I'm having troubles understanding, how a PDF that has been signed - let's say years ago - with a Long Term Validation digital signature, can be verified today, when the certificate issuer has gone bankrupt and it's CRL responder is no longer online?
How do I see whether or not this documents signature has been revoked any time since?
An LTV signature embeds all the element needed to verify it along time:
(B) signature and signing certificate
(T) a timestamp on the signature
(LT) used certificates and revocation evidences (ocsp & crl responses)
(LTA) an archive timestamp on the previous content
The archive timestamp protects the complete content and stablish the date in which was issued
If the timestamp is valid, you can trust in the revocation evidences and check that the signing certificate and certification chain was valid and not revoked at the time that the document was signed
The global expiration time is limited by the timestamp certificate validity. When timestamp is close to expire, it is needed to add other
Finally the B,T,LT and LTA identifiers represent the level of the signature as defined in AdES ETSI standards for long term signatures ( PAdES, XAdES, CAdES)
For checking the signature on a document it does not matter if the certificate is revoked now. It is instead relevant that the certificate was not revoked at the time the document was signed.
That's why a long-term validation signature involves also the certificate revocation status at the time of signing (which contains a time when this status is valid) and ideally also a secure timestamp so that it cannot be signed later while including an old revocation status. See Establish long-term signature validation for the details.
