How to check a PDF's digital signature
Check whether a PDF signature is valid with PDF by Zaweba's Signatures panel: see who signed, what changed afterwards, and trust certificates.
Open the PDF in PDF by Zaweba and go to View, Signatures panel. It checks every signature in the document as valid, unknown or invalid, lists the changes made after each one, and shows the signed version and the signer's certificate. The app is free and works offline on Windows.
Checking takes seconds, and it tells you two things: who signed, and whether the document has been altered since.
What the three results mean
Valid means the document hasn't been changed in a way the signature forbids since it was signed, and the certificate is one you trust.
Unknown usually means the signature itself is intact but the app can't tell whether to trust the signer's certificate. That's common with self-signed IDs and certificates from bodies your PC doesn't yet know. It isn't a sign of tampering, but it isn't proof of identity either.
Invalid means something is wrong: the document has been altered after signing in a way that breaks the seal, or the certificate has a problem. Treat the document with suspicion and ask the sender.
Changes after signing
A signed PDF can still be changed afterwards, for example by a second person adding their own signature or filling in a field. The Signatures panel lists the changes made after each signature, so you can see whether they're the expected sort.
It also shows the signed version, which is the document exactly as it was when that person signed. If you want to be sure what someone agreed to, look at that version rather than the current one.
Trusting certificates
If signatures from a regular contact come up as unknown, you can import their certificate as trusted (.cer, .pem or .p7b files), or trust a signer straight from the panel. After that, their signatures show as valid when the document is intact.
Only trust a certificate you've got from a source you're sure of, such as directly from the person, or from your organisation. Trusting a certificate because it came attached to the same email as the document proves very little.
Revocation
A certificate can be withdrawn by whoever issued it, for example if a key was lost. The app checks revocation offline from information stored in the document, or online if you switch that on. Documents signed with long-term validation carry their own certificates, OCSP answers and CRLs, so they can be checked offline years later.
Signed or certified?
Some documents are certified rather than simply signed. A certifying signature is the first signature in a document and states what may change afterwards: nothing, form filling and signing, or comments as well. The panel shows if a later change is allowed by the certification or goes beyond it.
A quick routine
When a signed PDF arrives, open the Signatures panel before anything else. Confirm the signer, check the status, read the list of later changes, and if needed view the signed version. If it's unknown, decide whether to trust that certificate. PDF by Zaweba does all of this on your own PC, without sending the document to an online checker.
