“Signature Validity Is Unknown” in Adobe: Causes and Solutions

Why a signed PDF document shows a yellow warning (validity unknown) or a red cross (invalid) in Adobe Acrobat and Adobe Reader, what each color really means, and how to make the signature appear as valid. No technical knowledge needed.

Who is this guide for?

• The people who receive signed documents and want to know whether they can rely on them: sections 1, 2 and 4 to 10.
• The people who sign documents and whose recipients see a yellow or a red signature: sections 2, 3 and 10 explain which certificate to use and what to avoid after signing.
• IT administrators who must configure many computers: sections 5 and 6.

Useful links

1. Green, yellow or red: what Adobe tells you

When you open a signed document, Adobe checks every signature and shows the result in the blue message bar above the document and in the Signatures panel. There are four results:

The texts are those of Adobe; the colors and the icons are simplified and can look slightly different in your version.

Where to read the details

1. Open the Signatures panel. Click Signature Panel in the blue message bar (in the new interface of Acrobat you can also click the signature on the page).
2. Open the properties of the signature. Right-click the signature in the panel and choose Show Signature Properties....
3. Read the Validity Summary. Each line has its own icon. The line about the document tells you whether the content was changed; the line about the signer's identity tells you whether Adobe trusts the certificate.

2. Yellow: the certificate, not the software

Many signers think that a yellow signature means that the signing program made a mistake, and many recipients think that their Adobe Reader is not set up correctly. Neither is true. This section explains why.

2.1 Two separate checks

Adobe answers two different questions for every signature:

The signing program takes part only in the first check: it computes the fingerprint and puts it, together with the certificate, in the signature. It cannot take part in the second check: no program can make Adobe trust a certification authority.

2.2 The chain of trust

A certificate is like an identity card: it is believable because of the authority that issued it. The signer's certificate is issued by a certification authority (often by an intermediate authority), which in turn is certified by a root authority. The root certificate is signed by itself, so it is trusted only if the program that checks the signature already has it in its list.

2.3 Where Adobe looks for trusted authorities

Adobe does not use the list of authorities of Windows by default. It keeps its own lists:

• the Adobe Approved Trust List (AATL), with the certification authorities from all over the world that Adobe has checked;
• the European Union Trusted Lists (EUTL), with the qualified trust service providers of the eIDAS Regulation;
• the Trusted Certificates (named Trusted Identities in the older versions), which the user of the computer adds by hand.

This is why the same certificate can look perfect in Windows (the Windows certificate window says This certificate is OK) and still be yellow in Adobe: Windows trusts many authorities, for example those of the web sites, which are not in the lists of Adobe. Windows and Adobe use different lists and different rules.

2.4 A simple test that proves it

If you need to convince a recipient, or yourself, that the problem comes from the certificate and not from the software, any of these tests is enough:

1. Read what Adobe says. The message is The signer's identity is unknown because it has not been included in your list of trusted identities and none of its parent certificates are trusted identities. It speaks about the certificate and its parents (the authorities), not about the program that signed.
2. Sign the same document in Adobe Acrobat itself, with the same certificate. The result is exactly the same yellow signature, although Adobe created it.
3. Trust the root certificate on your computer (section 4) and open the same file again. Nothing in the file changed, but the signature becomes green. If the color depended on the signing program, it could not change without signing again.
4. Sign with a certificate from an AATL member or with a qualified certificate (section 3). With the same program, the signature is green on every computer, without any setting.

3. Certificates that Adobe trusts by default

The permanent solution, the one that makes the signature green on every computer without any setting, is to sign with a certificate whose root is in one of the lists that Adobe downloads automatically. This is a choice of the signer, made when the certificate is bought.

European Union Trusted Lists (EUTL)

If the certificate is a qualified certificate for electronic signatures or seals, issued by a qualified trust service provider listed in the EU Trusted Lists, Adobe shows the signature as valid and says where the trust comes from. A qualified signature is also marked as such:

Adobe Approved Trust List (AATL)

The AATL is the program of Adobe for the certification authorities all over the world. Its members issue document signing certificates that Adobe trusts automatically; their private key is kept on a hardware device (a USB token, a smart card or an HSM) or in a remote signing service. The list of members is published by Adobe: AATL members. Ask the provider explicitly for an AATL document signing certificate. (The older Adobe program, CDS, was replaced by AATL.)

Keep the trusted lists up to date

Adobe downloads the AATL and the EUTL from its servers. On a computer that is offline, or where the updates were turned off, even a certificate from these lists can be shown as yellow. To update the lists:

1. Open the preferences. In the new Adobe Acrobat choose Menu → Preferences...; in the older versions Edit → Preferences... (or press Ctrl+K).
2. Select Trust Manager. In the list Categories, select Trust Manager.
3. Update both lists. Under Automatic Adobe Approved Trust List (AATL) updates and under Automatic European Union Trusted Lists (EUTL) updates, keep the option Load trusted certificates from an Adobe ... server ticked and click Update Now. Then open the document again.

4. Solution 1: trust the root certificate in Adobe

When the signer's certificate is not in the lists of Adobe, the person who checks the document can tell Adobe to trust the root authority of the certificate. This is done once per computer: after that, all the signatures made with certificates of the same authority are green on that computer. The signed document is not changed.

1. Open the properties of the signature. In the Signatures panel, right-click the signature and choose Show Signature Properties.... The tab Signer explains the problem: the certificate was not issued by an authority that you have trusted.
2. Open the certificate. Click Show Signer's Certificate... (in the older versions Show Certificate...). The Certificate Viewer opens.
3. Select the root certificate. In the list on the left, click the topmost certificate of the chain: the root authority, not the signer's certificate.
4. Add it to the trusted certificates. Open the tab Trust and click Add To Trusted Certificates... (in the older versions Add to Trusted Identities...). If Adobe shows a security question, click OK.
5. Set the trust. In the window Import Contact Settings, tick Use this certificate as a trusted root and Certified documents. The other three options (dynamic content, JavaScript, privileged system operations) are not needed to validate signatures; tick them only if you need to run such content in the documents certified by this authority. Click OK.
6. Validate again. Close the windows and click Validate All in the Signatures panel, or close the document and open it again. The signature is now green.

5. Solution 2: use the Windows certificate store

Use this method when the root certificate of the signer's authority is already installed in Windows, in Trusted Root Certification Authorities. This is common in companies, where the IT department installs the root of the company's authority on all the computers, and with some smart cards and tokens, whose software installs the roots of the provider. Adobe can be told to trust the roots of Windows too.

Check that the root is installed in Windows

1. Open the certificate manager. Press Windows+R, type certmgr.msc and press Enter.
2. Look for the root. Open Trusted Root Certification Authorities → Certificates and look for the name of the authority (the Issued To column).
3. Import it, if it is missing. Right-click Certificates → All Tasks → Import... and select the root certificate file (.cer or .crt) that you received from the authority or from your IT department. Windows asks for a confirmation before it adds a root.

Tell Adobe to use the roots of Windows

1. Open the preferences. Menu → Preferences... (older versions: Edit → Preferences...), or Ctrl+K.
2. Open the verification settings. Select Signatures, and in the section Verification click More.... (In Adobe Reader XI and older: Security → Advanced Preferences... → tab Windows Integration, as in the picture.)
3. Turn on Windows Integration. Under Windows Integration, Trust ALL root certificates in the Windows Certificate Store for the following operations, tick Validating signatures and Validating certified documents. Click OK.
4. Open the document again. The signature is now green.

6. Solution 3: one file for all the computers (FDF)

When many people must validate the signatures of the same authority, you do not need to repeat section 4 on every computer. Export the root certificate once, as an Adobe FDF file (Acrobat Forms Data Format), and send it to the recipients, or install it with the tools of your IT department.

Export the root certificate

1. Open the certificate viewer. In the properties of the signature, click Show Signer's Certificate... and select the root certificate at the top of the chain (not the signer's certificate).
2. Export. In the tab Summary, click Export....
3. Choose the FDF format. Select Save the exported data to a file and Acrobat FDF Data Exchange, then click Next through the steps.
4. Save the file. Choose where to save it and click Finish.

Import the FDF file on another computer

Before the import, the signature is yellow on that computer:

1. Open the FDF file. Double-click it: Adobe opens the window Data Exchange File - Import Contact.
2. Set the trust. Click Set Contact Trust..., tick Use this certificate as a trusted root and Certified documents (as in section 4), and click OK.
3. Finish the import. Adobe confirms that the certificate was imported. Open the signed document again: it is green.

7. Time stamps that are not trusted

A time stamp proves when a document was signed. It is a separate signature, made by a Time Stamp Authority (TSA) with its own certificate. The same rule applies to it: if the root of the certificate of the TSA is not trusted in Adobe, Adobe cannot verify the time stamp and says The signature includes an embedded timestamp but it could not be verified. The signature itself can be valid.

1. Open the tab Date/Time. In the properties of the signature, open the tab Date/Time. It shows the Timestamp Authority.
2. Open the certificate of the TSA. Click Show Certificate... and select the topmost certificate of its chain.
3. Trust it. Tab Trust → Add To Trusted Certificates..., tick Use this certificate as a trusted root and click OK.
4. Validate again. Close the windows and open the document again. Adobe now shows the time of the time stamp.

8. Revocation information that cannot be checked

A certificate can be cancelled (revoked) by its authority before it expires, for example when a token is lost. To know whether the certificate was revoked, Adobe asks the authority over the Internet, through OCSP (an online answer about one certificate) or CRL (a list of the revoked certificates). If the answer cannot be obtained, Adobe cannot confirm the identity, even when the certificate is trusted and the document is intact.

Typical messages: Revocation checking was not performed, The signer's identity was valid when it was issued, but no revocation checks could be made to validate the identity at this time, or Problem determining whether the selected certificate is valid.

What to do

1. Check the connection. The computer must reach the OCSP and CRL addresses of the authority (they are written in the certificate, tab Details). Adobe uses the proxy settings of Windows: Preferences → Internet → Internet Settings. A firewall or a proxy that requires a password can block these requests.
2. Ask the signer for a long-term signature. A long-term (LTV) signature, PAdES-B-LT or PAdES-B-LTA, contains the revocation answers obtained at the moment of signing, so Adobe does not need to go on the Internet, also years later. This depends on the format of the signature and on the authority, which must provide the OCSP or CRL answers.
3. Check the verification settings. Open Preferences → Signatures → Verification → More... (older versions: Security → Advanced Preferences... → Verification):
   • Require certificate revocation checking to succeed whenever possible during signature verification: when it is ticked, a revocation check that cannot be made turns the signature yellow. Untick it if you cannot reach the servers of the authority.
   • Ignore document validation information: when it is ticked, Adobe ignores the revocation data stored in the document (LTV). Leave it unticked; tick it only when the data stored in the document is damaged, as in the CRL error above, so that Adobe asks the authority on line.
4. Validate again. Click Validate All in the Signatures panel or open the document again.

9. Other reasons for a yellow signature

The certificate has expired

Every certificate has an end date. A signature made while the certificate was valid stays good, but Adobe must be able to prove when it was made. If the signature has no trusted time stamp, the only time available is the clock of the signer's computer (Signing time is from the clock on the signer's computer), and after the certificate expires Adobe may report the signature as a problem.

• The signer: use a signature with a trusted time stamp, and preferably a long-term signature (PAdES-B-LT or B-LTA), for documents that must be checked after the certificate expires. Renew the certificate before it expires.
• The recipient: in Preferences → Signatures → Verification → More..., under Verification Time, choose Secure time (timestamp) embedded in the signature, so that Adobe checks the certificate at the time proved by the time stamp.

The chain of the certificate is incomplete

Adobe must find every certificate between the signer and the root. If an intermediate certificate of the authority is missing, Adobe cannot build the path and the identity stays unknown, even when the root is trusted. The signature can contain only the certificates that are installed on the signing computer, so the intermediate certificates of the authority must be installed there. They are usually installed by the software of the token or smart card, or can be downloaded from the site of the authority. The recipient can also import the intermediate certificate as in section 6.

The document was changed after the signature, but the change is allowed

Some changes after a signature are allowed: filling in a form field, adding a comment, adding another signature. When such a change is not signed (for example, a form field filled in after the last signature), Adobe marks the signature with a yellow warning, so that you look at what changed. In the Signatures panel, use View Signed Version to see the document exactly as it was signed, and compare it with the current one. If the change is expected, there is nothing to repair; to avoid the warning, sign the document after all the fields are filled in.

10. Red: the signature is invalid

A red cross is different from the yellow warning: it is not about trust, it means that the check of the document or of the certificate failed. A red signature cannot be repaired by changing settings in Adobe, and it must not be ignored. It is, in fact, the proof that the digital signature does its job: it detected something.

10.1 The document was changed after signing

Adobe says Signature is INVALID and The document has been altered or corrupted since the signature was applied. The bytes of the document are not the ones that were signed. The usual causes:

• the signed file was opened and saved again by a program that rewrites the whole PDF instead of adding the changes at the end: online PDF converters and compressors, Print to PDF, Save As with a reduction of the file size, merging or splitting tools, OCR, adding a watermark, a header or page numbers, flattening the form fields, removing pages;
• a system processed the file after signing: a document management system, an archive that converts to PDF/A, an e-mail gateway or a scanner workflow that “optimizes” the PDF documents;
• the file was damaged during the transfer: an incomplete download, an FTP transfer in text (ASCII) mode, a program that changed the encoding of the file;
• the document was signed too early, and the last corrections were made after the signature.

The changes that the PDF standard allows (more signatures, form filling, comments, saved as incremental updates at the end of the file) do not make the earlier signatures invalid.

What to do

1. See what was signed. In the Signatures panel, click View Signed Version (in the older versions Click to view this version) to see the document as it was when signed.
2. Get the original signed file. Ask the signer for the file exactly as it was signed, sent as an attachment or as a download, not processed by another system. Compare the size of the two files.
3. Sign again, as the last step. A broken signature cannot be repaired: the signer must sign the final version again. Make all the changes before signing, and after signing do not open and save the file in programs that rewrite it.

10.2 Certified, then signed again: the certification is lost

A certifying signature is the signature of the author of a document. It must be the first signature of the document, and it sets which changes are still allowed afterwards. Adobe offers three levels when a document is certified:

The most frequent case: the author certifies the document with No changes allowed and sends it to other people, who sign it too. The new signature is a change that the author did not allow, so Adobe shows the certification as invalid (the blue ribbon with a red mark), although the new signature itself may be correct. Adobe can prevent the signing of such a document, but other programs, and other ways of signing, cannot know that the author wanted to forbid it.

What to do

1. Go back to the original document. A lost certification cannot be restored in the same file. Start again from the document before the certification.
2. Certify with the right level, first. If other people must sign after you, certify with Form fill-in and digital signatures (or with Annotations, form fill-in, and digital signatures if they must also add comments). Use No changes allowed only for the last, final version that nobody else signs.
3. Or do not certify at all. If you only want to sign, use a normal (approval) signature. Certification is for the author of a document that others will complete or sign, not for every signature.
4. Let the others sign in order. After the certification, the other people sign one after another; each new signature keeps the earlier ones valid.

10.3 The certificate was revoked

If the authority revoked the signer's certificate before the document was signed (because the token was lost, the data of the person changed, or the person left the company), Adobe shows the signature as invalid. The revocation is decided by the certification authority, not by any program. The signer must obtain a new certificate and sign the document again.

A certificate revoked after the signing does not make the earlier signatures invalid, as long as a trusted time stamp, or the revocation data stored in a long-term signature, proves that the document was signed before the revocation.

11. Problems and solutions

12. Glossary

13. Warning and disclaimer, trademarks

Every effort has been made to make this guide as complete and accurate as possible, but no warranty or fitness is implied. The information provided is on an “as is” basis. The author shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this guide. Changing the trust and verification settings of a program is the decision of its user; trust only the authorities you know.

Adobe, Acrobat and Reader are either registered trademarks or trademarks of Adobe Inc. Windows is a trademark of Microsoft Corporation. All other trademarks are the property of their respective owners.