How to Verify a PDF Signature (And What 'Validity Unknown' Means)

You open a signed PDF and the reader greets you with a yellow question mark: "Validity unknown." Before assuming fraud — or worse, assuming safety — it's worth knowing that a signature panel reports two different judgments, and only one of them is about tampering.

The two questions a verifier answers

1. Integrity. Have the signed bytes changed since signing? Pure mathematics: recompute the digest, compare with the value locked in the signature. Pass/fail, no opinions.
2. Identity / trust. Should this reader believe the signing certificate is who it claims? The reader consults trust lists — roots it ships with or you've added (Adobe's AATL is the best-known example). This judgment varies by machine and configuration.

"Validity unknown" almost always means: integrity passed, trust unresolved. The document is unchanged; the reader just can't vouch for the issuer.

Reading the status icons

Readers encode the states similarly (Acrobat Reader's convention):

• Green check — intact and the certificate chains to a trusted root. Both judgments pass.
• Yellow question mark ("Validity Unknown / Signature not verified") — intact, unknown issuer. Trust question, not tampering.
• Red cross / "document has been modified" — integrity failure: the bytes changed after signing, or the signature data is malformed. This is the only state that means the content is not what was signed (what breaks signatures).

How to verify, step by step (Acrobat Reader, free)

1. Open the PDF and the Signatures panel (fountain-pen icon in the left pane, or the signature bar's Signature Panel button).
2. Expand the signature entry and let validation run (right-click → Validate Signature forces a fresh check).
3. For the full picture: right-click → Show Signature Properties… → the signer's certificate, its issuing chain, timestamps, and revocation checks.
4. Decide the trust question separately (below).

Browser preview panes and many mobile viewers show weak or no signature status — verify in a real reader before making decisions.

The trust decision (a real decision)

If status is "unknown", you can tell the reader to trust the signer's certificate (Show Signer's Certificate… → Trust → Add to Trusted Certificates in Acrobat). Do that only when you can attribute the certificate:

• Reasonable: a government agency's signed notice you requested yourself; your organization's own CA; a counterparty whose certificate fingerprint you've verified out of band.
• Not reasonable: silencing a warning on an unexpected attachment from an unknown sender.

Trust lists are per-machine: adding a certificate changes what you see. If you must demonstrate a document's status to someone else, the portable answer is the signature panel evidence (or an independent validation report), not "it shows green on my laptop."

Why so many genuine documents show "unknown"

Certificate hierarchies differ by country and industry. Documents signed under national PKI schemes (and anything self-signed) frequently sit outside the major vendors' default trust lists — the signature is intact and the document genuine. This split between valid and trusted is exactly what the digital vs electronic signature distinction predicts: the math is universal; trust is local policy.