Direct answer: “Invalid” usually means the signed bytes, cryptographic result, or permitted-change rules failed. “Unknown” or “untrusted” usually means the reader could not establish the signer’s certificate trust or retrieve enough validation evidence. Do not edit the file or blindly trust its certificate. Preserve the exact original, record the full warning, verify the sender and certificate fingerprint through a separate channel, and validate the file in a capable desktop or institutional service.
Match the status to the safest first action
| What you see | What it may mean | First action |
|---|---|---|
| No digital signature | The visible mark may be typed text, an image, or an empty field rather than a certificate signature | Confirm what signature method the recipient requires |
| Validity unknown / signer untrusted | The certificate chain, trust anchor, revocation data, timestamp, or network lookup is unavailable | Verify the fingerprint with the issuer or sender before adding trust |
| Invalid / document altered | The signed content changed, a disallowed revision exists, or cryptographic validation failed | Stop using the changed copy as signed evidence; obtain the untouched original or a reissued file |
| Certificate expired | The certificate is outside its current validity window; a trusted signing-time timestamp may still matter | Check the trusted timestamp and long-term validation evidence in a capable validator |
| Timestamp cannot be verified | The timestamp certificate or trust evidence is missing, expired, or unreachable | Retry approved online validation, then ask the sender or IT team for validation material |
| Valid, but the content is unexpected | The signature can validate the signed bytes without proving the claims, authority, or transaction are correct | Confirm the document, signer, and business instruction out of band |
These labels vary by reader. Nitro’s current signature status reference separates valid, unknown, and invalid states, while Adobe exposes certificate, document, and timestamp details inside Signature Properties. The diagnosis matters more than the icon color.
The seven checks
1. Preserve the exact file that produced the warning
Save the attachment or authorized download without printing, optimizing, converting, combining, annotating, or using “Save as PDF.” Work on a duplicate and keep the original filename, source, received time, and warning text in your case notes. A later copy may no longer represent what the sender signed.
2. Confirm that it is a certificate signature
A handwritten image, typed name, or drawn mark can look signed without containing a PDF signature dictionary. A certificate signature normally has a signature panel, certificate details, a signing time, and a status. If the file only contains a visual mark, ask whether that electronic-signature method satisfies the intended workflow. Use the PDF Signature Checker as an initial signature screen.
3. Read the full status, not just “problem”
Open the signature properties in the recipient’s approved desktop reader. Record whether the failure concerns document integrity, signer identity, certificate path, revocation, timestamp, algorithm, or an unsupported format. Adobe’s digital signature validation steps show where to review the signer certificate and timestamp state.
4. Check for post-signing changes and allowed revisions
A PDF signature covers specified byte ranges. Later revisions can be permitted, such as another signature or form fill under a certification policy, or disallowed, such as replacing page content. ByteRange coverage is useful structural evidence, but coverage alone does not prove the cryptographic signature is correct. ETSI’s PAdES baseline specification requires the ByteRange to cover the file except the signature value itself.
If the warning appeared after you edited, highlighted, combined, optimized, or printed the PDF, return to the untouched original. Adobe’s signed-PDF limitations recommend using the unsigned source or requesting a new copy when edits are needed. Never present a rewritten copy as if the earlier signer approved it.
5. Establish certificate trust outside the PDF
“Unknown signer” can mean your reader lacks the correct trust anchor, but it can also mean you have no reliable identity evidence. Do not solve the warning by trusting any certificate embedded in an unverified file. Contact the sender or issuing organization through a known channel and compare the certificate fingerprint or approved trust path. Adobe’s certificate-import guidance explicitly says to import only from known sources after checking the fingerprint.
6. Separate certificate dates from trusted signing time
An expired certificate today does not, by itself, answer whether the signature was valid when created. A trusted timestamp and embedded revocation evidence can support later validation. A claimed time from the signer’s computer is weaker than a verified timestamp authority. Adobe explains that verification information can include revocation status and a trusted timestamp; PDF Association also lists ISO 14533-3 for long-term PAdES verification profiles.
7. Match the result to the recipient’s policy
A technically valid signature does not prove the signer had authority, the document is truthful, malware-free, legally enforceable, or acceptable to a specific portal. For contracts, invoices, regulated filings, or government records, follow the recipient’s approved validator, trust list, identity check, retention policy, and escalation path. If you still cannot establish trust, request a newly issued file through the official channel.
Use PDFCheck for structural triage—not the final trust verdict
The PDF Signature Checker can identify signature dictionaries and fields, inspect ByteRange coverage, surface parsable certificate fields and dates, detect timestamp markers, and report certification level and document permissions. Use that result to choose the next check.
Capability boundary: PDFCheck does not cryptographically verify the signature value, build or trust a certificate chain, query OCSP or CRLs, prove signer identity, certify PAdES compliance, detect malware, or decide legal validity or recipient acceptance. A “signed” structural result is not the same as a cryptographically valid and trusted signature.
Failure states and recovery actions
| Failure state | Likely explanation | Recovery |
|---|---|---|
| PDFCheck says “signed,” but Acrobat says “invalid” | Structure was found, but cryptographic, trust, revocation, or policy validation failed | Use Acrobat or the required institutional validator; keep the PDFCheck result as triage only |
| One computer says valid; another says unknown | Trust stores, network access, cached revocation data, time, or reader support differ | Compare reader versions and validation details; use the recipient’s controlled environment |
| The signature became invalid after Save, Print, or Export | The saved file is a different revision or rebuilt PDF | Recover the original; make approved changes in the source and run a new signing cycle |
| Visible signature, but no digital signature detected | It may be an image/typed mark, an empty field, or an unsupported signature structure | Confirm the required method and inspect in the sender’s recommended reader |
| Signature validates, but invoice details changed outside the PDF | Technical validation cannot verify bank instructions, signer authority, or business truth | Confirm the instruction with the known organization before acting |
Final handoff checklist
- □ I preserved the exact received file and worked on a copy.
- □ I recorded the full signature, certificate, timestamp, and document-change status.
- □ I did not add certificate trust until I verified the fingerprint through a separate channel.
- □ I checked certificate dates, trusted time, and revocation evidence in an approved validator.
- □ I treated PDFCheck as structural triage, not cryptographic or legal validation.
- □ I requested an original or newly signed copy when integrity or trust remained unresolved.
If the signature is only one part of a wider document review, inspect it with the PDF Signature Checker, compare metadata clues with the PDF metadata checker, and finish with the PDF Validator. These screens support review, but they do not prove identity, intent, authenticity, or legal validity.