Digital Signature Validation: How to Check Whether a Signed Document Is Genuine

Signing is easy — verifying is where trust is won

Anyone can apply a digital signature; the hard, valuable skill is checking one. Signature validation is the process your PDF reader, your e-signature platform, or your compliance tool runs when it answers three questions: is the document exactly what was signed (integrity), was the signing key under the signer's control and tied to their identity (authenticity), and can the proof survive certificate expiry and algorithm ageing (long-term validity). The green checkmark in Acrobat compresses hours of cryptographic checking into one glyph — understanding what it verifies keeps you from over-trusting it.

At a glance

What a validation actually checks, in order.

Document integrity: the hash of the signed byte ranges matches the digest embedded in the signature — any edit breaks it.

Certificate chain: the signing certificate chains to a CA your validator trusts — from a corporate trust store, a national trusted list, or the EU Trusted List.

Revocation state: the certificate was unrevoked at signing time, provable via embedded OCSP/CRL responses.

Timestamp: a trusted timestamp fixes the signing time and anchors revocation checks to that moment.

Long-term validation (LTV): embedded validation data lets the signature be re-verified years later, after certificates expire.

What the signature panel is telling you

The three states you will actually see, and what each means for your next step.

	Signature valid	Validity unknown / trust not found	Signature invalid
What it means	Integrity, chain, and revocation all passed	Crypto is fine but a trust decision is missing or data is stale	The document changed after signing, or the key was revoked before signing
Document integrity	Proven unchanged	Not in question	Broken — treat content as tampered
Typical causes	Signed properly with a chained, unrevoked certificate	Signer used a self-issued or non-listed CA; validator's trusted-list cache is old	Post-signing edits; forged or revoked credential
Safe action	Proceed; archive with the validation evidence	Update the validator's trust lists and re-check; if still unknown, decide trust manually	Stop; request a re-signed document and investigate the source

Validating a signature properly, step by step

The workflow for a reader who receives a signed PDF and must decide whether to rely on it.

1. Open the signature panel, not just the page

In Acrobat and most readers, the signature panel shows every signature on the document, the signing time, the reason, and a per-signature validity state. Multiple signatures mean multiple byte ranges — the last one covers the final document state.

2. Read the distinction between integrity and trust

'Signature is valid' means the bytes are unchanged and the chain checks out to a trusted root. 'Validity unknown — signer's certificate could not be verified' usually means the CA is not in your trust store — common with non-EUTL issuers and corporate CAs, and fixable without discarding the signature.

3. Update trust before judging

Acrobat refreshes its trusted lists (including the EU Trusted List) automatically when online and enabled. An offline or first-time reader may show warnings that disappear after a refresh — always re-validate before escalating a 'trust not found' warning.

4. Check timestamps and LTV explicitly

For agreements you will archive, look for a qualified or trusted timestamp and LTV-enabled data. A signature without LTV may become unverifiable once its certificate expires, even though the document never changed.

5. Save the evidence, not just the file

Export or archive the signature validation report alongside the document. If the signature is ever disputed, you want to show what was verified, when, and against which trust anchors.

Validation at enterprise scale

One signed PDF is a reader problem; ten thousand a month is an architecture problem.

Automate the decision, not just the check

Platforms and document pipelines can run validation programmatically and route outcomes: valid to archive with evidence; unknown trust flagged for review; invalid quarantined. The point is to convert reader-level judgment into policy.

Maintain a trust list strategy

Decide up front which anchors your organisation recognises — corporate CAs, national lists, the EUTL — and keep the validator's cache fresh. Most 'untrusted' escalations are stale-cache noise, and every unnecessary escalation erodes attention to real ones.

Validate on receipt, not just on dispute

Checking signatures when documents arrive catches tampering while the counterparty is still reachable and the evidence trail is warm. Disputes surface years later; validation is cheap now and expensive retroactively.

Beware the post-signing annotation trap

Adding form fills, comments, or certain metadata after signing can invalidate a signature that was perfectly sound at signing time — or produce a new, valid incremental signature over the additions. Know which your workflow produces before treating a 'modified after signing' warning as fraud.

Common questions

Only indirectly. It verifies the key-holder and that the certificate chains to a trusted issuer. How strongly the certificate binds to the real person depends on the issuing CA's practices. For high-stakes documents, check the certificate's policy and the signer's authentication method, not just the green glyph.

PAdES, XAdES and JAdES: the signature formats that make LTV possible What the EU Trusted List is and how trust is established E-signature audit trails: what a complete evidence package contains

Team discussing the right eSignature approach for a business

Explore the right eSignature approach for your business

Talk to our team about eSignature requirements, compliance considerations, and document workflows across your target markets.

Keep reading

Glossary