Can't figure out why my PDF signature is not LTV enabled

Question

I\'m generating a PDF document with signature and I want it to be LTV enabled. For this, I sign the PDF when creating it and then I add the second version containing the DSS wit

Answer 1

Just had a quick look and objects 15 and 16 are OCSP responses but you are adding them as CRLs:

Stream Object 15

Stream Object 16

This ASN.1 Decoder is very handy!

In my source viewer the DSS dictionary (Object 21) is:

<<
/CRLs 19 0 R
/Certs 20 0 R
/VRI 18 0 R
>>

19 points to the Array atom: [15 0 R 16 0 R]

Again VRI is not necessary for LTV it is currently basically an optimisation (see Appendix A1 in ETSI TS 102 778-4 which is basically taken from the PDF 2.0 specification). If you use it and add a timestamp (/TS entry) Adobe does not currently even display it correctly. In the VRI the TU/TS is also entirely optional and does not affect LTV validity (ibid).