How to Verify the Root Certificate for Signed PDF Invoices
Question details
Users need to resolve an unverified signature warning on digitally signed PDF invoices by correctly verifying the root certificate chain.
- Product
- Device & OS
- not provided
- Scenario
- Opening a digitally signed PDF invoice where the software cannot automatically validate the certificate chain used by the sender.
- Observed behavior
- The PDF reader displays an "unverified signature" or "signature validity is unknown" warning message when opening the document.
Ensure you have an active internet connection so your PDF software can fetch real-time certificate revocation lists (CRLs). Also, verify that your computer's date and time are accurate, as an incorrect system clock can cause valid certificates to appear expired.
Manually Trust the Root Certificate in Your PDF Reader
Add the sender's certificate or the issuing Certificate Authority (CA) to your software's trusted identities to properly validate the signature.
When your PDF reader does not recognize the certificate authority (such as the ICA Root CA / RSA certificate), you must manually instruct the software to trust it. The referenced certificate is valid until May 27, 2040, but will show as invalid until explicitly trusted.
Click on the "Signature Panel" button at the top of the document, or click directly on the unverified signature field within the invoice.
Select "Signature Properties" from the context menu and click the "Show Signer's Certificate" button to view the entire certificate chain.
Navigate to the "Trust" tab within the certificate viewer, click "Add to Trusted Certificates", and confirm the security prompt.
Check the boxes to trust the certificate for certified documents, click "OK", and then click the "Validate Signature" button to clear the warning.
Update the Trusted Certificate List
Keep your PDF reader's root certificate list up to date to automatically recognize common standard Certificate Authorities.
Securely View and Sign PDF Invoices in WPS Office
WPS Office provides an intuitive, high-performance PDF reader that seamlessly handles digital signatures, certificate verification, and overall document security without complex configurations.
- 1. Install WPS Office: Download and install WPS Office on your computer or mobile device.
- 2. Open the Invoice: Launch WPS PDF and open your digitally signed PDF invoice.
- 3. Check the Signature: Click on the digital signature field to instantly view the validation status and signer's certificate details.
Frequently Asked Questions
Why does a valid PDF invoice show "signature validity is unknown"?
This happens when your PDF viewer does not have the signer's root certificate in its internal list of trusted identities. Without it, the software cannot verify the certificate chain back to a trusted Certificate Authority (CA).
What is a Root CA certificate?
A Root Certificate Authority (CA) certificate acts as the highest level of trust in a digital certificate chain. It authenticates the identity of the entity that issued the digital signature applied to your PDF.
How long are root certificates typically valid?
Root certificates usually have a very long lifespan, often remaining valid for 10 to 20 years (for example, until May 2040), ensuring long-term validation capabilities for archived digital documents.
Can I still read the invoice if the signature remains unverified?
Yes, you can still open, read, and print the PDF invoice. However, the unverified status means the software cannot mathematically guarantee that the document was not altered after it was initially signed.
