PDF Digital Signature

Web pages can't read your operating system's or Adobe's list of trusted certificate authorities. This verifier only treats a signer as trusted if you add their certificate or their CA's certificate yourself. Adobe Reader and other PDF apps use their own lists when your recipients open the file.

A self-signed or own-CA certificate proves the document wasn't changed, but recipients' PDF readers will warn that the signer's identity can't be confirmed until they choose to trust your certificate. For automatic trust in Adobe Reader you need a certificate from an Adobe-approved (AATL) provider.

Checking whether a certificate has been revoked requires contacting the certificate authority's servers, which block requests from web pages. A revoked certificate will still show as valid here.

Time-stamp authorities (TSAs) don't accept requests from browsers, so the signing time comes from your device's clock and can't be independently proven. Existing time-stamps in PDFs you verify are checked.

Revocation data and time-stamps aren't embedded, so readers may report a signature as “not LTV-enabled”, and validating it after the certificate expires is harder.

Web pages can't talk to hardware tokens, national ID cards or remote signing services. Most commercial Adobe-trusted certificates are issued on such hardware, so they can't be used here.

Files exported by older Windows or macOS versions are often encrypted with 3DES/RC2, which browsers can't decrypt. Convert them to the modern AES format with OpenSSL 3, then delete the temporary file, which holds your unencrypted key:

openssl pkcs12 -in old.p12 -legacy -nodes -out temp.pem
openssl pkcs12 -export -in temp.pem -out new.p12
rm temp.pem

Encrypted PDFs can't be signed or verified. Remove the password protection first.

If a document was changed after someone signed it, the verifier tells you and lets you download the exact version they signed. It doesn't judge whether the later changes were permitted (form filling vs. content edits) the way Adobe Acrobat does.

You can't create “certify” signatures that lock a document, and PDFs certified as “no changes allowed” can't be signed.

Very old signatures using adbe.x509.rsa_sha1 are reported as unsupported. RSA-PSS keys and keys on curves other than P-256/P-384/P-521 can't be used for signing.

Some legal systems (for example eIDAS “qualified” signatures in the EU) require a qualified certificate on a certified device. Whether a signature made here is legally sufficient depends on your country and use case.