PDF Signature Invalid, Unknown or Modified? DSC and eSign Fixes

A signed PDF can fail a signature check for reasons that have nothing to do with forgery. A viewer that doesn't trust India's root, a file re-saved by a phone app, or an eSign certificate that expired minutes after use all produce warnings that look alarming. One message does mean someone changed the file, and it is worth knowing which one.

Start by matching what you see to the table, then go to the section for that message.

Match the message to the cause

Exact wording differs between Adobe Acrobat Reader, browser viewers and phone apps, but each shows some version of these.

"Validity unknown" or a yellow question mark

The file is intact. The viewer checked the signature against the file and it matched, but it couldn't follow the signer's certificate up to a root it trusts. Indian signatures, whether from a DSC (digital signature certificate) issued by eMudhra or another licensed CA, from UIDAI or from Aadhaar eSign, chain to a root run by the Controller of Certifying Authorities (CCA), which many viewers don't include. How digital signatures work in India explains that chain.

Two fixes:

1. Check it in a tool that carries the CCA roots. The PDF signature verifier checks the chain in your browser. The file isn't uploaded; the issuing authorities' public certificates are fetched through our server to complete the chain. For e-Aadhaar, use the e-Aadhaar verifier. The full explanation for e-Aadhaar is in the yellow question mark guide.
2. Trust the CCA root in Adobe Acrobat Reader on a computer. Right-click the signature and choose Validate Signature, or open Signature Properties. On the Signer tab, choose Show Certificate (or Show Signer's Certificate). The certificate viewer lists the chain on the left; select the top entry, a "CCA India" root. On the Trust tab, choose Add to Trusted Certificates, tick the option to use it as a trusted root, confirm, and then Validate Signature again. Before trusting a root, compare it with the one published on cca.gov.in.

Some official guides tell you to trust the signer's own certificate instead. That works for that one document but has to be repeated for every signer, and it trusts the signer without checking who issued its certificate.

"Signature is valid, but the document was changed"

A PDF can be signed more than once, and some changes after signing are allowed: filling a form field, adding a comment or a second signature. Each change is saved as an addition on top of the signed version, so the signed version is still intact. Viewers usually let you open "the signed version" to see exactly what was signed.

What to do: open the signed version and compare. If the change was a second signature or a filled-in field you expected, the document is fine. If the visible page differs from the signed version in a figure or name, rely on the signed version and ask the sender why.

"The signer's certificate has expired"

Certificates expire: a DSC after its validity period, the CCA's own 2014 root on 5 March 2024, and an Aadhaar eSign certificate almost at once, because eSign issues a short-validity certificate for a single signing. What matters is whether the certificate was valid when the document was signed.

• In Adobe Acrobat Reader, open the signature preferences (Preferences > Signatures > Verification, then More) and set signatures to be verified at the time the signature was created. Then validate again.
• If the signature carries a timestamp from a timestamp authority, the signing time is trusted. If not, the viewer shows the signer's own clock, and says so.

An eSigned agreement from 2024 that shows "expired" today is usually fine. One signed with a certificate that had already expired on the signing date is not.

"Revocation could not be checked"

A full check asks the CA whether the certificate was cancelled before the signing date. If the viewer is offline or the CA's service doesn't respond, it says it couldn't check. Try again online. Our checker confirms integrity and the chain to the CCA root but doesn't query revocation, so for a high-stakes document where revocation matters, check it in a desktop reader as well.

"Document altered or corrupted since it was signed"

This one matters. The bytes that were signed no longer match. Either someone edited the file, or a program rewrote it. Common innocent rewrites:

• Opening and saving the PDF in a viewer or editor that rewrites the whole file, such as some built-in preview apps
• Compressing it, merging it with other PDFs or adding a page
• Removing the password by saving an unlocked copy
• Converting it to another format and back

What to do:

1. Go back to the source: re-download e-Aadhaar from UIDAI, Form 16 from your employer (who downloads it from TRACES), an income tax document from the e-filing portal, or ask the sender for the original file.
2. Check the fresh copy before opening it in any other app.
3. If a fresh copy from the source is valid and the one you were given isn't, the copy you were given was altered after signing. Don't rely on it. For a Form 16, the TRACES and AIS checks test the figures even when the signature can't be relied on.

"No signature" on a print or a phone

A printout, a screenshot, a scan or a "Print to PDF" copy has no digital signature. It is an image of the page, including any "Signature Not Verified" box drawn on it. Some phone viewers also don't show signatures even when they're there. Check the original file in a tool that reads signatures.

A print-ready copy from the e-Aadhaar verifier or the PDF signature verifier carries a "signature valid" mark, but it is a flattened copy without the original signature. It is a convenience printout, not something any authority has agreed to accept, so where a signed document is required, hand over the original PDF.

If you are the signer: DSC and eSign checks

• Check the certificate's dates before signing. An expired DSC on a USB token produces signatures that fail.
• Use the original file to sign. Signing a PDF that already carries someone else's signature in a way that rewrites it can break theirs.
• Sign last. Fill fields, add pages and merge before signing, not after.
• For Aadhaar eSign, the certificate name comes from your Aadhaar record. A name spelt differently from the document's party name is a mismatch the reader will notice.

Frequently asked questions

Does a yellow question mark mean the PDF is fake?

No. It means the viewer couldn't confirm who signed it because it doesn't trust the CCA root. The file itself matched its signature.

Why does my eMudhra-signed document show "unknown" on one computer and "valid" on another?

The second computer's reader trusts the CCA root, or the user added it. The document is the same.

Can I fix an "altered" signature?

No. A broken signature can't be repaired. Get a fresh copy from the source and keep it unopened in other editors.

Is an eSign certificate that expired the same day a problem?

No. eSign certificates are short-lived by design. What matters is that the certificate was valid when the document was signed.

Why did removing the password break the signature?

Saving an unlocked copy rewrites the file, so the signed bytes change. Keep the original password-protected file and check that one.

Sources

• Controller of Certifying Authorities: root certificates
• Controller of Certifying Authorities: eSign
• Controller of Certifying Authorities: licensed CAs
• Maharashtra State Board: steps to validate a digital signature (Adobe Reader)