Fault in adobe digital signature revocation checking schema

Question

Hello,
I have found some fault in adobe digital signature revocation checking schema. If OCSP response signing certificate contains CRL distribution point (in my case CDP (CRL) and AIA (OCSP)), online OCSP check executes, but after getting all chain certificate OCSP responses, validating signature against CRL (it’s looks from Local cache). It means you never get OCSP validation data in Adobe Acrobat or Reader signature revocation tab.
Adobe Revocation Checking Quick Key schema is following:
Check      Embedded revocation responses
Check      local CRL cache C:\Documents and Settings\<user>\Application      Data\Adobe\Acrobat\9.0\Security\CRLCache
Check      Online OCSP response
Check      Online CRL response
LAB environment:
Certificate      chain E-ME SSI      (RCA) (Root Certificate) -> E-ME PSI (PCA) (Policy Certificate) -> E-ME IS (CA1) (Issuer certificate) -> User      certificate (Document signing certificate)
Sign      PDF document (Ocsp-CHECK.pdf)      using Adobe Acrobat 9 with User certificate (Don’t add revocation information in signature)
Test steps:
Sign      PDF document using Adobe Acrobat 9 with User certificate (Don’t add revocation      information in signature)
Clear      Local CRL cache under C:\Documents and Settings\<user>\Application      Data\Adobe\Acrobat\9.0\Security\CRLCache
Open      signed file using Adobe Acrobat 9 or Reader 9
Verify      signature. Verification process finishes successfully. Under signature      properties in certificate windows and user certificate revocation tab you      can see that revocation information data comes from CRL. The same for all      chain certificates. But if we look in chain and user certificate its holds      AIA record for OCSP service.
After      a couple of tests I tried to disable access for Acrobat to local CRL cache      folder (Everyone – Full control deny).
After      disabling access to local CRL cache folder - verify the same signed PDF      file. Opening document you can see OCSP checking progress and verification      process finishes successfully. Under signature properties in certificate      windows and user certificate revocation tab you can see that revocation      information data comes from OCSP. The same for all chain certificates.
Resolution:
Its looks when Adobe starts online OCSP checking and receives OCSP response they start parsing OCSP response signer certificate and check OCSP signer certificates revocation information. In this process CRL for OCSP signer certificate is downloaded and placed in Local CRL cache C:\Documents and Settings\<user>\Application Data\Adobe\Acrobat\9.0\Security\CRLCache
Somehow when Adobe gets all chain certificate OCSP responses and have verified also all OCSP signer certificates, online OCSP check is no more continued and revocation information are taken from Local CRL cache.
Can you please help me to clear how to deal with this problem, to make sure that procedure works correctly?
Message was edited by: Gatis Žeiris

Answer 1

Sorry i add corect link to Signed test file: http://www.dsistemas.lv/files/Ocsp-CHECK.pdf