Embed LTV validation material (PAdES B-LT)
add_ltvAdds long-term validation (LTV) to a signed PDF by embedding a Document Security Store with certificates and OCSP/CRL data, enabling future verifiers to validate the signature after certificate expiration.
Instructions
PAdES B-LT: embed a Document Security Store (/DSS + per-signature /VRI) with the certificates and OCSP/CRL material future verifiers need ('LTV enabled' in Adobe Reader once the root is trusted). Ladder step 3: sign_pdf (profile:'pades', timestamp:true) → add_ltv → timestamp_pdf. mode 'online' (default) fetches through the OPERATOR revocation provider (PDFNATIVE_MCP_REVOCATION + PDFNATIVE_MCP_NETWORK_ALLOWED_HOSTS; REVOCATION_NOT_CONFIGURED otherwise — no network without it); mode 'offline' embeds caller-supplied DER certificates / OCSP responses / CRLs with zero network. Incremental (existing /DSS merged). Needs ≥ 1 signed signature; unencrypted PDFs only.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | 'online': fetch OCSP/CRL through the operator provider (PDFNATIVE_MCP_REVOCATION + allow-list; REVOCATION_NOT_CONFIGURED otherwise). 'offline': embed the caller-supplied DER material, zero network. | online |
| pdfBase64 | Yes | Base64-encoded SIGNED PDF (unencrypted). Sign with sign_pdf (profile=pades recommended) first. | |
| outputMode | No | 'base64' (default) returns the PDF inline; 'file' writes it inside the PDFNATIVE_MCP_OUTPUT_DIR sandbox (SECURITY_VIOLATION when the sandbox is not configured). | base64 |
| outputPath | No | Relative path inside PDFNATIVE_MCP_OUTPUT_DIR (required when outputMode='file'). | |
| preferOcsp | No | online: try OCSP before CRL for each certificate (default true). | |
| crlsDerBase64 | No | offline: DER CertificateList (RFC 5280) blobs to embed in /DSS /CRLs. | |
| certificatesDerBase64 | No | offline: DER X.509 certificates to embed in /DSS /Certs. | |
| ocspResponsesDerBase64 | No | offline: DER OCSPResponse (RFC 6960) blobs to embed in /DSS /OCSPs. | |
| extraCertificatesDerBase64 | No | online: additional DER certificates (intermediates / roots) to complete chains the CMS does not carry. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | ||
| summary | No | Tool-specific summary, when produced. | |
| filePath | No | Sandboxed absolute path (file mode). | |
| sizeBytes | Yes | ||
| diagnostics | No | PDF/A diagnostics (when includeDiagnostics=true). |