How to Fix Timestamped PDF Signature Validity Unknown
Question details
The user needs to understand why an earlier timestamped PDF signature displays 'Validity Unknown' and how to validate it properly using the signing-time timestamp.
- Product
- Device & OS
- not provided
- Scenario
- Verifying multiple digital signatures in a single PDF document over a period of time.
- Observed behavior
- The newer signature is valid, but the earlier timestamped signature shows 'Validity Unknown' because the certificate chain is no longer time-valid.
Ensure you have the latest version of your PDF reader installed and that you have an active internet connection to retrieve certificate revocation lists if needed.
Enable Long-Term Validation (LTV) and Secure Timestamping
Properly configure your PDF reader to validate signatures using the secure timestamp and embed revocation data for long-term validation.
A timestamp establishes when a signature was created but does not inherently preserve all certificates and revocation records (like CRLs or OCSPs) needed for future verification. To prevent the 'Validity Unknown' error when a certificate expires, Long-Term Validation (LTV) data must be included in the PDF.
By adjusting your verification preferences, you can instruct your software to evaluate the signature based on the secure timestamp rather than the current system time.
Launch your PDF reader, navigate to the application Settings or Preferences menu, and click on the 'Signatures' category.
Under the Verification section, click 'More' or 'Advanced'. Check the option to validate signatures using the 'Secure time (timestamp)' embedded in the document.
Right-click the signature showing 'Validity Unknown', select 'Signature Properties', go to the 'Signer' tab, and manually add the certificate to your Trusted Identities if it is missing.
Return to the document, right-click the earlier signature, and select 'Validate Signature' to force the software to re-check the certificate chain using the secure timestamp settings.
Verify and Manage PDF Digital Signatures Securely with WPS PDF
WPS PDF provides robust tools for managing digital signatures, timestamps, and document security. You can easily validate certificate chains, apply reliable digital signatures, and view comprehensive signature properties.
- 1. Open your PDF: Launch WPS Office and open your signed PDF document using the WPS PDF tool.
- 2. Access the Protect Tab: Navigate to the 'Protect' tab on the top ribbon to find digital signature and document security features.
- 3. View Signature Panel: Click on 'Manage Signatures' or click the digital signature directly in the document to open the Signature Properties and validate the timestamped certificate.
Frequently Asked Questions
What does 'Validity Unknown' mean in a PDF digital signature?
It means the PDF software cannot verify the certificate chain. This usually happens when the certificate has expired, the necessary revocation information is missing, or the root certificate is not added to your trusted identities list.
Does a timestamp automatically make a PDF signature valid forever?
No. While a timestamp proves the document was signed at a specific time, you also need Long-Term Validation (LTV) data. LTV embeds the necessary certificate and revocation records to prove the certificate was valid at that specific time, even if it expires later.
How can I manually trust a digital signature certificate?
Right-click the signature, open 'Signature Properties', click 'Show Signer's Certificate' or 'Certificate Details', navigate to the 'Trust' tab, and select 'Add to Trusted Certificates'.
Why is the newer signature valid while the older timestamped one is not?
The newer signature's certificate chain is likely still active and valid according to the current system time. The older signature's certificate may have expired, and because it lacks embedded revocation data (LTV), the software cannot retroactively validate it without specific secure time settings.
