Add revocation info (ocsp response) in the signatures

Question

I'm doing an application to sign pdfs in java.
I already have successfully sign pdfs, but I want to add also the revocation info embedded into the file. I have no problems with CRLs, but I can't add the other revocation method like a ocsp response.
To get a fully signed pdf I have downloaded adobe pro 9 trial version, and I'm trying to sign a pdf with revocation info. For that I selected the "add revocation info when signing" in security preferences. So I sign a pdf with revocation info activated and another one without it. Comparing both files there is a file size difference of 300 KB, so I suppose something has added. But when I validate the pdf with the adobe reader I can't get a valid signature in offline mode. Really I'm not sure if the acrobat reader don't understands correctly the revocation info embedded in the pdf or if the signature itself is not correct.
If I use my program to sign the pdf and I add the crls the acrobat reader validate correctly the signature in offline mode.
Anyone have manage to sign a pdf with adobe pro 9 including revocation info? or anyone know where I cat get a sample pdf with an ocsp response embedded? or anyone knows something to help me?
thanks.

Answer 1

Hola Alfredo,
"So if I trust directly in the ocsp responder it would be a valid ocsp response, right?"
Wrong. Although nothing happens in Acrobat without trust being established, it's not enough to just assign a certificate in the chain "trust anchor" status. All of the other rules must be followed as well. As an example, although we have been discussing OCSP responses, similar rules apply to indirect CRLs. If a CA is using an indirect CRL the correct extensions in both the CRL itself and the certificate under test would need to be present. It wouldn't be enough to just trust the signer of the CRL.
"Is there any possibility in adobe to trust in the responder, the same way as I can do with the timestamp?"
It's a little more complicated than that, but Acrobat does allow for a user to establish local trust in accordance with RFC 2560, Section 4.2.2.2. You are asking about adding "a local configuration of OCSP signing authority for the certificate in question". It can be done using the registry keys defined in the Acrobat Security Administration Guide (location noted in the first reply above), Section 5.4.1.1. You need to define the iURLToConsult and the sURL (which tells Acrobat to accept any OCSP response that comes from this URL). That's the effect you are looking for. However, these are global settings and will overwrite any other certificates, so you might want to set up a Custom Cert Preference as described in Section 3.4.6.
"Adobe have any type of utility or log to show more details about the signature verification?"
Yes, check out section 5.4.4.4 of the Acrobat Security Administration Guide.
"In that last case with the nextUpdate problem it were not giving me any type of error about the ocsp, but anyway It didn't consider valid the response as you say."
With apologies, I wasn't clear enough on this issue. It's not that Acrobat doesn't consider the response valid, but rather it's doesn't consider the response usable for other than "real time" usage. An OCSP response downloaded in real time that doesn't contain the nextUpdate extension is valid (assuming all other checks are okay). It's only when you are trying to use a cached OCSP response without the nextUpdate extension that Acrobat won't accept it. The lack of the nextUpdate extension is a tool that the CAs have at their disposal to force requesting applications (in this case Acrobat) to always ask for the latest information and not rely on older data.
"And the last question, where can I get a sample pdf with an embedded valid ocsp response? do you have any sample one?"
The Acrobat Security Administration Guide has an embedded OCSP response covering the end-entity in the signing chain.
Steve