Verifying signed PDFs
Signed PDF certificate expired: is the old signature still valid?
In short
An expired certificate warning does not by itself show that an old PDF signature is invalid. Check whether the signature existed while the certificate was valid, whether the signed bytes match, and what revocation and trust evidence supports that time. Without enough evidence, the honest result may remain unknown.
What should I preserve first?
Save the original received PDF before trying any fix. Keep the message or submission record it arrived with. Work on a copy when checking it. Printing, rescanning, compressing or adding a new stamp changes the file you are investigating and can discard evidence.
Open the original in Verify PDF Signature. Record which signature has the warning if several people signed. A later signer and an earlier signer can have different certificates, dates and results within the same PDF.
Was the certificate valid when the signature existed?
Read the certificate's valid from and valid until dates. Then distinguish the claimed signing date from a trusted timestamp. A date in a visible signature appearance is just page content. A date supplied by the signer does not independently prove that the signature existed before expiry.
A trusted signature timestamp can supply that missing reference time if its own signature, issuer and certificate checks hold. If the timestamp was made after the signer certificate expired, it does not establish that the document was signed before expiry. Do not move a computer clock backward or type an earlier date onto the page.
What happened in our later check?
We created a sample certificate that expired 30 days after our test, signed a one page agreement with a trusted test timestamp and complete validation evidence, then ran KovaPDF's verifier with its checking date 60 days after signing. The certificate was past expiry at that simulated date.
The output still reported a valid cryptographic signature, a valid timestamp and complete LTV. It reported that the signer certificate was not expired at signing. These are controlled test results with private test authorities, not a legal judgment or a claim that an arbitrary issuer will be accepted. They demonstrate why a checker must distinguish the reference time from today's date.
Could the certificate have been revoked?
Yes. Expiry is scheduled; revocation can happen earlier. A certificate that was cancelled before the relevant signature time raises a different issue from one that simply reached its end date later. Read the revocation row and its timing rather than treating an unavailable status service as an affirmative good result.
If the PDF contains signed historical status evidence, the checker can inspect it. If it has to contact a service that no longer exists, the result may be indeterminate. Ask the sender for the original evidence package or the receiving organisation for its validation process. A fresh certificate does not replace evidence about an old one.
Did the document change after signing?
Check the digest and the revision covered by the signature. A certificate can have been valid at signing while the document was subsequently changed. Some later updates, such as another signature or added validation data, may be expected. Other changes can alter what the person approved.
Review the reported changes and permitted modifications. The question is not only whether a signature exists, but which version of the document it protects. Keep the complete original bytes so the verifier can inspect earlier revisions.
What can I ask the sender for?
Ask for the original signed PDF, the validation report, the claimed signing date and any independent timestamp or retained status evidence. If you must request a newly signed document, label it as a new signing event. Do not describe it as proof of the earlier event.
For future documents, how long term validation packages the evidence explains what to collect while the records are available. For a password or file input problem before signing, use the PFX and P12 guide. Those file errors cannot explain or repair a historical expiry warning.
Common questions
Does certificate expiry automatically invalidate an old signature?
No. The outcome depends on evidence of signing time, document integrity, revocation and accepted trust policy.
Is the date printed in the signature enough?
No. Visible text and a signer supplied clock are not independent evidence that a signature existed before expiry.
Can I repair the evidence by changing my computer clock?
No. A changed local clock does not create a trusted historical timestamp.
What does an unavailable revocation service prove?
It may leave a gap in the evidence. Unavailable does not mean the certificate was not revoked.
Should I compress the PDF before checking?
Check and preserve the original first. Rewriting the PDF can discard signature structures or alter the bytes under investigation.
Will renewing the certificate fix the old PDF?
Renewal gives credentials for a new signing event. It does not retroactively replace the evidence for the old signature.
KovaPDF on your computer and phone
Use KovaPDF on your computer, where many tools work with no internet, and on your phone. The same account works in both.