diff -Nru itext-2.1.7/src/core/com/lowagie/text/pdf/OcspClientBouncyCastle.java itext-2.1.7.bouncycastle/src/core/com/lowagie/text/pdf/OcspClientBouncyCastle.java
--- itext-2.1.7/src/core/com/lowagie/text/pdf/OcspClientBouncyCastle.java	2009-06-09 10:31:05.000000000 +0200
+++ itext-2.1.7.bouncycastle/src/core/com/lowagie/text/pdf/OcspClientBouncyCastle.java	2015-06-28 03:29:55.209352087 +0200
@@ -59,20 +59,29 @@
 import java.net.HttpURLConnection;
 import java.net.URL;
 import java.security.Security;
+import java.security.cert.CertificateEncodingException;
 import java.security.cert.X509Certificate;
 import java.util.Vector;
 import org.bouncycastle.asn1.DEROctetString;
 import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+import org.bouncycastle.asn1.x509.Extension;
+import org.bouncycastle.asn1.x509.Extensions;
 import org.bouncycastle.asn1.x509.X509Extension;
 import org.bouncycastle.asn1.x509.X509Extensions;
-import org.bouncycastle.ocsp.BasicOCSPResp;
-import org.bouncycastle.ocsp.CertificateID;
-import org.bouncycastle.ocsp.CertificateStatus;
-import org.bouncycastle.ocsp.OCSPException;
-import org.bouncycastle.ocsp.OCSPReq;
-import org.bouncycastle.ocsp.OCSPReqGenerator;
-import org.bouncycastle.ocsp.OCSPResp;
-import org.bouncycastle.ocsp.SingleResp;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
+import org.bouncycastle.cert.ocsp.BasicOCSPResp;
+import org.bouncycastle.cert.ocsp.CertificateID;
+import org.bouncycastle.cert.ocsp.CertificateStatus;
+import org.bouncycastle.cert.ocsp.OCSPException;
+import org.bouncycastle.cert.ocsp.OCSPReq;
+import org.bouncycastle.cert.ocsp.OCSPReqBuilder;
+import org.bouncycastle.cert.ocsp.OCSPResp;
+import org.bouncycastle.cert.ocsp.SingleResp;
+import org.bouncycastle.operator.DigestCalculator;
+import org.bouncycastle.operator.DigestCalculatorProvider;
+import org.bouncycastle.operator.OperatorException;
+import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
 
 /**
  * OcspClient implementation using BouncyCastle.
@@ -107,28 +116,26 @@
      * @throws OCSPException
      * @throws IOException
      */
-    private static OCSPReq generateOCSPRequest(X509Certificate issuerCert, BigInteger serialNumber) throws OCSPException, IOException {
+    private static OCSPReq generateOCSPRequest(X509Certificate issuerCert, BigInteger serialNumber) throws OCSPException, IOException, OperatorException, CertificateEncodingException {
         //Add provider BC
         Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
         
+        JcaDigestCalculatorProviderBuilder digestCalculatorProviderBuilder = new JcaDigestCalculatorProviderBuilder();
+        DigestCalculatorProvider digestCalculatorProvider = digestCalculatorProviderBuilder.build();
+        DigestCalculator digestCalculator = digestCalculatorProvider.get(CertificateID.HASH_SHA1);
         // Generate the id for the certificate we are looking for
-        CertificateID id = new CertificateID(CertificateID.HASH_SHA1, issuerCert, serialNumber);
+        CertificateID id = new CertificateID(digestCalculator, new JcaX509CertificateHolder(issuerCert), serialNumber);
         
         // basic request generation with nonce
-        OCSPReqGenerator gen = new OCSPReqGenerator();
+        OCSPReqBuilder gen = new OCSPReqBuilder();
         
         gen.addRequest(id);
         
         // create details for nonce extension
-        Vector oids = new Vector();
-        Vector values = new Vector();
+        Extension ext = new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false, new DEROctetString(new DEROctetString(PdfEncryption.createDocumentId()).getEncoded()));
+        gen.setRequestExtensions(new Extensions(new Extension[]{ext}));
         
-        oids.add(OCSPObjectIdentifiers.id_pkix_ocsp_nonce);
-        values.add(new X509Extension(false, new DEROctetString(new DEROctetString(PdfEncryption.createDocumentId()).getEncoded())));
-        
-        gen.setRequestExtensions(new X509Extensions(oids, values));
-        
-        return gen.generate();
+        return gen.build();
     }
     
     /**
@@ -167,7 +174,7 @@
                     if (status == CertificateStatus.GOOD) {
                         return basicResponse.getEncoded();
                     }
-                    else if (status instanceof org.bouncycastle.ocsp.RevokedStatus) {
+                    else if (status instanceof org.bouncycastle.cert.ocsp.RevokedStatus) {
                         throw new IOException("OCSP Status is revoked!");
                     }
                     else {
diff -Nru itext-2.1.7/src/core/com/lowagie/text/pdf/PdfPKCS7.java itext-2.1.7.bouncycastle/src/core/com/lowagie/text/pdf/PdfPKCS7.java
--- itext-2.1.7/src/core/com/lowagie/text/pdf/PdfPKCS7.java	2015-06-28 03:29:57.603235703 +0200
+++ itext-2.1.7.bouncycastle/src/core/com/lowagie/text/pdf/PdfPKCS7.java	2015-06-28 03:18:52.706561173 +0200
@@ -113,9 +113,12 @@
 import org.bouncycastle.asn1.x509.X509Extensions;
 import org.bouncycastle.cms.SignerInformationVerifier;
 import org.bouncycastle.cms.jcajce.JcaSimpleSignerInfoVerifierBuilder;
-import org.bouncycastle.ocsp.BasicOCSPResp;
-import org.bouncycastle.ocsp.CertificateID;
-import org.bouncycastle.ocsp.SingleResp;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
+import org.bouncycastle.cert.ocsp.BasicOCSPResp;
+import org.bouncycastle.cert.ocsp.CertificateID;
+import org.bouncycastle.cert.ocsp.SingleResp;
+import org.bouncycastle.operator.jcajce.JcaContentVerifierProviderBuilder;
+import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
 import org.bouncycastle.tsp.TimeStampToken;
 
 /**
@@ -903,7 +906,7 @@
                     if (!keystore.isCertificateEntry(alias))
                         continue;
                     X509Certificate certStoreX509 = (X509Certificate)keystore.getCertificate(alias);
-                    if (ocsp.verify(certStoreX509.getPublicKey(), provider))
+                    if (ocsp.isSignatureValid(new JcaContentVerifierProviderBuilder().setProvider(provider).build(certStoreX509.getPublicKey())))
                         return true;
                 }
                 catch (Exception ex) {
@@ -997,7 +1000,8 @@
             CertificateID cid = sr.getCertID();
             X509Certificate sigcer = getSigningCertificate();
             X509Certificate isscer = cs[1];
-            CertificateID tis = new CertificateID(CertificateID.HASH_SHA1, isscer, sigcer.getSerialNumber());
+            CertificateID tis = new CertificateID(
+               new JcaDigestCalculatorProviderBuilder().build().get(CertificateID.HASH_SHA1), new JcaX509CertificateHolder(isscer), sigcer.getSerialNumber());
             return tis.equals(cid);
         }
         catch (Exception ex) {