Valid Signature, Unknown Signer, or Expired Certificate: What Do These Results Mean?

The five results people actually see

Result	Plain meaning	Common cause	Sensible next step
Signature valid	Signed bytes unchanged, chain trusted, identity as bound in the certificate verified	Everything lined up	Record what you checked, then act on the document on its merits
Validity unknown or signer unknown	The checker cannot complete verification, often the chain does not reach a trusted root	Missing root, no network for online checks, unusual certificate profile	Import or trust the right root if you know it; otherwise ask the sender which authority issued the certificate
Document modified after signing	Some content changed after the signature was applied	Later edits, added pages, form fills or annotations	Identify what changed and which revision each signature covers before relying on it
Certificate expired	The certificate's validity period has ended	Time passed; certificates carry fixed validity windows and are reissued rather than extended	Check whether a trusted timestamp shows signing happened inside the validity period
Certificate revoked or signature invalid	The issuing authority cancelled the certificate, or the cryptographic check failed	Key compromise, certificate mis-issuance, tampering or corruption	Treat with serious caution; confirm through the issuer or sender through another channel

Expired needs one careful question

Expiry is the result people misread most. A certificate valid from March to March is expired today if you read it in June. But if the PDF carries a trusted timestamp proving signing happened in April of the first year, then at the moment of signing the certificate was current, and standards for long-term validation exist precisely to make that distinction checkable. ETSI's PAdES baseline profiles define the levels that add a trusted timestamp and then embedded validation data such as certificates and revocation information, so a checker can reconstruct the situation at signing time rather than only at opening time.

So when you see "expired", ask: expired when checked, or expired when signed? Those are different findings with different consequences.

Unknown signer is about your trust list

When a checker says the signer or validity is unknown, it usually means it cannot build a chain from the signer's certificate to any root it trusts. Your software's trusted roots are a policy choice, not a universal truth. In India, digital signature certificates are issued by Certifying Authorities licensed by the Controller of Certifying Authorities, whose list is published on the CCA site. If a certificate was issued under a CA your tool does not know, the signature can be entirely sound and still show as unverified on your device. The cure is to confirm which authority issued the certificate and decide whether to trust that authority, not to assume fraud.

Modified does not always mean malicious

PDFs are designed so later parties can add signatures and permitted changes as new revisions. A result saying content changed after signing might mean someone replaced a clause, or it might mean a second signatory countersigned on top. What matters is which revision each signature covers and what the change was. A good checker shows you the difference; a poor one leaves you guessing.

The line between technical and legal

Say this clearly: a signature state is a technical finding. A valid signature proves the signed bytes are intact and were signed with a key tied to a certificate. It does not prove the signer had authority, that the statements are true, that the document binds anyone, or that a court will treat it a particular way. Conversely, an unknown-signer result can be a missing trust setting rather than a problem with the document. Where money, property or compliance follows from the document, take the verification record to someone qualified to advise on the decision; the checker's job is to give you facts, not verdicts.

A checker that spells out what it checked

SureSign, our free app, exists for this exact confusion. Its App Store listing says it helps "you understand what was actually checked in a digitally signed PDF, in plain language, before you rely on it", checking signature integrity, signer and certificate facts and giving a trust summary, with batch checks, CSV export and saved reports. The listing states core features require no account, there are no ads, analytics, advertising identifiers or tracking SDKs, reports stay on device, and verification uploads are discarded unless saved to Vault. SureSign is available on iOS. Android is in controlled testing.

Frequently asked questions

Can a signature be valid while the signer is unknown?

Yes. Integrity can pass while the chain cannot be completed to a root your tool trusts. These are two separate questions and good tools report them separately.

If the certificate expired, is the document useless?

Not necessarily. If a trusted timestamp shows signing occurred inside the validity period and validation data is embedded, long-term validation may still succeed. Ask when it expired relative to signing.

Does "document modified" always mean someone tampered?

No. PDF signing permits later additions as new revisions. Find out what changed and which signature covers which revision.

Who decides the trusted roots?

Your checking software, its vendor, or you, by importing roots. That is why the same file can verify on one device and not another.

Is a revoked certificate the same as an invalid signature?

No. Revocation is the issuer cancelling the certificate; invalid means the cryptographic check itself failed. Both deserve caution, for different reasons.

Does a valid signature prove the named person signed it?

It proves the signing key tied to that certificate was used. How reliably the certificate binds to a real person depends on how the issuing authority verified them.

Last reviewed: 29 August 2026.