Technical Anshu
Tutorials Blog
❓ Signature Validity

Signature Validity Unknown in Adobe Reader Fix for Indian DSC

You signed the PDF correctly, yet Adobe Reader shows a yellow question mark and says the signature validity is unknown. The client calls, worried the document is fake. In most Indian DSC cases, the signature is perfectly valid — the reader simply does not trust the Indian certificate chain yet.

✍️ Technical Anshu🪟 Windows 10 / 11⏱️ 8 minute read
🎥 Watch the full video — the bulk signing flow that produces these signed PDFs

When Adobe Reader opens a signed PDF, it checks the signer's certificate against its trust lists. Indian DSCs are issued by Certifying Authorities working under the CCA India root. If that chain is missing from the reader's trusted list — common on fresh installs, old versions, or office PCs where updates are blocked — the reader honestly reports validity unknown. It is a trust-list gap, not a failed signature. Here is how to close it.

Adobe Reader — signature panel before the fix
✍️ Signature 1 — signed with a DSC from an Indian CA?
⚠️ Signature validity is UNKNOWN — signer identity cannot be verifiedUntrusted chain
📄 Document status — not modified since signingIntact
☝️ Unknown means the reader cannot verify the chain — the document itself and the signature are untouched
1

First Understand the Three States

Reader shows one of three verdicts — know which one you actually have before changing anything.

  1. Green tick — valid: chain trusted, document unchanged. Nothing to do
  2. Question mark — validity unknown: the signature is intact, but the issuing chain is not in the reader's trust list. This is your case, and it is fixable
  3. Red cross — invalid: the document changed after signing or the signature is damaged. No trust setting fixes this — the file must be signed again
2

Fix 1 — Update the Adobe Approved Trust List

Adobe maintains a downloadable trust list (AATL). One update fixes most Indian DSC cases.

  1. Open Adobe Acrobat or Reader and press Ctrl + K for Preferences
  2. Select Trust Manager in the left panel
  3. Under the Adobe Approved Trust List section, click Update Now and stay connected to the internet
  4. Close the PDF completely, reopen it, and check the signature again
  5. Leave the option to load trusted certificates automatically switched on, so the list keeps refreshing
3

Fix 2 — Trust the Certificate Manually

If the AATL update is not enough, trust the signer's chain directly — only for documents whose source you are sure of.

  1. Open the signed PDF and open the Signatures panel (pen icon on the left)
  2. Right-click the signature and choose Show Signature Properties
  3. Click Show Signer's Certificate, then open the Trust tab
  4. Click Add to Trusted Certificates, tick Use this certificate as a trusted root, and confirm
  5. Back in the document, right-click the signature and choose Validate Signature — the question mark should turn into a green tick
4

Fix 3 — Also Trust the Windows Certificate Store

On machines where the CCA India root is installed in Windows, Reader can be told to use it.

  1. In Preferences, open Signatures and find the Verification settings (More)
  2. Enable the option to use certificates from the Windows certificate store for verification where offered
  3. If the CCA India root is not in Windows either, it can be downloaded from the official CCA website (cca.gov.in) and installed — the root for all Indian DSCs
5

What to Tell the Person Who Received Your PDF

If your signature shows unknown on the client's PC, the setting is on their side.

  1. Explain calmly: unknown means their reader has not verified the Indian CA chain yet — the document is not fake and not modified
  2. Ask them to run the same AATL update in Trust Manager and reopen the file
  3. Offer to share your certificate details from the signature properties so they can match the name and authority themselves
🔴 Honest note: only add a certificate to your trusted list when you are confident about whose it is — a government authority's, your own organisation's, or an expected signer's. Trusting random certificates from unknown senders defeats the entire purpose of signature verification.

🎥 Watch the Signing Side of This Story in the Video

The bulk signing workflow, live on screen — so the PDFs you send out carry a clean, complete signature every time.

▶️ Watch Full Video
❓ Frequently Asked Questions

If validity shows unknown, is my signed PDF rejected by portals?

Portals verify the signature cryptographically on their own systems, not through your Reader's trust list. A PDF that shows unknown in a desktop reader is still normally accepted by tender and government portals, because the signature itself is complete and valid.

Why does the same PDF show valid on one PC and unknown on another?

Because trust lists live on each PC, not inside the PDF. The updated machine has the CCA India chain in its AATL or trusted store; the other machine does not. The document is identical in both cases.

Should I re-sign the PDF to remove the question mark?

No. Re-signing changes nothing about the reader's trust list — the new signature would still chain to the same authority. Fix the trust list once, and all past and future PDFs from that chain validate.

This guide is based on the Technical Anshu bulk PDF signing with DSC video • Stuck on any step? Ask in the video comments — help is available there 🙏