LTV Signature Verification error with VA with id-pkix-ocsp-nocheck

Question

When adobe Reader 11 verify a LTV PDF Signature with OCSPNoCheck VA shows a message that signature is not a LTV

Answer 1

Hi jonagr,
In the Acrobat world (and when I say Acrobat I mean both Acrobat and Reader), LTV only applies to the document signature over the PDF file. Part of that document signature consists of revocation checking and in order for the signature to be LTV compliant all of the revocation collateral must be embedded in the PDF document as part of the signature. The revocation info can consist of either a CRL or an OCSP response. If the cert that signs the OCSP response is a special use designee issued by the certificate authority to sign on its behalf it's that cert that has the OCSP noCheck flag set because there is no sense in doing revocation checking on this special use cert. Otherwise, you end up in a constant loop of validating the validator. 
You shouldn't be using a certificate that is designated to sign OCSP responses (in lieu of the CA signing the response) to sign a PDF file. Starting with version 11.0.9 Acrobat/Reader should prevent you from signing if the Extended Key Usage asserts OCSP Signing.
Steve