Windows Signed Revocation Information

The Windows sign operation can authenticate CRL and OCSP evidence, include it in the Adobe RevocationInfoArchival signed attribute, and publish the PDF only after validating the actual generated CMS and embedded evidence

Signing options

{"schemaVersion":1,"type":"sign","incremental":true,
 "existingField":true,"fieldName":"ApprovalOne",
 "pfxFile":"C:/keys/signer.pfx","pfxPassword":"password",
 "cades":true,"digestMethod":"SHA384",
 "revocationInfo":{"enabled":true,
   "trustedCAFile":"C:/trust/signing-roots.pem",
   "certificatesBase64":[],"ocspResponsesBase64":[],
   "crlsBase64":["BASE64_DER_CRL"],
   "requireTimestamp":false,"clockSkewSeconds":300,
   "maxOCSPAgeSeconds":86400}}

revocationInfo is optional; enabled defaults to true when the object is supplied, and disabled evidence cannot contain certificates, OCSP responses, or CRLs

trustedCAFile explicitly identifies PEM trust roots and remains open with write sharing denied throughout signing; validation does not silently trust a certificate merely because the PFX or evidence contains it

Evidence arrays contain canonical Base64 strings encoding complete DER certificates, CRLs, or OCSPResponse values; at least one CRL or OCSP response is required when enabled

The standard signed attribute contains DER CRLs and BasicOCSPResponse values; complete OCSPResponse inputs are normalized before embedding, and certificates supply additional validation chain material

HPDFNormalizeHeadlessOCSPResponse in HPDFHeadlessRevocationInfo exposes the bounded successful-response conversion for Pascal callers; it validates DER framing and extracts BasicOCSPResponse, while cryptographic and status validation remains the signing or LTV verifier's responsibility

Authenticated evidence

Validation authenticates the actual CMS signature, signing-certificate binding, explicit certificate trust, certificate validity, CRL signatures and validity intervals, and OCSP signatures, responder authorization, issuer identifiers, response status, and update times

Evidence must cover the complete non-root signing chain; revoked, unknown, expired, incomplete, unauthorized, untrusted, or malformed evidence cannot publish a PDF

requireTimestamp requires an actual signing timestamp and authenticates evidence for its TSA chain as well; use the application transport and separate TSA trust settings described in Windows signing timestamps

clockSkewSeconds accepts 0 through 86400, while maxOCSPAgeSeconds must be positive; both configure evidence time validation rather than changing certificate trust

Seed values and publication

A required SV AddRevInfo true constraint requires this validated signed-evidence workflow; a required false value requires omission of the attribute

The workflow supports existing and newly created signature fields, first certification signatures, subsequent permitted approval signatures, supported encrypted sources, and unsigned document signing

The trust file and decoded evidence share a byte cap of one eighth of memoryBytes; evidence object counts are limited to the smaller of objectCount and 4096 before allocation

Canonical Base64, DER framing, budgets, cancellation, CMS integrity, and evidence validity are checked before binary publication; rejected evidence preserves the original document handle and publishes no PDF bytes, while publication callbacks retain the existing callback failure semantics

A successful result reports revocationInfo: true only after authenticating the actual signed attribute; disabled or omitted evidence reports false

See HPDFNormalizeHeadlessOCSPResponse for the bounded native conversion from a complete OCSPResponse to BasicOCSPResponse DER

See incremental PFX signing for source snapshots, encryption permissions, prior signature policies, output budgets, and callback publication semantics