Why does my PDF signature say “invalid” or “unknown”?

If Acrobat says “At least one signature has problems”

That blue bar at the top of Acrobat and Acrobat Reader is a summary: at least one signature in the file isn’t plainly valid. It doesn’t say why. The same goes for “Signature validity is UNKNOWN” in the signatures panel. Both can mean a changed document or, just as often, a certificate your copy of Acrobat doesn’t know. Click the signature in the Signatures panel and read its details, then find the matching row below.

What the statuses mean

Validators check two separate things: whether the signed bytes are unchanged (integrity), and whether the certificate is one they trust (identity). The message you see combines both.

The six usual causes

1. The file was rewritten after signing

The most common one. A PDF signature covers exact bytes. If the document was saved by an app that rebuilds the whole file, the signed bytes change even if the page looks the same. In our test of November 4, 2026, filling one field and saving in Preview on a Mac was enough. Compressing, flattening, printing to PDF and converting to PDF/A all have the same effect.

Fix: go back to the copy you received, make your changes in an app that saves incrementally, and check again. If there’s no clean copy left, the signer has to sign again. See how to sign a signed PDF without breaking it.

2. Your software doesn’t trust the certificate

Company certificates, national ID certificates and certificates from smaller authorities often aren’t in the default trust list of your software. The signature can be perfect and still show as “unknown”.

Fix: in Acrobat or Reader, look at the signature properties and the certificate’s issuer. Acrobat can load two trust lists in Preferences › Trust Manager: the Adobe Approved Trust List (“Load trusted certificates from an Adobe AATL server”) and the European Union Trusted Lists, for EU qualified certificates. Adobe notes that the EU list in Acrobat is a local copy refreshed about once a month, so a new provider can take up to some 30 days to show as trusted. Only trust a certificate by hand if you know where it came from. To check a signature again from scratch, see how to verify a PDF signature.

3. The certificate couldn’t be checked for revocation

Validators may ask the issuer whether the certificate was revoked. Offline, or when the issuer’s server doesn’t answer, the status can stay unknown. Long-term signatures (PAdES-LT and LTA) include this revocation data inside the PDF so the check works years later without a connection.

4. The certificate had expired or was revoked when it was used

If the signer’s certificate had already expired, or had been revoked, the signature is invalid on the identity side. A trusted timestamp proves when the signature was made, which is what lets a signature made with a then-valid certificate stay valid after that certificate expires.

5. It isn’t a digital signature at all

A drawn or typed signature placed on the page is an image or an annotation. Validators don’t list it as a signature, and some tools then complain that the document “isn’t signed”. That’s expected; it was never a certificate signature.

6. The signature itself is damaged

Rarely, a file is cut short in transfer, or a tool writes a broken signature. The validator then reports an error reading the signature. Ask for the file again, preferably not through a service that “optimizes” attachments.

How to see which cause it is

1. Open the signature panel and click the signature for its details.
2. If it mentions the document being modified or altered, it’s an integrity problem (cause 1 or 6).
3. If it mentions the signer’s identity, the issuer or revocation, it’s an identity problem (causes 2 to 4). The document itself is usually fine.
4. Look at the signing time and whether a timestamp is included.