How to Verify a Digital Signature in a PDF

Someone sends you a signed PDF. Your viewer shows a green tick, or a yellow warning triangle, or nothing at all. Working out what those actually mean — and what they do not — is the difference between a signature that proves something and a picture that looks reassuring. This guide covers checking a digital signature properly, reading the three separate questions a validation answers, and knowing when the green tick is not enough.

First, is it a digital signature at all?

The common confusion. A picture of a signature — a scanned squiggle, a typed name in a script font, a drawn mark — is an image on a page. It carries no cryptography, proves nothing about who applied it, and does not detect changes to the document. Most "signed PDFs" in circulation are this.

A digital signature is a cryptographic object embedded in the file: a hash of the document's bytes, encrypted with the signer's private key, packaged with their certificate. It answers real questions.

How to tell them apart: open the document and look for a signature panel in the viewer. In Acrobat, a blue or yellow bar appears across the top and there is a Signature Panel button. In Firefox's viewer, nothing appears at all — it does not validate signatures. If no viewer you try shows a signature panel, there is no digital signature, whatever the page looks like. The distinction is covered in depth in digital signatures vs electronic signatures.

The three questions validation answers

A validation result bundles three separate checks, and conflating them is the usual mistake.

1. Integrity: has the document changed since signing? The viewer recomputes the hash over the signed byte range and compares. This check is binary and reliable. If it fails, the document has been altered.

2. Authenticity: who does the certificate say signed it? The certificate carries a name, and possibly an organisation, email and country. This is only as good as the certificate authority's identity checks.

3. Trust: do you have any reason to believe that certificate? This is the one that produces most warnings, and it is not a property of the document at all — it is a property of your trust configuration. A perfectly valid signature from a certificate authority your machine has never heard of shows as "validity unknown".

A green tick means all three passed on your machine, today. A yellow triangle usually means 1 and 2 passed but 3 did not.

Verifying in Adobe Acrobat or Reader

The most complete implementation, and the reference for what a good check looks like.

1. Open the document. A bar appears at the top: "Signed and all signatures are valid", or "At least one signature has problems", or "Validity is unknown".
2. Click Signature Panel.
3. Expand the signature entry. You get: the signer name, signing time, the reason and location fields if filled, and the certificate details.
4. Click Certificate Details → Summary / Trust / Revocation tabs.

What to actually read there:

• "Document has not been modified since this signature was applied" — the integrity check. This is the sentence that matters most.
• Signature covers: the whole document, or only part of it. A signature applied before later changes covers only the earlier revision — see below.
• Signing time, and whether it is a timestamp from a trusted authority or merely the signer's computer clock. The latter is unverifiable and trivially forged.
• Revocation status: whether the certificate was checked against a CRL or OCSP responder, and what the answer was.

Verifying without Acrobat

• Foxit Reader and PDF-XChange Editor both validate properly and are free.
• LibreOffice Draw shows signature status when opening a signed PDF, at a basic level.
• The EU's DSS demonstration validator (ec.europa.eu/digital-building-blocks) checks signatures against the EU trusted lists, which is the authoritative check for qualified European signatures.
• Browsers do not validate. Chrome, Edge, Firefox and Safari all render signed PDFs happily and tell you nothing about the signature. Never conclude anything from a browser view.
• Command line: pdfsig from poppler prints signature details, including the signer, time, and whether the signature covers the whole file. It is the quickest scriptable check and it is refreshingly blunt in its output. See poppler-utils introduction.

Reading the warnings correctly

"Validity unknown" / "The signer's identity is unknown" — the integrity check passed; your machine does not trust the issuing certificate authority. Extremely common with signatures from national eID schemes and corporate CAs. The fix is to install the relevant trust list, not to assume the document is bad. In Acrobat, the Adobe Approved Trust List (AATL) and the European Union Trusted Lists (EUTL) are enabled by default and cover most commercial e-signature providers.

"The signature is valid, but the document has been modified since it was signed" — this needs care. PDF supports incremental updates, so a document can be legitimately changed after signing — a second signer, a filled form field, an added annotation — without invalidating the first signature over its own byte range. Acrobat will tell you what changed. Reading that list is essential: "form field filled" is expected in a workflow; "page content modified" is not.

"The signature is invalid" — the hash does not match. The document has been altered in a way that breaks the signed range, or the file is corrupt.

"The certificate has expired" — the certificate was valid when signing occurred but has since passed its expiry date. Whether this matters depends entirely on whether there is a trusted timestamp proving the signing happened during the validity window. Without one, an expired certificate makes the signature unverifiable going forward. This is the whole motivation for long-term validation and PDF timestamps.

"Revocation information could not be checked" — your machine could not reach the CA's revocation service, often for network reasons. It is an inconclusive result, not a failure.

What a valid signature does not tell you

Worth being explicit, because green ticks are persuasive:

• It does not prove the signer read or agreed to the document. It proves a private key was applied.
• It does not prove the key holder was the person named. If the key was stolen, delegated, or sitting on a shared server, the signature is cryptographically perfect and evidentially weak.
• It does not prove the whole document is signed. Check the "signature covers" statement; a signature over pages 1–3 of a ten-page document is valid and nearly meaningless.
• It does not survive editing. Any tool that rewrites the file — compression, conversion, flattening, even some "save as" operations — will break it. If you need to process a signed document, keep the signed original untouched.
• It says nothing about legal validity in your jurisdiction. That depends on the signature type and the applicable law: e-signature laws around the world and is it legal to sign documents electronically.

A practical checklist

When a signed document arrives and it matters:

1. Open it in a viewer that actually validates — Acrobat, Foxit, or pdfsig.
2. Confirm "has not been modified".
3. Confirm the signature covers the entire document.
4. Read the signer's name and certificate issuer, and ask whether that issuer is one you have reason to trust.
5. Check for a trusted timestamp, not just a claimed signing time.
6. Check revocation status resolved successfully.
7. If any of these are unclear and the stakes are real, ask the sender for the signature's validation report, or run it through an independent validator.

For the internals of what is being checked, digital signature internals deep dive goes a level lower, and how to detect tampered PDFs covers the case where there is no signature to rely on.

Summary

Look for a signature panel; if there is none, there is no digital signature regardless of what the page shows. Then read three things separately: that the document has not been modified, that the signature covers all of it, and who the certificate belongs to — treating "validity unknown" as a trust-configuration issue rather than a verdict on the document. And remember that browsers show signed PDFs without checking anything at all.