← Blog

PDF Signature Valid vs Invalid vs Unknown — Complete Explanation

When you open a digitally signed PDF, your reader shows one of three signature statuses: Valid, Invalid, or Unknown. These three labels mean very different things, and knowing the difference can save you from dismissing a legitimate document — or worse, accepting a tampered one. Here's a clear breakdown of each status and what you should do.

✅ Signature Valid (Green Tick)

A green "Signature Valid" status means three things are simultaneously true: (1) the document was digitally signed using a certificate issued by a trusted Certificate Authority, (2) the document has not been modified since it was signed, and (3) the PDF reader's trust store includes the signing CA's certificate chain. This is the gold standard — you can be confident the document is authentic, unaltered, and signed by the stated authority.

What to do: Nothing. The document is verified. You can use it with full confidence.

Example: A PDF downloaded from a major international bank's portal, signed with a DigiCert certificate, will typically show Valid in Adobe Reader because DigiCert is on Adobe's AATL.

⚠️ Signature Validity Unknown (Yellow Warning)

An "Unknown" status means: the document was signed and the document integrity is intact (it has not been tampered with), but the PDF reader cannot verify the certificate chain because the signing CA is not in its trust store. This is the most common status for Indian government documents in Adobe Reader and Foxit — and it does not mean the document is fake.

What to do: Use VerifySign.in to verify the document properly. VerifySign.in holds a trusted certificate store for Indian government CAs and will confirm whether the signature is genuinely valid. If it is, VerifySign.in embeds LTV data so the PDF displays as Valid everywhere going forward.

Example: An Aadhaar card PDF signed by NIC, opened in Adobe Reader without the NIC root certificate installed, will show "Signature Validity Unknown."

❌ Signature Invalid (Red X)

A red "Signature Invalid" or "Signature Not Valid" status is a serious warning. It means either: (1) the document was modified after it was signed — even a single character change, an added watermark, or a page rearrangement will break the signature — or (2) the signing certificate has been revoked by the issuing CA, meaning the signer's credentials were invalidated. Either scenario means the document cannot be trusted as originally issued.

What to do: Do not use or submit this document. If you received it from an official source, re-download it from the original portal (DigiLocker, UIDAI, Income Tax e-filing, etc.). If someone sent it to you, request a fresh copy directly from the issuing authority. If you suspect deliberate tampering, contact the relevant authority and, if necessary, law enforcement.

Example: A fake Aadhaar where the name or photo has been edited in any image editor will show a red "Invalid" signature, because the document hash no longer matches the one recorded in the signature.

Quick Reference Summary