Signature Validity Unknown in a PDF: Causes and Fixes

"Signature validity is unknown" means your PDF reader checked the digital signature but could not decide whether to trust it. Usually the document has not been changed: the reader simply cannot link the signer's certificate to an issuer it trusts, or it lacks the revocation or time information it needs. That is a trust question, not proof of tampering.

The message looks alarming, and the related banner "At least one signature has problems" often appears with it. Before you reject a document or ask for it to be signed again, it helps to know what the reader actually checked and which part failed. This article explains the three states a signature can be in, the common causes of "unknown", and what you can safely do about each one.

Valid, invalid and unknown: what is the difference?

A digital signature in a PDF is checked in two separate ways. The first is integrity: the reader recalculates a fingerprint of the signed bytes and compares it with the one locked inside the signature. The second is identity and trust: the reader looks at the signer's certificate and tries to build a chain from it to a certificate it already trusts, and checks that nothing in that chain has expired or been revoked.

The European standard for validating advanced digital signatures, ETSI EN 319 102-1, names three overall results, and they map neatly onto what PDF readers show:

So "unknown" sits in the middle. It is not the same as "invalid", which is the result you should worry about, because it can mean the signed content was altered.

Why does a PDF say signature validity is unknown?

ETSI EN 319 102-1 lists the reasons a validation ends as indeterminate. In everyday PDF use, five of them account for most cases.

1. The certificate is self-signed or from an issuer you do not trust

This is the most common cause. Anyone can create a certificate with any name in it, so a reader only trusts a signer when it can trace the certificate back to a trust anchor: a root certificate it already has in its trusted list. If the signer made their own certificate, or their organisation runs an internal certificate authority your computer does not know, the standard calls this "no certificate chain found" and the result is indeterminate.

Many signatures between colleagues, suppliers and sites are made this way. They still prove that the file has not changed since that certificate signed it. What they cannot prove on their own is who holds the certificate.

2. The reader cannot check revocation

Certificates can be revoked before they expire, for example if a key is lost. A reader checks this using a certificate revocation list (CRL) or an OCSP response. If it is offline, the issuer's server cannot be reached, or the information was never embedded in the file, the check cannot finish. The standard has a specific outcome for this, TRY_LATER, meaning more revocation information may become available later.

3. The certificate has expired and the signing time cannot be proven

A signature made while a certificate was valid is still meaningful after the certificate expires, but only if the reader can prove when the signature was made. Without a trusted timestamp, the signing time usually comes from the clock on the signer's computer, which the reader cannot rely on. ETSI describes this as the certificate being expired or not yet valid at the validation time, with no way to ascertain that the signing time falls within its validity period.

4. The timestamp itself cannot be verified

If the signature carries a timestamp, the reader also has to trust the timestamp server's certificate. When that certificate is not in the reader's trusted list, or the timestamp has expired, the reader reports the timestamp as unverified or expired, and it then cannot use that time to prove when the signature was made.

5. The algorithm or key size is below the required level

Older signatures made with weak hash algorithms or short keys can end as indeterminate when the validation policy treats them as no longer secure and there is no proof the signature was made before they became weak.

What does "At least one signature has problems" mean?

This banner is a summary. It appears when any signature in the document is not fully valid, which includes unknown signatures as well as invalid ones. Open the signature panel and look at each signature separately. If every problem signature says "unknown" and none says "invalid" or "the document has been altered", you are dealing with trust or validation information, not with a changed file.

Also look for changes made after signing. A reader can often tell you that the document was modified after a signature was applied, for example by filling in a form field or adding a later signature. Whether those later changes were allowed is a separate question from whether the signer is trusted.

How do you fix signature validity unknown?

Work through the checks in order. The aim is to find out which part of validation could not finish, not to make the warning go away.

1. Open the signature properties. In a full PDF reader such as Adobe Acrobat Reader, open the Signatures panel, validate the signature and open the signature properties. Note the signer, the issuer, the certificate's validity dates and whether the document was modified after signing.
2. Check the integrity line first. If the reader says the document has not been modified since it was signed, the content is intact as far as that signature is concerned. If it says the document was altered, treat the file as suspect regardless of trust.
3. Check who issued the certificate. If the issuer and the signer are the same name, it is a self-signed certificate. If it is an internal company CA, ask your IT team whether that root certificate should be installed on your computer.
4. Confirm the certificate with the signer, then trust it. If you expect signatures from this person regularly, ask them for the certificate's fingerprint through a separate channel, such as a phone call, and compare it with the fingerprint shown in the certificate details. Only then add it to your reader's trusted certificates. Trusting a certificate because a document told you to defeats the purpose.
5. Go online and validate again. If the problem is revocation checking, connect to the internet and revalidate, so the reader can reach the issuer's CRL or OCSP service.
6. Check the signing time. The reader will say whether the time came from the signer's computer clock or from a timestamp server. If the certificate has since expired and there is no trusted timestamp, the result may stay unknown. Ask the signer for a newly signed copy if you need a fully verifiable record.

Do not try to fix the warning by editing, repairing or re-saving the signed file. Any change to the signed bytes can turn an unknown signature into an invalid one, and you lose the original evidence.

What about qualified signatures from EU trust service providers?

Under eIDAS, a trust service provider and its services count as qualified only if they appear in an EU trusted list. Each Member State maintains and publishes its own list, and the European Commission makes them available through the EU Trusted List browser. You can use it to check whether the issuer named in a certificate is a qualified provider. Your PDF reader may report a qualified signature as unknown if it has not loaded the trust lists that cover that provider.

The European Commission also publishes the DSS signature validation demo, which produces an ETSI-style validation report. Read its notice before using it: files are transmitted to the Commission's infrastructure, it is intended for testing purposes only, and it advises against using documents that contain sensitive material. It is useful for understanding a result on a test copy, not for confidential batch records or patient data.

For signatures that need to stay verifiable for years, the European PAdES standard, ETSI EN 319 142-1, defines higher levels. Level B-T adds a trusted token proving the signature existed at a certain time, and B-LT embeds the material needed to validate the signature inside the document. Signatures at these levels are much less likely to drift into "unknown" as certificates expire. Our article on electronic and digital signatures in PDFs explains the eIDAS signature levels in more detail.

What should a regulated team record?

In GMP, clinical and quality settings, a signed PDF is often the record itself: an approved SOP, a batch record review or a signed protocol page. An unknown status is not automatically a deviation, but it should not be ignored either. A practical approach is to:

• record the validation result and the reason given, for example "issuer not trusted" or "revocation could not be checked";
• confirm the signer's certificate through a separate channel before accepting it;
• follow your SOP for how signatures on external documents are verified, and ask QA where it does not cover this case;
• keep the original signed file unchanged and work on copies.

Our article on online PDF tools in pharma and GMP work covers the wider data-integrity questions.

Can Priya LifePDF help?

For checking a signature, use a full PDF reader, because the integrity check is the part that matters most. Our Validate Signature tool shows certificate details but does not verify that the document is unchanged since signing, so it cannot answer this question.

If you are the one signing, Digital Sign PDF signs a PDF in your browser with your own PFX, P12 or PEM certificate file. It creates a standard adbe.pkcs7.detached signature, not a PAdES baseline signature, and it does not add a timestamp, so the signing time comes from your device's clock. If you sign with a self-made certificate, recipients will normally see "validity unknown" until they choose to trust it. For signatures that recipients' readers trust automatically, you need a certificate from a provider their software trusts. Our guide on how to sign a PDF covers visual signatures, which carry no certificate at all.

This article is general information, not legal or regulatory advice. Check your organisation's signature procedures with your QA or legal team.