3

I'm running into a new issue with PDF file sizes. It seems that Acrobat X and above now have by default enabled a preference called "Include Signature’s Revocation Status When Signing". Essentially what this feature does is enable the verification of a signature that in the future may be revoked or expire, but prove at the time of the signing of the document that the signature was in fact valid by adding the certificate revocation list (.CRL file) of the certificate authorizing/verifying server.

So when someone has this preference enabled and signs the document, this adds the CRL list from this certificate server. At my company this list is approximately 2MB and the file size then increases from approximately .3MB to 3.1MB or so (with additional adobe bloat). With thousands of documents, you could see how this might be somewhat costly with space, bandwidth, and time as our main intranet site is located in another country.

Is there any way to create a PDF so that when someone signs a document with their digital signature, and that preference is enabled in their Acrobat, that it won't add the CRL list? With my particular document, verifying the signature long term is not at all needed but we want to sign it to prevent changes and to for very short term validation.

--

Additional information: The preference is found under the edit menu, click "preferences" then, Security > Advanced Preferences > Creation tab. What this preference does is explained here on Adobe's website, with full instructions on enabling and disabling.

1 Answer 1

0

Some questions based on some rather hazy ideas:

  • Which CA issued this signature?
  • Is it possible to ask them to give you a digital signature without a "CRL Distribution Point"?
  • Is it possible to block access to the CA's revocation list on the Internet so Acrobat cannot get at it, as well as reset the local certificate revocation list?

As a test of the last idea, you could try to reset the local certificate revocation list, disconnect from the Internet and sign a PDF to see if Acrobat now signs it without including the revocation list. If that works, you could perhaps block Acrobat in the firewall from accessing the CA's revocation list when signing.

5
  • The CA authority is my company. The digital signature doesn't come with the CRL file it goes to the server and pulls it which is acrobat doing that. Without this preference checked it does not do that just adds the signature without revocation list. None of the network things are possible. I can't block access to the revocation list, its a server on our intranet and I can't block anything anyway. Additionally, sometimes it might be useful to have the long term signature validation so I wouldn't want to permanently block it for all PDFs, however on this form it most certainly is not.
    – Blisk
    Mar 5, 2013 at 14:50
  • Acrobat can't get the revocation list if the signature doesn't include a "CRL Distribution Point" which tells it where to get it from. Do I understand correctly that what you are looking for is to prevent Acrobat from including the revocation list even if (1) the signature does include a "CRL Distribution Point", and (2) the above Acrobat preference does instruct it to include the list?
    – harrymc
    Mar 5, 2013 at 15:33
  • Yes you have that right. For this specific document I'm trying to prevent the CRL list from being added to the document which is added by the CA server when the option "Include Signature’s Revocation Status When Signing" is enabled. I created the document without the preference enabled, however it seems that the setting is independent of the document and if the person's computer who is signing the document has that option enabled it includes in the digital signature a CRL file. You are correct that it gets those CRL files that it adds to the list from the "CRL Distribution Point" in the cert.
    – Blisk
    Mar 5, 2013 at 15:54
  • The only issue is there may be times when the digital certificate should have the CRL list included, so reissuing a digital signature without the "CRL Distribution Point" isn't really possible. Sometimes it will be needed for documents that need to be certified for say long standing contracts to other companies that might need to be unquestionably legally binding, so it would be needed in the case of those documents.
    – Blisk
    Mar 5, 2013 at 15:57
  • Given that you insist that Acrobat settings and the signature should both dictate the inclusion of the list, the only way I see to prevent it from happening is to temporarily block access to the CRL server. There are heaps of ways of doing that, but do you find this solution interesting? (And does it work? - to try just pull the network plug.)
    – harrymc
    Mar 5, 2013 at 16:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .