Signatures explained
What long term validation means for a PDF signature
In short
Long term validation stores certificate and revocation evidence with a signed PDF so later checks depend less on outside records. A trusted signature timestamp provides a reference time. LTV is an evidence package, not a guarantee that every reader or future policy will accept the signature.
What evidence does LTV preserve?
A later checker needs to establish which key signed, how the signer certificate connects to an issuer, and what was known about revocation at the relevant time. Certificates alone answer only part of that. A certificate can be revoked before its scheduled expiry, so an issuer's signed status response or revocation list matters too.
The PDF can store this material in a Document Security Store. Think of it as the supporting record that travels with the signature. The record still needs cryptographic checks and an accepted trust policy. A folder full of certificates, without the relevant status evidence, is not equivalent to completed validation material.
How is a timestamp different?
A trusted signature timestamp binds independent time evidence to the signature value. It helps establish that the signature existed at that time. The signer's claimed date is useful context but is not independent evidence: a computer clock can be wrong.
LTV preserves the validation material around that time evidence. These roles explain the order of the options in Digital Signature. First create the signature, then obtain its timestamp, then collect and embed the evidence. The trusted timestamp explanation covers the time mechanism in more detail.
What did our evidence test add?
We signed the same 870 byte sample agreement twice with KovaPDF's signing engine. Without timestamp or LTV it produced 18,460 bytes and reported PAdES B B. With a locally generated timestamp and signed status responses, the output was 49,374 bytes and reported PAdES B LT, with LTV marked complete.
This was a controlled test with a private test issuer and timestamp authority. It exercised the actual signing and checking code without claiming public trust for those fixtures. The added 30,914 bytes in this run bought supporting evidence, not extra pages or a more decorative stamp. Real certificate chains and responses have different sizes.
Which PAdES level should I look for?
| Level | What the level contributes |
|---|---|
| B B | Basic signature structure |
| B T | Signature timestamp |
| B LT | Embedded validation material in addition to time evidence |
| B LTA | Further document timestamp protecting the accumulated evidence |
The output's achieved level matters more than a box you selected before processing. In Verify PDF Signature, inspect the timestamp and long term validation results independently. A valid timestamp with incomplete revocation evidence has not achieved the same result as a complete evidence package.
Why might LTV be incomplete?
An issuer may publish no usable status endpoint. A status request can fail, a chain can be incomplete, or a returned answer may not cover the certificate that needs checking. A self issued identity often has no external revocation record to collect. None of those gaps should be hidden behind the fact that the PDF still has a signature.
Preserve the reported reason. If an issuer record cannot be obtained, ask the issuer or the receiving organisation how they handle that case. Do not describe an incomplete result as archival proof just because the visible stamp looks the same.
Is this the fix for an expired certificate warning?
For a new document that may be needed years later, collecting evidence while the relevant records are available is useful. For an already signed document, first establish what evidence is actually there. LTV does not move the old certificate's validity dates or manufacture an independent signing time after the event.
Use the expired certificate decision guide for that diagnosis. If the question is why an intact file has an unknown issuer, read what a digital certificate proves. Expiry, missing historical evidence and missing trust are separate findings, even when one document has all three.
Common questions
What does long term validation store?
It stores certificates and signed revocation evidence needed to support later checks of the signature and its timestamp.
Does LTV extend a certificate expiry date?
No. It preserves evidence about a signature. The certificate keeps its original validity interval.
Why does LTV need time evidence?
A trusted timestamp establishes a reference time independently of the signer clock. The surrounding validation material supports checking at that time.
Does selecting LTV guarantee completion?
No. The issuer chain or status evidence may be unavailable or unusable. Check the achieved output level and reported reasons.
Does LTV make a private test issuer publicly trusted?
No. Embedded evidence and accepted issuer trust are distinct requirements.
Is LTV the same as an archive timestamp?
No. An archive timestamp protects the accumulated document and validation evidence as an additional preservation step.
KovaPDF on your computer and phone
Use KovaPDF on your computer, where many tools work with no internet, and on your phone. The same account works in both.