How to Fix PDF Long-Term Validation Ignoring SHA-256 OCSP Responses
Question details
The user needs to resolve an issue where the PDF reader ignores embedded SHA-256 OCSP responses when validating digitally signed PDFs for long-term validation.
- Product
- Device & OS
- not provided
- Scenario
- Validating digitally signed PDF documents that require long-term validation (LTV) without relying on online checks.
- Observed behavior
- The PDF software bypasses the embedded SHA-256 OCSP response and instead performs an online certificate revocation check.
Ensure you have an active internet connection to download any necessary software updates and verify that your system clock is correctly synchronized, as time discrepancies can invalidate certificate checks.
Update Software and Verify OCSP Embedding Format
Updating your PDF reader ensures compatibility with the latest signature profiles and SHA-256 OCSP response formats.
Older versions of PDF readers may lack full support for newer encryption algorithms like SHA-256 in OCSP responses. Updating the software and checking the signature's properties ensures the embedded response is recognizable.
Open your PDF reader, navigate to the 'Help' menu, and select 'Check for Updates' to ensure you are running the latest release.
Right-click the digital signature on the PDF document and select 'Show Signature Properties' to view the validation details.
In the signature properties window, navigate to the 'Revocation' or 'Advanced' tab to confirm that the OCSP response was successfully embedded at the time of signing and is marked as valid.
Export Validation Details and Contact Support
If the software is up to date but still performs an online check, the issue may stem from specific certificate responder configurations requiring vendor support.
Easily View and Manage PDF Digital Signatures with WPS Office
WPS Office offers a comprehensive, built-in PDF reader that supports robust document security, enabling you to seamlessly view digital signatures, manage certificate validations, and handle secure documents.
- 1. Download and install: Download WPS Office for free from the official website and install it on your device.
- 2. Open your signed PDF: Launch WPS Office, click on 'Open', and select your digitally signed PDF document.
- 3. Access signature details: Navigate to the 'Protect' tab and click on 'Manage Signatures' to verify document integrity and view certificate validation information.
Frequently Asked Questions
What is PDF Long-Term Validation (LTV)?
Long-Term Validation (LTV) is a feature in digitally signed PDFs that embeds the certificate revocation status (like an OCSP response or CRL) directly into the document. This allows the signature to be validated years later, even if the original certificate has expired or the issuing server is offline.
Why does my PDF reader check online despite having an embedded OCSP response?
This usually happens if the PDF reader does not support the specific hash algorithm used (such as SHA-256), if the embedded OCSP response is incorrectly formatted, or if the response was not valid at the exact time the document was signed.
What is an OCSP response in digital signatures?
OCSP stands for Online Certificate Status Protocol. It is a method used to obtain the revocation status of a digital certificate in real-time, ensuring that the certificate hasn't been compromised or revoked by the issuer before its natural expiration date.
Can I manually force a PDF reader to use the embedded OCSP response?
Generally, you cannot manually force this behavior if the software deems the embedded response invalid or unreadable. Ensuring your software is fully updated to support modern encryption standards is the most reliable way to fix this issue.
