is an older method that can sometimes cause compatibility issues. Using a Document Security Store (DSS) is the modern standard for PAdES (PDF Advanced Electronic Signatures). It provides a centralized, structured way to store all revocation data for the entire document, making LTV validation much more reliable.
