"Invalid" usually means the file changed after it was signed. "Unknown" usually means your reader cannot confirm that the signer's certificate is trusted. The first is an integrity problem. The second is a trust problem, and the signature itself may be perfectly fine. Do not edit the file or click "trust" to make the warning go away. Keep the copy you received and work down the rungs below. If you want the full verification routine rather than a diagnosis, start with how to verify a PDF digital signature; this article is for when that routine has already shown you a warning.
Start here: which message do you see?
The wording is Adobe Acrobat's. Other readers say similar things in other words.
| Message | Usual cause | Rung |
|---|---|---|
| This document does not contain any digital signatures | Only a picture of a signature, or the signed file was rebuilt | 1 |
| Signature is INVALID; document has been altered or corrupted | Bytes inside the signed range changed | 2 |
| Signature validity is UNKNOWN; signer's identity is unknown | The certificate does not chain to a trusted root, or revocation could not be checked | 3 |
| Certificate expired or revoked | The certificate's end date has passed, or the issuer withdrew it | 4 |
| Valid on one machine, unknown on another | Different trust lists, versions or network access | 5 |
Rung 1: is there a digital signature at all?
A scanned handwritten signature or a typed name is page content. It will never show up in a signatures panel. An empty signature field waiting to be signed is not a signature either. And if someone printed the signed file to PDF or re-saved it through a converter, the file was rebuilt and the signature was discarded along the way. In every one of these cases the fix is the same: ask the sender for the signed original, and compare the two with the PDF comparer if you are not sure which copy you have.
Rung 2: did the file change after signing?
A PDF signature cannot cover itself, because the signature value sits inside the file it signs. The signing software leaves a gap and records the signed parts in /ByteRange as four numbers: the start and length of the bytes before the gap, then the start and length after it. Everything outside the gap is hashed and signed.
Here is a file I signed locally with TCPDF and a self-signed OpenSSL certificate, then checked with the PDF signature checker and Poppler's pdfsig 26.10.0:
Signed file, 19,613 bytes. ByteRange [0 1840 13584 6029].
Signed: bytes 0 to 1,839. Gap: bytes 1,840 to 13,583, holding the 11,744-byte signature. Signed: bytes 13,584 to 19,612.
13,584 + 6,029 = 19,613 = file size, so the checker reports Signed range reaches file end.
Then I appended an update that changed the title to "Edited after signing". The file grew to 19,804 bytes, the signed data still ended at 19,613, and the checker reported Bytes follow signed range with 191 unsigned bytes. Its summary read: "This document contains 1 digital signature. The document is certified. Warning: the document may have been modified after signing." pdfsig said "Signature is Valid, Not total document signed". Both are right. The original bytes are intact, so the maths holds, but the 191 bytes after them can change what a viewer displays. That is why the extra bytes matter more than the green tick.
Not every appended update is a problem. When a second person signs, their signature is itself an appended update, so the first signature in a two-signature file always shows bytes after its range. Compare against the last signature: if signing was the final step, the last signature should reach the end of the file. Form filling and comments also append updates, and a certifying signature can allow exactly that through its DocMDP level:
| /P value | Shown as | Later changes the author allows |
|---|---|---|
| 1 | No Changes Allowed | None |
| 2 | Form Filling & Signing | Filling in fields and adding signatures |
| 3 | Annotations & Forms | As 2, plus comments and other annotations |
| Missing or unreadable | Declared Certification | A DocMDP entry exists but its value was not read |
The checker reports the declared level. It does not test whether the later updates stayed within it; Acrobat does.
If the signed range itself was altered, the signature is broken for good. The usual culprits are innocent: printing to PDF, compressing with any tool including our optimizer, adding or removing a password including with our password tool, or merging and splitting, which copy page content into a brand-new file with no signature in it. Go back to the file exactly as it was sent. If changes are genuinely needed, Adobe's advice is to edit the unsigned source and sign again. Never pass a rebuilt copy off as something the signer approved.
Rung 3: is the certificate trusted?
A reader trusts a certificate only if it links back to a root on its trust list. Microsoft's guidance puts it plainly: the assurances of a digital signature apply when the certificate comes from a reputable certificate authority. When the chain cannot be built, Acrobat reports that the signer's identity is unknown. Common reasons:
- The signer used a company-internal or self-signed certificate. In my test file the issuer and the subject were both "Test Signer", which is the mark of a self-signed certificate. The checker displayed that without comment, because judging trust is not its job.
- Your reader's trust lists are out of date. In Acrobat the Trust Manager preferences can load the Adobe Approved Trust List and the EU Trusted Lists.
- You were offline, so revocation could not be checked.
Update the trust lists and reconnect first. If the warning stays, contact the sender through a channel you already know and ask them to confirm the certificate's fingerprint. Add the certificate to your trusted list only if the fingerprints match. Never trust a certificate because the document asks you to.
Rung 4: has the certificate expired or been revoked?
What matters is whether the certificate was valid at the moment of signing, not whether it is valid today. The PDFCheck checker judges expiry against today, so a certificate that lapsed last month shows as expired even if the document was signed a year ago. A trusted timestamp settles it: an RFC 3161 time-stamp token is evidence that the signed data existed before a particular time, issued by a third party rather than the signer's clock. Signatures that also embed the revocation data from signing time, which PAdES calls validation data in a Document Security Store, can be checked years later without any network. Without a timestamp, the "Recorded Signing Date" is simply the /M entry, taken from the signer's computer clock.
Revocation is more serious. If the certificate was revoked before the signing time, treat the signature as not valid and ask for a fresh signature.
Rung 5: why is it valid on one computer and unknown on another?
The two readers have different trust lists, versions or network access. One has loaded the AATL or EU lists, or checked revocation online, and the other has not. Judge the document in the environment the final recipient will use, not the friendliest one you can find.
What the checker shows, and what it does not
For each signature it lists the Name (typed by the signer's software, and it may differ from the certificate), Reason, Location and Contact, the Recorded Signing Date, the Signature Filter such as Adobe.PPKLite, the Signature Format (adbe.pkcs7.detached, adbe.pkcs7.sha1, ETSI.CAdES.detached, or ETSI.RFC3161 for a document timestamp) and the certificate's common name, organization, issuer, algorithm and validity dates. It does not recompute the hash, verify the signature value, build a trust chain or check revocation lists. Permissions are read from the encryption dictionary, so an unencrypted file shows printing, modification, copying and annotations all allowed. That is a list of facts to take to the sender, not a verdict, and no online check can tell you whether a signature is legally binding where you are.
Can I fix an invalid signature myself?
No. Only the signer can produce a new valid signature. You can recover the untouched original, or ask for a newly signed copy. Everything else is cosmetics on a broken seal.