When you open a digitally signed PDF, your PDF reader performs multiple cryptographic and trust validations to confirm that the document is authentic and has not been altered.
These checks happen within seconds but involve complex Public Key Infrastructure (PKI) mechanisms.
This article explains exactly what happens behind the scenes when a digitally signed PDF is opened.
Quick Answer
When a digitally signed PDF is opened, the PDF reader performs the following validations:
- Document integrity verification
- Digital signature verification
- Certificate validity verification
- Certificate chain validation
- Certificate revocation check (CRL / OCSP)
- Timestamp validation
- Signed byte-range verification
- Allowed modification verification
- Cryptographic algorithm validation
If all checks pass, the signature is marked Valid.
1. Document Integrity Check (Has the File Been Modified?)
The first validation verifies that no content in the document has changed after signing.
How it Works
During signing:
- The document is processed using a hash algorithm such as SHA-256.
- This generates a unique hash value (digital fingerprint).
- The hash is encrypted using the signer’s private key.
This encrypted hash becomes the digital signature.
When the document is opened:
- The PDF reader calculates the hash of the document again.
- The stored signature is decrypted using the signer’s public key.
- The two hash values are compared.
Result:
- ✔ If hashes match → Document is unchanged
- ❌ If hashes differ → Document has been tampered with
2. Verification of the Signer’s Digital Signature Certificate
The PDF reader verifies the Digital Signature Certificate (DSC) used for signing.
A DSC contains information such as:
- Signer name
- Organization
- Certificate serial number
- Issuing authority
- Validity period
- Public key
The reader checks whether the certificate was valid at the time of signing.
3. Certificate Authority Trust Verification
Digital Signature Certificates are issued by Certifying Authorities (CAs).
Common CAs in India include:
- eMudhra
- Sify
- NIC Certifying Authority
- Capricorn CA
The PDF reader verifies whether the certificate was issued by a trusted Certifying Authority.
If the CA is trusted:
✔ Signature validation continues.
If the CA is not trusted:
⚠ The PDF reader may display “Signer identity unknown”.
4. Certificate Chain Validation (Chain of Trust)
Digital certificates are validated through a chain of trust.
Signer Certificate
↓
Intermediate CA
↓
Root Certifying Authority
The PDF reader verifies:
- Each certificate is signed by the authority above it
- The chain is complete
- The Root CA is trusted by the system
If any link in the chain fails, the signature becomes untrusted.
5. Certificate Revocation Check (CRL / OCSP)
A certificate may be revoked by the Certifying Authority even before expiry.
Common reasons include:
- Private key compromise
- Fraudulent issuance
- User request
The PDF reader checks revocation status using:
CRL (Certificate Revocation List)
A periodically published list containing revoked certificates.
OCSP (Online Certificate Status Protocol)
A real-time validation query sent to the Certifying Authority.
If the certificate is revoked, the signature becomes invalid.
6. Timestamp Validation
Many digital signatures include a trusted timestamp issued by a Timestamp Authority (TSA).
This timestamp proves the exact time when the document was signed.
This is important because a certificate may expire later, but the signature remains valid if it was created while the certificate was still valid.
7. PDF Byte Range Verification
In a signed PDF, only specific byte ranges of the document are signed.
The PDF reader verifies that these signed sections remain unchanged.
If any byte within the signed portion changes, the signature becomes invalid.
8. Allowed Changes After Signing
Some PDF signatures allow limited changes after signing. Allowed Change Effect No changes allowed Any change invalidates the signature Form filling allowed Signature remains valid Annotations allowed Comments allowed
The PDF reader checks whether changes remain within permitted limits.
9. Signature Algorithm Verification
The reader verifies the cryptographic algorithms used in the signature.
Common algorithms include:
- RSA
- ECDSA
- SHA-256
- SHA-384
If weak or deprecated algorithms are used, the PDF reader may display security warnings.
Final Signature Status
Status Meaning Valid All validation checks passed Unknown Signer certificate not trusted Invalid Document modified Revoked Certificate revoked Expired Certificate expired without timestamp
Why Digital Signature Validation Matters
Digital signature validation ensures:
- Document authenticity
- Data integrity
- Non-repudiation
- Legal enforceability
Digital signatures are legally recognized under the Information Technology Act, 2000 in India.
They are widely used in:
- Income tax filing
- GST returns
- MCA filings
- Government e-office systems
- Aadhaar eSign services
Conclusion
When a digitally signed PDF is opened, the PDF reader automatically performs multiple security validations including:
- Document hash verification
- Certificate validation
- Chain of trust verification
- Revocation checks
- Timestamp verification
These checks ensure that the document is authentic and has not been altered after signing.
Digital signatures therefore form the backbone of secure digital governance and paperless transactions.