Why does my signed PDF say validity unknown?

Two questions, one icon

Every signature check answers at least two separate questions: have the covered bytes changed, and should this certificate be believed. Readers compress both into a single badge, which is why an unfamiliar issuer produces a warning that looks like tampering. Learning to read the panel text rather than the icon resolves most of the anxiety, because the wording almost always distinguishes the two. A document reported as modified is a different situation from one whose signer cannot be identified, and treating them the same wastes time on the first and understates the second.

Why the issuer is often unknown

Trust stores are conservative. Operating systems and readers ship a list of root authorities that meet audit requirements, and plenty of legitimate signing certificates chain to roots outside those lists, including internal corporate authorities and smaller commercial issuers. Some readers also maintain their own list separate from the operating system, so the same file can appear trusted in one application and unknown in another on the same machine. None of that is evidence about the document.

When the warning is worth taking seriously

When the wording says the document has been altered or the signature is invalid. That means the bytes covered by the signature no longer match, which happens when a file has been edited, re-saved by a tool that rewrote its structure, merged with another document, or had pages appended after certification. Innocent causes are common, and so is the other kind. Either way the copy in front of you is not the copy that was signed, and the right response is to ask the sender for the original rather than to trust what you have.

Browsers and email previews

Most in browser viewers and mail client previews do not evaluate signatures at all, so a document that would show a warning in a full reader shows nothing. That is the most common reason somebody insists a file is fine when it is not. Anyone whose job involves receiving signed documents should have a reader that checks signatures and should open anything important in it rather than relying on a preview pane.

What to record when a document is verified

If verification matters for a transaction, note what you saw: the date checked, the reader used, the integrity finding, the issuer and the subject of the certificate. That takes a minute and gives a future colleague something better than a memory. Where a document is being accepted despite an unknown issuer, note the reason for accepting it, since that decision is the kind of thing an auditor asks about years later.

What to expect from documents signed here

The completed PDF is sealed with a PAdES signature from the service's own certificate and certified so that later changes are detectable. Because the certificate belongs to the service, a reader will name the service rather than an individual, and depending on the trust list it may report the issuer as unknown while confirming the document is unchanged. The evidence about who signed lives in the certificate of completion, which is issued as its own file and lists each signer with their verification method, time and address. When a counterparty raises the warning, a short reply usually settles it. Explain that the message concerns the certificate issuer rather than the contents, ask them to confirm what the panel says about modification, and point them at the certificate of completion for the evidence about who signed. If their policy requires a trusted issuer, that is a conversation to have before the next document rather than after this one, since it may mean using a different signing arrangement for that counterparty. Recording the exchange is worthwhile, because the same question tends to arrive from the same organisations each time a new person there receives a signed file. Keeping the reply somewhere shared means the next colleague asked does not have to work it out from scratch. The same holds inside the business, since this warning is almost always the first question a colleague raises the first time they open a signed file in a proper reader.

Questions people ask