How to Create an LTV-Enabled Digital Signature in Adobe Acrobat
Question details
The user wants to configure Adobe Acrobat to create digital signatures with Long-Term Validation (LTV) to ensure the signature remains verifiable even after the original digital certificate has expired.
- Product
- Adobe Acrobat
- Device & OS
- not provided
- Scenario
- Signing important PDF documents with digital certificates that require permanent validity and undeniable proof of verification over an extended period.
- Observed behavior
- Standard digital signatures may lose validation status after the certificate expires or if the application lacks access to reliable Certificate Revocation List (CRL) or OCSP timestamp information.
Ensure you have a valid digital certificate installed on your system and an active internet connection so Acrobat can successfully retrieve real-time revocation and timestamp information from your certificate authority.
Enable Revocation Status in Preferences
Configure Acrobat to automatically embed the revocation status into the digital signature when signing, establishing a basic LTV signature.
By enabling this setting, Acrobat fetches the certificate's revocation status at the time of signing and embeds it into the document. This is required to create at least a Type 2 LTV signature that doesn't rely heavily on external servers post-signing.
Launch Adobe Acrobat and navigate to Edit > Preferences (or Acrobat > Preferences on macOS) in the top menu.
Select 'Signatures' from the left-hand Categories pane.
Under the 'Creation & Appearance' section, click the 'More...' button.
Check the box labeled 'Include signature's revocation status' and click OK to apply the changes.
Add Verification Information Manually
Use this method to retroactively make a valid, non-LTV signature LTV-enabled by embedding the necessary verification data into the saved PDF.
Adjust Signature Verification Preferences
Change how Acrobat verifies signatures locally, enabling Type 2 LTV signatures to validate without needing a dedicated timestamp server.
Use WPS Office to Sign and Secure PDF Documents
WPS Office offers a comprehensive PDF toolkit, allowing you to easily view, edit, sign, and protect your PDF documents with digital certificates and standard electronic signatures without complex configurations.
- 1. Open your PDF: Launch WPS Office and open the PDF document you need to sign.
- 2. Navigate to the Protect Tab: Click on the 'Protect' tab located in the top ribbon menu.
- 3. Select Sign Document: Click the 'Sign Document' button and choose to add a digital signature.
- 4. Apply Signature: Select your existing digital ID, place the signature box on the page, and save the secured document.
Frequently Asked Questions
What is an LTV-enabled digital signature?
A Long-Term Validation (LTV) enabled signature includes embedded revocation information (such as CRL or OCSP responses) and ideally a secure timestamp. This allows the signature to remain valid and verifiable long after the original digital certificate has expired.
Why does my digital signature say it will expire?
This usually happens if the signature relies on a secure timestamp that wasn't properly embedded, or if your PDF reader's verification preferences are set to verify using an embedded secure time that is missing, rather than the time the signature was created.
Do I need a timestamp server for LTV signatures?
While Acrobat can create a basic LTV signature by embedding revocation status and verifying using creation time, a full LTV signature highly recommends an independent trusted timestamp server to provide undeniable proof of the exact signing time.
Can I fix a missing CRL or OCSP validation error?
Yes. If a signature lacks validation data, you can sometimes fix it by manually adding the archival Certificate Revocation List (CRL) to your system's Adobe CRLCache folder, renaming it to match the SHA-1 hash of the distribution point, and reopening the document.
