Overview
When building a digital signature, the Personal Certificate Client (PCC) collects revocation information — Certificate Revocation Lists (CRLs) and OCSP responses — for the certificates in the signing chain and sends it to the server. This revocation information is required to build a signature with Long-Term Validation (LTV).
A non-LTV signature may be reported as "unknown" after the signer's certificate expires, because the issuing Certificate Authority (CA) may no longer provide revocation information for expired certificates. An LTV signature embeds the required revocation information in the signature, so a validator can continue to verify the certificate's revocation status even after the certificate expires.
Some Certificate Authorities publish very large CRLs (several megabytes or more). Including such CRLs in a signing request can cause the server's request size limit to be exceeded, which makes the signing operation fail. A known symptom of this problem is the misleading error message Incorrect image: The uploaded image is too large. Please upload a smaller file displayed during signing.
PCC can be configured to exclude CRLs above a specified size from the data sent to the server.
Impact on LTV Signatures
If one or more CRLs are excluded due to the configured size limit, the server attempts to retrieve the missing revocation artifacts itself. If it cannot retrieve all of them, a signature is still created, but it will not be an LTV signature. Consider this trade-off before configuring a CRL size limit if LTV signatures are a requirement in your environment.
Configuration
Both settings are string values (REG_SZ) located under the registry key:
HKCU\SOFTWARE\OneSpan\OneSpan Personal Certificate Client
CrlSizeLimit — The maximum size of a CRL that PCC sends to the server. CRLs above this limit are excluded from the signing request.
Accepted values: a valid data size string (for example, "1024 KB", "1 MB") or "unlimited".
Default (if the value is missing or cannot be parsed): "unlimited".
CrlSizeLimitWarningThreshold — The CRL size above which PCC logs a warning. If a CRL exceeds this threshold but the configured CrlSizeLimit still allows sending it, a warning is logged stating the CRL size and the threshold value, and advising you to configure a CRL size limit.
Accepted values: same format as CrlSizeLimit.
Default (if the value is missing or cannot be parsed): "512 KB".
By default, PCC logs are configured at ERROR level. Warnings will not appear in the logs unless the log level is changed.
Examples
Exclude CRLs larger than 1 MB from the signing request:
reg add "HKCU\SOFTWARE\OneSpan\OneSpan Personal Certificate Client" /v CrlSizeLimit /t REG_SZ /d "1 MB"Log a warning for CRLs larger than 256 KB:
reg add "HKCU\SOFTWARE\OneSpan\OneSpan Personal Certificate Client" /v CrlSizeLimitWarningThreshold /t REG_SZ /d "256 KB"Restore the default behavior (no limit):
reg add "HKCU\SOFTWARE\OneSpan\OneSpan Personal Certificate Client" /v CrlSizeLimit /t REG_SZ /d "unlimited"