<div dir="ltr"><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px">Hi John, thanks for answering...<br><br>Yes it is, My CA it's trusted by the Adobe Application.<br><br>I solved it partially, but I think the problem is with the certificate of the OCSP.<br><br><strong>Solution:</strong><br><br>1. Enable LOG for Abode Acrobat or Adobe Reader to see more details of the error.</div><br style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px">Check this info: <span class="gmail-Object" id="gmail-OBJ_PREFIX_DWT49_com_zimbra_url" style="color:rgb(0,90,149)"><a target="_blank" href="http://www.adobe.com/content/dam/Adobe/en/devnet/reader/pdfs/acrobat_reader_security_9x.pdf" style="color:rgb(0,90,149);text-decoration:none">http://www.adobe.com/content/dam/Adobe/en/devnet/reader/pdfs/acrobat_reader_security_9x.pdf</a></span></div><br style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px">Page 127<br>5.3.4.4 Validation Certificate Data Logging<br><br>Example 5.7: Chain building log file settings<br><strong>[HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\8.0\Security\cASPKI\cAdobe_ChainBuilder]</strong></div><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><strong>"ILogLevel" = dword: 00000008</strong><br><strong>"SLogFilePath" = <BINARY path to Existing directory for log file></strong><br><br>The folder path has to exist, but Acrobat will create the file if it's missing. For example, if you want to save the file to C:\LogFile\digSigLog.txt the folder LogFile would have to exist on the C drive, but the log file itself will get created if it's not there already.<br><br>When you type in the file path and name in the Edit Binary Value dialog in regedit, make sure you null terminate the string by typing a zero at the end of the hex data on the left side of the dialog. It will look like a dot on the right side, but it's not really a dot (a dot is 2E in hex).</div><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><br><img width="786" height="454" src="http://mail.osh.com.mx/service/home/~/?auth=co&id=1380&part=2.2"></div><br style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><br style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><img src="http://mail.osh.com.mx/service/home/~/?auth=co&id=1380&part=2.3"></div><br style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px">2.- Signature Validation RevCheck</div><br style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><span class="gmail-Object" id="gmail-OBJ_PREFIX_DWT50_com_zimbra_url" style="color:rgb(0,90,149)"><a target="_blank" href="http://www.adobe.com/devnet-docs/acrobatetk/tools/PrefRef/Windows/Security.html#SignatureValidationRevCheck%28OCSP%29" style="color:rgb(0,90,149);text-decoration:none">http://www.adobe.com/devnet-docs/acrobatetk/tools/PrefRef/Windows/Security.html#SignatureValidationRevCheck%28OCSP%29</a></span></div><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><br></div><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><strong>[HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\8.0\Security\cASPKI\cAdobe_OCSPRevChecker]</strong></div><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><strong>"iReqRevCheck" = dword: 1</strong></div><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><br></div><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><img src="http://mail.osh.com.mx/service/home/~/?auth=co&id=1380&part=2.4"></div><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><div><strong>iReqRevCheck:</strong> Indicates whether revocation checks are required to succeed on the OCSP response.</div><div><strong>Set this value to 1</strong> (1: <span class="gmail-Object" id="gmail-OBJ_PREFIX_DWT51_com_zimbra_date" style="color:rgb(0,90,149)">Do</span> a check IF certificate has AIA extension or responder info is in registry; don't fail if the check fails.)</div></div><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><br>After setting these values in the registry, I indicated that the signatures are valid.</div><br style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px">If I leave the default value of 2 (2: <span class="gmail-Object" id="gmail-OBJ_PREFIX_DWT52_com_zimbra_date" style="color:rgb(0,90,149)">Do</span> you have to check IF AIA certificate extension or respond info is in registry, all checks must succeed if there is data and to check OCCURS.)</div><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px">Continued to receive the same error message</div><br style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><br><strong>So I think the key to solve completely the problem is:</strong></div><br style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px">The OCSP certificate or certificates used to sign must have: Authority Information Access (AIA) certificate extension or respond info is in registry.</div><br style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px"><div style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;font-size:16px">Really <span class="gmail-Object" id="gmail-OBJ_PREFIX_DWT53_com_zimbra_date" style="color:rgb(0,90,149)">do</span> not know how this or how to verify that the certificates comply with this requirement.</div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-09-21 11:00 GMT-05:00 <span dir="ltr"><<a href="mailto:pki-users-request@redhat.com" target="_blank">pki-users-request@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send Pki-users mailing list submissions to<br>
<a href="mailto:pki-users@redhat.com">pki-users@redhat.com</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://www.redhat.com/mailman/listinfo/pki-users" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/pki-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:pki-users-request@redhat.com">pki-users-request@redhat.com</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:pki-users-owner@redhat.com">pki-users-owner@redhat.com</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Pki-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: ocsp doesn't work on the client side - "OCSP response<br>
signature invalid" (John Magne)<br>
<br>
<br>
------------------------------<wbr>------------------------------<wbr>----------<br>
<br>
Message: 1<br>
Date: Tue, 20 Sep 2016 14:02:37 -0400 (EDT)<br>
From: John Magne <<a href="mailto:jmagne@redhat.com">jmagne@redhat.com</a>><br>
To: Ricardo Alexander Perez Ricardez <<a href="mailto:rperez@osh.com.mx">rperez@osh.com.mx</a>><br>
Cc: <a href="mailto:pki-users@redhat.com">pki-users@redhat.com</a><br>
Subject: Re: [Pki-users] ocsp doesn't work on the client side - "OCSP<br>
response signature invalid"<br>
Message-ID:<br>
<<a href="mailto:1939478162.975581.1474394557729.JavaMail.zimbra@redhat.com">1939478162.975581.<wbr>1474394557729.JavaMail.zimbra@<wbr>redhat.com</a>><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
Is your CA being trusted by the Adobe application in question?<br>
<br>
----- Original Message -----<br>
From: "Ricardo Alexander Perez Ricardez" <<a href="mailto:rperez@osh.com.mx">rperez@osh.com.mx</a>><br>
To: <a href="mailto:pki-users@redhat.com">pki-users@redhat.com</a><br>
Sent: Thursday, September 15, 2016 1:12:21 PM<br>
Subject: [Pki-users] ocsp doesn't work on the client side - "OCSP response signature invalid"<br>
<br>
Error: "OCSP response signature invalid"<br>
<br>
<br>
On the server side I have configured an instance of pki working properly, I have two subsystems a CA, and OCSP.<br>
<br>
On the client side I have a valid certificate that I use to sign a PDF document<br>
<br>
In Adobe Reader or Adobe Acrobat I perform the following steps:<br>
<br>
1. Signing a PDF document<br>
2. Validate Signature<br>
3. I receive the message: "The validity of the signature is unknown"<br>
4. Click on: Check the properties of signature<br>
5. Click on: Show signer certificate<br>
6. Click: Revocation tab<br>
<br>
The following message is displayed:<br>
<br>
We attempted to determine whether the certificate is valid by performing a revocation check using the protocol online certificate status (OCSP Online Certificate Status Protocol).<br>
The OCSP response was signed by "OCSP Signing CA Certificate" on 2016/09/15 14:53:06 -05'00 '.<br>
Click Details signer for more information on the source of the revocation information.<br>
Click trouble seeing the problems encountered when performing this check revocation.<br>
<br>
6. Click on: Problems Found<br>
7. I get the message: "OCSP response signature invalid"<br>
<br>
______________________________<wbr>_________________<br>
Pki-users mailing list<br>
<a href="mailto:Pki-users@redhat.com">Pki-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/pki-users" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/pki-users</a><br>
<br>
<br>
<br>
------------------------------<br>
<br>
______________________________<wbr>_________________<br>
Pki-users mailing list<br>
<a href="mailto:Pki-users@redhat.com">Pki-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/pki-users" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/pki-users</a><br>
<br>
End of Pki-users Digest, Vol 101, Issue 4<br>
******************************<wbr>***********<br>
</blockquote></div><br></div>