Digital signatures · Published
How to check whether a PDF signature is valid
Three free ways to validate the signature on a PDF someone sent you — the European Commission’s DSS demo, Spain’s VALIDe and Adobe Acrobat — and what valid, indeterminate, invalid and modified actually mean.
A handwritten flourish, a stamp or the word “signed” on a PDF proves nothing. A digital signature is something you check, and checking it means four things:
- Integrity: the document hasn’t changed since it was signed, or what changed is allowed.
- Identity: the signer’s certificate was issued by a provider that can be trusted.
- Validity: the certificate wasn’t expired or revoked at the time of signing.
- Time: if there is a timestamp, it is sound and you know who issued it.
None of this requires PDFsigna. All three tools below can be used for free; for Adobe, the free Acrobat Reader is enough.
The European Commission’s DSS validator
DSS is the European Commission’s open-source signature library, and it has a demonstration web app that validates signatures from any EU country using the European trusted lists. Upload the PDF as the signed file, keep the default policy and submit.
Its result follows the European validation standard, ETSI EN 319 102-1, with one of three indications: TOTAL_PASSED, INDETERMINATE or TOTAL_FAILED. The detailed report explains why.
Two warnings the page itself gives: it is a demonstration of the library, not a Commission validation service, and the files you upload are sent to the Commission’s infrastructure (it says they are not retained). Don’t upload anything to any web tool that shouldn’t leave your computer.
VALIDe, for Spanish signatures
If the signature was made with a Spanish certificate — the FNMT certificate most Spaniards use, the ACCV’s, or the Spanish national ID card — VALIDe is the Spanish public service for checking signatures and certificates. Choose Validar Firma on its home page, upload the PDF, and it returns the result for each signature with the certificate details. Its notice says the personal data in what you send is used only for validation and deleted from its temporary records afterwards.
Adobe Acrobat or Acrobat Reader
Open the PDF in Acrobat, open the Signatures panel, and choose Validate Signatures from its options. The status of each signature appears in a validation dialog, and the signature properties show the signer’s certificate. Adobe walks through it in its help on validating signatures.
What you need to know about Acrobat is that its verdict depends on which certificates it trusts. An untouched signature made with a certificate from an issuer Acrobat doesn’t trust won’t show as valid, even though nobody has tampered with it.
What each result means
| Result | What it means |
|---|---|
Valid (TOTAL_PASSED in DSS) |
The cryptographic checks succeeded and every check required by the validation policy passed |
Indeterminate (INDETERMINATE) |
What could be checked doesn’t allow calling it valid or invalid. Usually something is missing: revocation data, an issuer the validator doesn’t know, a trustworthy time |
Invalid (TOTAL_FAILED) |
The cryptography failed, the certificate is proven to have been invalid when signing, or the signature can’t even be processed |
| Modified | The document changed after signing. If the change is allowed — another signature, a form filled in where it was meant to be — the original signature still stands; if not, it no longer covers what you see |
The first three definitions are the standard’s. “Modified” isn’t a fourth indication but a reason, which ends up under one of the other three.
Indeterminate is not an accusation. It almost always means the validator couldn’t finish checking, not that the signature is forged. Before you worry, try another of the three tools and read the reason in the report: it usually says exactly what was missing.
And with PDFsigna
When you open a signed PDF, PDFsigna shows each signature’s legal level, and its validation card lists integrity, revocation, timestamp, PAdES profile and later changes. When the app can call a signature neither valid nor invalid, it says “Validity can’t be confirmed”, using none of the five level colours. The validator that needs no install isn’t on this site yet and has no date; it won’t go live until it gives the same verdict as the app.
This article is general information, not professional advice. Laws, prices and how software works change over time: before you decide, check the official, up-to-date documentation from each authority or vendor.