A signed PDF arrives from a business partner. The signature panel shows a name, a date, and a validity status. You need to know whether that signature is genuine, whether the document has been modified since it was signed, and whether the signer identity can be trusted. The PDF reader gives you indicators: a green checkmark, a blue ribbon, a warning icon. But these indicators can be misleading if you do not understand what they are verifying and what they are not. Validating a digital signature is not just checking the icon. It is understanding the chain of trust behind it.
Digital signature validation involves three checks. Document integrity: has the document been modified since signing? Signer identity: does the certificate belong to the person who claims to have signed? Certificate trust: was the certificate issued by a trusted authority? All three must pass for the signature to be fully valid. A green checkmark that confirms document integrity but comes from an untrusted certificate is a warning, not a confirmation.
The Sign PDF verification process is a technical check, not a legal one. A valid signature proves mathematically that a specific private key signed the document and that the document has not changed. It does not prove that the person named on the certificate actually controlled that key or intended to sign.
Checking Document Integrity
Open the signed PDF in a reader that supports signature verification. The signature panel shows the validity status. A valid signature means the document content has not been modified since the signature was applied. An invalid signature means the document was changed after signing. The change could be as minor as adding a comment or filling a form field, or as major as altering the contract terms. Any change invalidates the signature. If the signature is invalid, do not rely on the document without understanding what changed and whether the signer approved the change.
The Digital Signature integrity check is binary. Either the document has changed or it has not. There is no partial validity. A document that shows a valid signature for page 1 and an invalid signature for page 2 has been modified. Treat the entire document as potentially altered.
Verifying Signer Identity and Certificate Trust
Click the signature to view certificate details. The certificate shows the signer name, the issuing certificate authority, and the validity period. Check that the signer name matches the person you expected to sign. Check that the certificate was valid at the time of signing. A certificate that expired after the signature date is fine. A certificate that expired before the signature date means the signature was applied with an expired certificate and may not be trustworthy. Check the certificate authority. A certificate from a recognized public CA provides stronger identity assurance than a self-signed certificate.
The PDF Security certificate trust chain should be intact. The certificate should chain up to a root certificate authority that your reader trusts. If the chain is broken, the signature may show as invalid even if the document is unchanged and the signer is genuine.
What to Do With an Invalid or Untrusted Signature
If the signature is invalid, contact the signer. Ask whether they modified the document after signing or whether they can re-sign the current version. Do not accept an invalidly signed document as authoritative without confirmation. If the signature is valid but from an untrusted certificate, the signature proves that someone with access to that certificate signed, but does not independently prove who that person is. For internal documents, this is usually sufficient. For external contracts, request a signature from a certificate issued by a recognized authority.
WukongPDF supports digital signatures. The Sign PDF validation tools in standard PDF readers provide the verification capabilities described here.
Understanding Long-Term Validation (LTV) in Received Signatures
A signature with LTV enabled includes all the information needed to verify it after the signer certificate expires. When you open an LTV-enabled signed document years after signing, the signature can still be verified because the certificate chain, revocation status, and timestamp are embedded in the document.
If you receive a signed document that must remain verifiable for years, check whether LTV is enabled. Open the signature properties and look for LTV or long-term validation indicators. If LTV is not enabled, the signature may become unverifiable after the certificate expires. The Digital Signature LTV status affects the document long-term legal weight.
Documenting Signature Verification for Compliance Records
For regulated documents, document your signature verification. Record the document name, the signer name, the verification date, and the verification result. The record demonstrates that you checked the signature and confirmed its validity before relying on the document. If the signature is later challenged, the verification record supports your reliance.
The PDF Security verification record is a simple audit trail entry. It takes seconds and provides evidence of due diligence.
Handling Multiple Signatures on a Single Document
A contract signed by two parties has two digital signatures. Each must be validated independently. One signature may be valid while the other is invalid. A document modified after the first signature but before the second will show the first signature as invalid and the second as valid. Understand the sequence of signatures and the document state at each signing event.
The signature panel lists all signatures chronologically. Review each one. The Digital Signature validation for multi-signature documents requires understanding the signing timeline, not just the validity status of each signature.
Revoked Certificates and Certificate Revocation Lists
A signature that was valid when applied may become invalid if the signer certificate is later revoked. Certificate revocation occurs when the private key is compromised, the certificate holder leaves the organization, or the certificate authority discovers that the certificate was issued improperly. Check the certificate revocation status through the Certificate Revocation List or Online Certificate Status Protocol.
A signature that shows as valid but has a revoked certificate should not be trusted. The PDF Security verification includes checking revocation status. A signature with a revoked certificate provides no assurance regardless of the validity indicator.