PDF Signature Shows “Not Verified”? What It Means and How to Fix It

By Michael Peters · Published July 30, 2026 · 7 min read

What the warning actually means — and doesn't

A digital signature check answers two independent questions. Integrity: has the document changed since it was signed? That is mathematics — the signature either matches the content or it does not. Trust: does the signer's certificate chain up to an authority your PDF reader recognises? That is a configuration setting on your machine.

“Signature Not Verified” (or “At least one signature has problems”, or the yellow question mark) is a trust message. Your reader is saying: the signature may well be intact, but I don't recognise the authority that vouches for the signer, so I won't put a green tick on it. It is emphatically not saying the document was altered — tampering produces a different and unmistakable message: “Document has been altered or corrupted since it was signed”, with a red cross.

So the practical question is not “is this document broken?” but “why doesn't my machine trust the issuer, and should it?”

First: confirm the document is intact (one minute)

Before touching any settings, get an independent answer on the part that matters. Upload the file to Mapsoft's free Validate Signature tool — it works in any browser, including on a phone, and reports two things separately for every signature:

• Whether the signature is cryptographically intact — the content has not been altered since signing. This is the tampering question, answered directly.
• Whether the certificate chains to a trusted root — reported as its own, informational status, so an unrecognised government authority doesn't get muddled up with a broken document.

If the report says the signature is intact, you know the document is exactly as its signer produced it. Everything from here on is about the trust label, not the document.

Why government-issued PDFs show this warning so often

Adobe ships Acrobat with two curated trust lists — the Adobe Approved Trust List (AATL) and the EU Trusted Lists (EUTL). Certificates that chain to those roots validate with a green tick out of the box. But a great deal of official paperwork worldwide is signed under national PKI hierarchies that are not (or not fully) represented there.

India is the clearest example, and the source of a large share of these warnings: documents such as Aadhaar downloads, EPFO pension passbooks, income-tax acknowledgements and DigiLocker records are digitally signed under certifying authorities licensed by the CCA (Controller of Certifying Authorities). The signatures are real and the documents are genuine — but desktop PDF readers frequently cannot chain them to a built-in root, so every one of those files opens with a question mark. The same pattern appears with internal company CAs and with self-signed certificates used between business partners.

In other words: the warning is usually evidence of a trust-list gap, not of anything wrong with your document.

The fix in Adobe Acrobat or Acrobat Reader

You resolve the warning by telling Acrobat to trust the certificate that signed the document. Do this only when you can attribute the certificate to an issuer you actually trust — a government authority whose document you requested yourself, or your own organisation's CA (see the caution below).

1. Open the signed PDF and open the Signatures panel (the fountain-pen icon in the left-hand pane).
2. Right-click the signature entry and choose Show Signature Properties…
3. Click Show Signer's Certificate… to open the certificate viewer.
4. Select the Trust tab, then click Add to Trusted Certificates… and confirm the security prompt.
5. Tick Use this certificate as a trusted root, then OK your way back out.
6. Back in the document, right-click the signature and choose Validate Signature.

The question mark becomes a green tick — for this document and for anything else signed under the same authority in future.

Two settings worth knowing about while you are there. Edit > Preferences > Trust Manager has an option to load trusted certificates from an Adobe AATL server — make sure automatic updates are enabled, since authorities do get added over time. And under Preferences > Signatures > Verification, Acrobat can optionally use the Windows certificate store for trust, which helps in organisations that distribute roots through Windows.

The judgement call: when trusting is appropriate

Adding a trusted root is a real security decision. From that point on, anything signed under that root validates with a green tick on your machine. That is exactly what you want for a national authority behind your own tax documents. It is not what you want for a certificate you cannot attribute — making a warning disappear is not a reason to trust an unknown issuer, and an unexpected “signed” invoice from a stranger deserves more suspicion after a trust warning, not less.

A sensible rule: trust certificates you sought out (you downloaded the document from the issuing authority's own portal), not certificates that arrived unsolicited.

Why the warning comes back on other machines

Trust lives on the machine, not in the file. Adding the certificate on your laptop changes what you see; a colleague opening the same PDF still gets the question mark until they make the same decision. That matters when you need to demonstrate a document's status to someone else — forwarding the file with “it shows valid for me” convinces nobody. An independent online check they can run themselves, from any device without touching trust settings, is the practical answer.

The messages that do warrant concern

• “Document has been altered or corrupted since it was signed” — an integrity failure. The content no longer matches the signature. Request a fresh copy from the source; do not rely on this file.
• Unsigned changes after signing — Acrobat may report that the signature is valid but later modifications exist. Common with form-filling after signature; review what changed before accepting it.
• A revoked certificate — the issuing authority has withdrawn the certificate. Treat the document as unverified and check with the signer.

For the machinery behind these checks — certificate chains, revocation (OCSP/CRL), and how long-term validation keeps old signatures verifiable — see our technical guide to how signature validation works, and for the broader step-by-step across desktop, online and mobile, how to validate a digital signature in a PDF.

Frequently asked questions

Does “Signature Not Verified” mean the document is fake?

Usually not. It means your reader couldn't confirm the signer's certificate against its trust lists — a configuration matter. Tampering shows as “Document has been altered or corrupted”, which is a different message entirely. Confirm integrity with an independent validator first.

Why does my Aadhaar, EPFO or income-tax PDF show this warning?

Those documents are signed under India's CCA-licensed certifying authorities, whose roots are often missing from Adobe's default trust lists. The signature is intact and the document genuine; Acrobat just can't chain the certificate to a root it ships with. Add the certificate to your trusted certificates (steps above) and validate again.

Is it safe to click “Add to Trusted Certificates”?

For a certificate you can attribute — a government authority whose document you downloaded yourself, or your organisation's own CA — yes, that is the intended use. For an unexpected document from an unknown sender, no: you would be trusting everything that issuer signs, just to silence a warning.

I fixed it on my computer — why does it still warn on my colleague's?

Trust decisions are per machine. Each reader consults its own trust list, so everyone sees the warning until they add the certificate themselves — or checks the document with an online validator instead.

What if the validator says the document was altered?

Then the warning has earned its keep: the content no longer matches what was signed. Don't rely on the file — go back to the issuing source and download or request a fresh copy.