“Signature validity is unknown” in Adobe: what it means and how to fix it

What the message means

Adobe Acrobat and Reader run two checks on every digital signature in a PDF. The first compares the signed part of the file with the signature: if one byte in that part changed, the check fails. The second follows the certificate up to its root and asks whether Adobe trusts that root. A signature shows as valid only when both checks pass.

“Signature validity is unknown” usually means the first check passed and the second did not: Adobe has no basis to vouch for the name or email address in the certificate. The bar above the document then says “At least one signature has problems.” That bar sums up every signature in the file, so read the details before you decide anything.

Untrusted identity or changed document: how to tell

1. 1Click Signature Panel in the bar above the document.
2. 2Expand each signature in the list. Adobe checks each one separately.
3. 3Read the lines under each signature. One is about the document, another is about the signer's identity.
4. 4Right-click the signature and choose Show Signature Properties, then Show Signer's Certificate, to see who issued it.

A yellow icon next to a signature means unknown, a red cross means invalid. The exact wording below differs a little between Acrobat versions.

Why it happens with certificates outside AATL and EUTL

Out of the box, Adobe trusts roots from two sources: the Adobe Approved Trust List (AATL) and the EU trusted lists (EUTL). A certificate that leads to a root on one of them passes the identity check on any computer.

Any other root is unknown to Adobe until you add it yourself. That covers internal company CAs, test setups and signing services that run their own certificate authority. The file can be untouched and Adobe will still show the identity as unknown. The warning says nothing about forgery, only that Adobe does not yet know who vouches for this signer.

How to fix it for a SignClearly PDF

SignClearly runs its own certificate authority, which is not on AATL or the EU trusted lists, so Adobe cannot vouch for its certificates until you trust the SignClearly root. Every signed PDF from SignClearly carries a SignClearly platform seal: a digital signature over the final file that shows it has not changed since SignClearly sealed it. The seal stands for the platform, not for a person.

The file also carries the signer's own digital signature, made in their browser with a one-time key. SignClearly's CA issues a certificate for that key, valid for 24 hours and for this one signature. It shows the signer's email address.

If the sender required an ID check, the certificate also shows the name from the signer's ID.

All SignClearly certificates lead to one root, so one import per computer covers every SignClearly PDF.

1. 1Download r1.crt from the verification page. It is named “SignClearly Root CA” and is valid until 28 October 2046.
2. 2Check its SHA-256 fingerprint with one of the commands below and compare it with the published fingerprint, character for character.
3. 3In Adobe, open Preferences → Signatures, go to Trusted Certificates under Identities & Trusted Certificates, import r1.crt and mark it as a trusted root.
4. 4Open the PDF again. The bar should say “Signed and all signatures are valid.”

On a Mac, in Terminal:

On Windows, in Command Prompt:

The published fingerprint of the SignClearly root:

The verification page has the click-by-click steps for Acrobat and Reader.

You can also skip the import. Adobe still checks whether the file changed, and the certificate page at the end of the PDF lists the SHA-256 of the original file and the event log.

When the document itself was modified

If a signature has a red cross and Adobe says the document was altered or corrupted after signing, your file differs from the file that was signed. Importing a root will not change that, and it should not. Common causes:

• Someone edited the PDF and saved it again after signing, even for a small fix.
• The file went through a tool that rewrites PDFs, such as a compressor or “print to PDF”. Some remove the signatures, others break them.
• The download was cut short or the file was damaged.
• Someone changed the content on purpose.

Stop relying on that copy. Ask the sender for the file they downloaded from SignClearly. If you were the signer, download it again from the link in your email: it works for 7 days after signing.

PDFs signed under other private CAs

The same approach works for a PDF from any issuer Adobe does not know. Show Signer's Certificate gives you the chain, with the root and the organization behind it at the top. Get that root from the issuer directly, check its fingerprint against a value they publish or give you through a separate channel, and only then import it.

To accept one signer without trusting everything a CA issues, Adobe can trust a single certificate from the Trust tab of the certificate viewer. This helps little when a service issues a fresh certificate for every signature, as SignClearly does. If the issuer cannot give you a root and a fingerprint to check, treat the identity in the certificate as unconfirmed.

What “valid” means after the fix

Once the root is trusted, “valid” means the file is the one that was signed and its certificates lead to a root you chose to trust. It does not make the signature a qualified electronic signature (QES), and it does not decide whether a given country accepts it for a given document. The guide on SES, AES and QES explains the levels.