Digital certificates expire, typically one to three years after issuance. A Digital Signature on a PDF created with a now-expired certificate presents a verification challenge. The PDF reader checks the certificate validity at verification time, not at signing time. If the certificate has expired, the signature shows as invalid even though it was perfectly valid when applied. What happens depends on whether the signature was time-stamped.
Without a timestamp, an expired certificate renders the signature unverifiable. The PDF reader cannot determine whether the document was signed before or after the certificate expired. The signature displays a warning triangle or a red X, and the document appears to have an invalid signature. This is the most common outcome for signed PDFs that are verified years after signing.
With a timestamp from a trusted Time Stamping Authority, the signature remains verifiable even after certificate expiration. The timestamp freezes the certificate validity at the moment of signing. The Sign PDF verification process checks the timestamp rather than the current certificate status, confirming the certificate was valid when the timestamp was issued.
WukongPDF's PDF verification tools display signature validity status including certificate expiration information.
Why Certificates Expire and Why That Matters
Certificate expiration is a security feature, not a flaw. Certificates have limited validity periods because identity information changes over time. A certificate issued to an employee who later leaves the organization should not remain valid indefinitely. Expiration forces periodic identity re-verification and certificate renewal.
The problem for signed documents is that their verification lifetime often exceeds the certificate lifetime. A mortgage document may need verification 15 years after signing. A patent application may be referenced 20 years later. The signing certificate expired long before the document's verification need expired. Time-stamping addresses this mismatch between certificate lifetime and document lifetime.
What the PDF Reader Displays for an Expired Certificate
When a PDF with an expired signing certificate is opened, the reader displays a signature status. Without a timestamp, the status is typically Signature Validity is Unknown or The signer's certificate has expired. The signature panel may show a yellow warning triangle or a red X depending on the reader. The visual signature appearance on the page may show a question mark overlay.
With a valid timestamp, the status is different. The reader displays Signature is Valid with a notation that Long Term Validation is enabled or The signature includes an embedded timestamp. The visual signature appearance shows a green checkmark with a clock icon. The signature is verified as valid because the timestamp proves the certificate was valid at the moment of signing.
The Role of Long-Term Validation
Long-Term Validation, or LTV, is a PDF feature that embeds enough information in the signed PDF to verify the signature without accessing external servers. LTV includes the signing certificate, the certificate chain up to a trusted root, the timestamp, and certificate revocation status information at the time of signing. An LTV-enabled signature is self-contained for verification purposes.
To enable LTV on an existing signed PDF, open it in Acrobat Pro and add verification information. The software gathers all certificates, timestamps, and revocation status data needed for verification and embeds them in the PDF. After LTV enablement, the signature can be verified even on a computer with no internet access and even after the signing certificate and timestamp certificate have both expired, as long as the root certificate in the chain is still trusted.
What Happens When the Timestamp Certificate Also Expires
TSA certificates have much longer validity periods than signing certificates, typically 10 to 20 years, but they do eventually expire. When both the signing certificate and the timestamp certificate have expired, the signature verification depends on whether the root certificate at the top of the chain is still trusted by the PDF reader.
Root certificates from major certificate authorities are typically valid for 20 to 30 years and are pre-installed in operating systems and PDF readers. If the root certificate is still trusted, the signature chain from signing certificate through timestamp to root can be verified even after both intermediate certificates have expired. The root certificate is the anchor of trust that enables indefinite verification.
Preparing Signed PDFs for Maximum Future Verifiability
During typical workflows, when creating a signed PDF that needs long-term verifiability, follow three practices. First, always enable timestamping with a reputable TSA. Second, enable LTV to embed all verification information in the PDF. Third, use a CA-issued certificate from a major certificate authority with a long-lived root. These three steps maximize the probability that the signature will be verifiable decades later.
Before the signing certificate expires, apply a new signature with a fresh certificate and timestamp. This creates a new signature that independently verifies the document and can serve as the primary verification path after the original signature certificate expires. The new signature does not invalidate the original but provides a redundant verification path.
An expired signing certificate does not mean the signed document is invalid. With proper timestamping and LTV, the signature remains verifiable indefinitely. Without these protections, the signature becomes unverifiable when the certificate expires. The difference is a few configuration settings at signing time.
| Scenario | What Reader Shows | Validity Status |
|---|---|---|
| Certificate expired, no timestamp | Invalid signature warning | Cannot verify when signed |
| Certificate expired, timestamped | Valid signature with LTV note | Verifiable, timestamp proves validity window |
| Certificate revoked, timestamped before revocation | Valid signature with LTV note | Verifiable, timestamp predates revocation |
Document signing practices should account for the expected verification lifetime of the document. A routine internal approval that will be verified within the certificate validity window does not need the full LTV and timestamp treatment. A legal contract, regulatory filing, or archival record that may need verification decades later deserves the strongest available signature protection.
Checking Certificate Revocation Status at Verification Time
Certificate expiration and certificate revocation are different. An expired certificate simply reached its validity end date. A revoked certificate was actively invalidated by the issuing authority before its expiration date, typically because the private key was compromised or the certificate holder left the organization. Timestamps protect against expiration but cannot protect against revocation before the timestamp was issued.
During typical workflows, when verifying a signed PDF, the PDF reader checks the certificate revocation status through OCSP (Online Certificate Status Protocol) or CRLs (Certificate Revocation Lists). If the certificate was revoked before the timestamp date, the signature is invalid regardless of the timestamp. If the certificate was revoked after the timestamp date, the signature remains valid because the timestamp predates the revocation.
Migrating Signed Documents to New Certificates Before Expiration
Before a signing certificate expires, plan for migration. Inventory all documents signed with the expiring certificate. For documents that need ongoing verifiability, apply a new signature with the replacement certificate while the original certificate is still valid. The new signature adds a verification path that will remain valid after the original certificate expires.
Document the certificate migration in the organizational signing policy. Specify how far in advance of expiration the migration should begin, which documents need re-signing, and the verification process for confirming the new signatures are valid. A planned migration prevents the discovery of unverifiable signatures after the certificate has already expired.
Building Signature Verification Into Document Management Systems
Enterprise document management systems can automate signature verification when documents are accessed. When a user opens a signed PDF from the repository, the system verifies the signature and timestamp in the background and displays the validity status. The user does not need to manually check each signature.
Automated verification catches expired or invalid signatures that manual review would miss. A document with an invalid signature can be flagged for review before it is relied upon for a business decision. The verification automation provides a safety net that protects the organization from acting on documents whose authenticity cannot be verified.
Certificate expiration is an inevitable part of the digital signature lifecycle. Understanding what happens when a certificate expires, and preparing for it with timestamping and LTV, ensures that signed documents remain verifiable long after the signing certificate has reached the end of its validity period.
The practices described here transform digital signatures from temporary authentication into permanent verification. A signed PDF prepared with timestamping and LTV can be verified decades after signing, providing the long-term document authenticity that legal, financial, and regulatory contexts require.
Understanding certificate expiration and preparing for it is part of responsible digital document management. Every signed PDF has an expiration date on its signature, whether the signer realizes it or not. Timestamping and LTV push that expiration date far into the future, but the practices must be implemented before the certificate expires.
A signed PDF without timestamping and LTV has a verification window of one to three years. The same PDF with timestamping and LTV has a verification window measured in decades. The difference is a few configuration settings applied at signing time. Implementing these practices for every signed PDF ensures consistent long-term verifiability across the entire document collection, ensuring that every signed document remains verifiable for its full required retention period without unexpected verification failures.