Pdf | |
When true, the revocation data of the signing certificate and of its issuers - an OCSP response or a certificate revocation list for each - is obtained from the addresses the certificates name and embedded in the document when it is saved, together with the issuer certificates. The signature can then be validated after the certificates have expired, or once the issuer's services are no longer reachable, without going online.
The data is added in a revision of its own, after the signature, so the signature still covers everything it signed. The issuer certificates are found among the certificates the signing certificate was obtained with (the same PKCS#12 file or store) and in the system certificate stores. A self-signed root needs no revocation data.
Saving fails with a PdfDocumentException when a certificate of the chain names no OCSP responder or revocation list, or when none of them can be reached. Default value is false.