How to read a signature validation report
A signature validation report answers four questions about a signed PDF: has it changed since it was signed, who signed it, when, and can it still be checked in years to come. Below is a real report for a signed quote, followed by what every line means.
Example report for a NomaSign(ed) quote.
Signed, and all signatures are valid
Quote Q-2026-0142 - Aurora Retail-digital-signed.pdf
523 KB · 1 page · 4 signatures · checked 14 Oct 2026, 12:00:00 UTC
Signed, and all signatures are valid
Quote Q-2026-0142 - Aurora Retail-digital-signed.pdf
523 KB · 1 page · 4 signatures · checked 14 Oct 2026, 12:00:00 UTC
Certified by NomaSign Digital SignatureValid
- Time
- 9 Oct 2026, 11:32:15 UTC
- Placement
- Invisible signature
- Name in the signature:
- Daniel Fourie
- Certificate:
- NomaSign Digital Signature, YOUSOURCE SA (PTY) LTD
- Added by
- Added by NomaSign: it matches the NomaSign evidence in the file.
Signed part: Whole document at Rev. 1
Covers the document exactly as it was when signed (Rev. 1)
A signature covers every byte of the document as it was at that moment, except the slot that holds the signature itself.
Signature byte range: saved version 1 of 7
Integrity: Not modified since signing
Document has not been modified since this signature was applied
The signed bytes were hashed and compared with the hash inside the signature, and the signature was verified with the signer's public key. Both match.
Hash and signature verified
Changes after signing: Only allowed additions
Only allowed additions after this signature: 2 more signatures, form fields filled in, revocation data, document metadata and an archive timestamp
Later versions may add the next signers' fields and signatures, revocation data and timestamps. Nothing else was added.
Permitted changes: the certification allows filling in form fields and signing
Signer identity: Trusted by Adobe
Signed with a certificate that Adobe trusts
The signer's certificate leads up to a certificate authority on the Adobe Approved Trust List, the list Adobe Acrobat uses.
Adobe Approved Trust List: GlobalSign R45 AATL Root CA 2020
Time of signature: Proven by a timestamp
Signing time proven by a trusted timestamp: 9 Oct 2026, 11:32:15 UTC
A timestamp authority vouched for the moment of signing, so the time can't be backdated.
Timestamp from Globalsign TSA for AATL - R45 - 2026 TSU-03.001-LCY
Long-term validation: Enabled
Can still be verified in years to come, even offline
The file carries the certificates and the proof that they were not revoked at the time of signing, so the signature stays verifiable after the certificates expire.
LTV enabled
Signature details
- Signature level
- The highest level: verifiable later, and the whole file is sealed with an archive timestamp (PAdES B-LTA)
- Trusted through
- Adobe Approved Trust List: GlobalSign R45 AATL Root CA 2020
- Signature format
- ETSI.CAdES.detached
- Algorithms
- SHA-256, RSA
- Allowed after certification
- Filling in form fields and signing
- Field
- Original-Document-Sender-Certification
- Certificate chain
- Signer: NomaSign Digital Signature (valid until 17 Mar 2029)
- Issued by: GlobalSign GCC R45 AATL CA 2020 (valid until 28 Jul 2030)
- Root: GlobalSign R45 AATL Root CA 2020 (valid until 28 Jul 2030)
Rev. 2: Signed by NomaSign Digital SignatureValid
- Time
- 9 Oct 2026, 11:37:36 UTC
- Placement
- Signature on page 1
- Name in the signature:
- Naledi Mokoena
- Certificate:
- NomaSign Digital Signature, YOUSOURCE SA (PTY) LTD
- Added by
- Added by NomaSign: it matches the NomaSign evidence in the file.
Signed part: Whole document at Rev. 2
Covers the document exactly as it was when signed (Rev. 2)
A signature covers every byte of the document as it was at that moment, except the slot that holds the signature itself.
Signature byte range: saved version 3 of 7
Integrity: Not modified since signing
Document has not been modified since this signature was applied
The signed bytes were hashed and compared with the hash inside the signature, and the signature was verified with the signer's public key. Both match.
Hash and signature verified
Changes after signing: Only allowed additions
Only allowed additions after this signature: 1 more signature, form fields filled in, revocation data, document metadata and an archive timestamp
Later versions may add the next signers' fields and signatures, revocation data and timestamps. Nothing else was added.
Permitted changes: the certification allows filling in form fields and signing
Signer identity: Trusted by Adobe
Signed with a certificate that Adobe trusts
The signer's certificate leads up to a certificate authority on the Adobe Approved Trust List, the list Adobe Acrobat uses.
Adobe Approved Trust List: GlobalSign R45 AATL Root CA 2020
Time of signature: Proven by a timestamp
Signing time proven by a trusted timestamp: 9 Oct 2026, 11:37:36 UTC
A timestamp authority vouched for the moment of signing, so the time can't be backdated.
Timestamp from Globalsign TSA for AATL - R45 - 2026 TSU-02.001-LCY
Long-term validation: Enabled
Can still be verified in years to come, even offline
The file carries the certificates and the proof that they were not revoked at the time of signing, so the signature stays verifiable after the certificates expire.
LTV enabled
Signature details
- Signature level
- Signature with a trusted time (PAdES B-T)Not higher because: The revocation data for the timestamp authority's certificates is missing from the file.
- Trusted through
- Adobe Approved Trust List: GlobalSign R45 AATL Root CA 2020
- Signature format
- ETSI.CAdES.detached
- Algorithms
- SHA-256, RSA
- Field
- participant.98793372-205a-5c76-8e08-67cee75c18df.field.14088872-6284-4977-983e-0ef531f46139
- Certificate chain
- Signer: NomaSign Digital Signature (valid until 17 Mar 2029)
- Issued by: GlobalSign GCC R45 AATL CA 2020 (valid until 28 Jul 2030)
- Root: GlobalSign R45 AATL Root CA 2020 (valid until 28 Jul 2030)
Rev. 3: Signed by NomaSign Digital SignatureValid
- Time
- 9 Oct 2026, 11:37:54 UTC
- Placement
- Signature on page 1
- Name in the signature:
- Daniel Fourie
- Certificate:
- NomaSign Digital Signature, YOUSOURCE SA (PTY) LTD
- Added by
- Added by NomaSign: it matches the NomaSign evidence in the file.
Signed part: Whole document at Rev. 3
Covers the document exactly as it was when signed (Rev. 3)
A signature covers every byte of the document as it was at that moment, except the slot that holds the signature itself.
Signature byte range: saved version 4 of 7
Integrity: Not modified since signing
Document has not been modified since this signature was applied
The signed bytes were hashed and compared with the hash inside the signature, and the signature was verified with the signer's public key. Both match.
Hash and signature verified
Changes after signing: Only allowed additions
Only allowed additions after this signature: revocation data, document metadata and an archive timestamp
Later versions may add the next signers' fields and signatures, revocation data and timestamps. Nothing else was added.
Permitted changes: the certification allows filling in form fields and signing
Signer identity: Trusted by Adobe
Signed with a certificate that Adobe trusts
The signer's certificate leads up to a certificate authority on the Adobe Approved Trust List, the list Adobe Acrobat uses.
Adobe Approved Trust List: GlobalSign R45 AATL Root CA 2020
Time of signature: Proven by a timestamp
Signing time proven by a trusted timestamp: 9 Oct 2026, 11:37:54 UTC
A timestamp authority vouched for the moment of signing, so the time can't be backdated.
Timestamp from Globalsign TSA for AATL - R45 - 2026 TSU-01.001-LCY
Long-term validation: Enabled
Can still be verified in years to come, even offline
The file carries the certificates and the proof that they were not revoked at the time of signing, so the signature stays verifiable after the certificates expire.
LTV enabled
Signature details
- Signature level
- The highest level: verifiable later, and the whole file is sealed with an archive timestamp (PAdES B-LTA)
- Trusted through
- Adobe Approved Trust List: GlobalSign R45 AATL Root CA 2020
- Signature format
- ETSI.CAdES.detached
- Algorithms
- SHA-256, RSA
- Field
- participant.5c75acaf-ce70-5dd8-a2d0-d234c7adcebe.field.91c6b510-369b-4c5c-84fc-59fabe654fc3
- Certificate chain
- Signer: NomaSign Digital Signature (valid until 17 Mar 2029)
- Issued by: GlobalSign GCC R45 AATL CA 2020 (valid until 28 Jul 2030)
- Root: GlobalSign R45 AATL Root CA 2020 (valid until 28 Jul 2030)
Rev. 4: Document timestamp by Globalsign TSA for AATL - R45 - 2026 TSU-01.001-LCYValid
- Time
- 9 Oct 2026, 11:37:54 UTC
- Placement
- Covers the whole file
- Certificate:
- Globalsign TSA for AATL - R45 - 2026 TSU-01.001-LCY, GlobalSign nv-sa
- Added by
- Added by NomaSign: it matches the NomaSign evidence in the file.
Signed part: Whole document at Rev. 4
Covers the document exactly as it was when signed (Rev. 4)
A signature covers every byte of the document as it was at that moment, except the slot that holds the signature itself.
Signature byte range: saved version 7 of 7
Integrity: Not modified since signing
Document has not been modified since this signature was applied
The signed bytes were hashed and compared with the hash inside the signature, and the signature was verified with the signer's public key. Both match.
Hash and signature verified
Changes after signing: None
Nothing was added after this signature
This is the last version of the document.
Signer identity: Trusted by Adobe
Signed with a certificate that Adobe trusts
The signer's certificate leads up to a certificate authority on the Adobe Approved Trust List, the list Adobe Acrobat uses.
Adobe Approved Trust List: GlobalSign R45 AATL TimeStamping Root CA 2021
Timestamp: Seals the finished document
Seals the finished document with a trusted time: 9 Oct 2026, 11:37:54 UTC
An archive timestamp over the whole file, including the revocation data, keeps the document verifiable after the certificates in it expire.
Document timestamp from Globalsign TSA for AATL - R45 - 2026 TSU-01.001-LCY
Long-term validation: Enabled
Can still be verified in years to come, even offline
The file carries the certificates and the proof that they were not revoked at the time of signing, so the signature stays verifiable after the certificates expire.
LTV enabled
Signature details
- Trusted through
- Adobe Approved Trust List: GlobalSign R45 AATL TimeStamping Root CA 2021
- Signature format
- ETSI.RFC3161
- Algorithms
- SHA-256, RSA
- Field
- NomaSign-DocTimeStamp
- Certificate chain
- Timestamp authority: Globalsign TSA for AATL - R45 - 2026 TSU-01.001-LCY (valid until 24 Jul 2037)
- Root: GlobalSign R45 AATL TimeStamping Root CA 2021 (valid until 18 May 2038)
Signer identity is checked against the Adobe Approved Trust List of 24 Sept 2026 and the EU Trusted List of 14 Oct 2026. The file was checked in the browser and not uploaded.
What each line means
Every signature gets the same checks, in the same order. Each line starts with what it means for you, followed by the technical term in smaller text.
- The timeline: certification, signatures, document timestamp
- A well-signed document follows the same order every time: the sender certifies it, the signers sign, and a document timestamp seals the finished file. The report shows each step in that order. A step the document does not have shows as a grey row; it is not an error, but best practice is to have it.
- Signed part: whole document at Rev. 2
- Every save of a signed PDF adds a version on top of the last one, and the old versions stay inside the file. Like Adobe Acrobat, the report numbers the signed versions: the certification comes first, then Rev. 2 is the next signature, and so on. Saves that only add verification data or fill in fields get no number of their own.
- Integrity: not modified since signing
- The part of the file this signature covers is byte for byte what was signed. If even one character had changed, this line turns red: the signed content was altered. That is certain, though not always malicious: a damaged download or a program that re-saves the whole file gives the same result.
- Changes after signing: only allowed additions
- Later versions can add things on top: the next signer's fields and signature, revocation data, a timestamp. When the first signature is a certification, it decides what may be added. Anything else, like a new price on the page, turns the report orange: the signed versions are intact, but the document was changed in a way the signer did not allow.
- Signer identity: trusted by Adobe, or qualified on the EU Trusted List
- The signing certificate leads up to a certificate authority on the Adobe Approved Trust List, the list Adobe Acrobat uses, or to a qualified provider on the EU Trusted List that was approved at the time of signing. If a signer isn't found, that doesn't mean it isn't trusted: the signer may use a private certificate authority, so open the file in Acrobat to be sure.
- Time of signature: proven by a timestamp
- A timestamp authority vouched for the moment of signing. Without one, the time comes from the clock on the signer's computer (which can be the signing provider's server); the signature stays valid, but the report shows a warning, because best practice is a trusted timestamp.
- Long-term validation: enabled
- The file carries everything needed to check the signature later: the certificates and the proof that they weren't revoked when it was signed. Acrobat calls this LTV enabled. Certificates expire after a few years; an LTV-enabled signature stays verifiable.
Signature levels
Under Signature details, the report names the level the signature reaches. These are the PAdES levels from the European standard for signed PDFs, lowest to highest. When a signature could reach a higher level, the report says what is missing.
- PAdES B-BBasic signature, no trusted time
- PAdES B-TSignature with a trusted time
- PAdES B-LTSignature with a trusted time and everything needed to verify it later
- PAdES B-LTAThe highest level: verifiable later, and the whole file is sealed with an archive timestamp
What a problem looks like
Here is the same quote after someone changed the total and saved the file. The old signatures are still mathematically intact, because the change was added as a new version on top. The report catches it anyway and shows it in orange: the certification only allowed fields and signatures to be added, and a new price on the page is neither. Had someone edited the signed bytes themselves, the report would be red: the signed content was altered.
Signed, but changed afterwards in a way the signer did not allow
Quote Q-2026-0142 - Aurora Retail-digital-signed (price changed).pdf
526 KB · 1 page · 4 signatures · checked 14 Oct 2026, 12:00:00 UTC
Signed, but changed afterwards in a way the signer did not allow
Quote Q-2026-0142 - Aurora Retail-digital-signed (price changed).pdf
526 KB · 1 page · 4 signatures · checked 14 Oct 2026, 12:00:00 UTC
Certified by NomaSign Digital SignatureChanged after signing
- Time
- 9 Oct 2026, 11:32:15 UTC
- Placement
- Invisible signature
- Name in the signature:
- Daniel Fourie
- Certificate:
- NomaSign Digital Signature, YOUSOURCE SA (PTY) LTD
- Added by
- Added by NomaSign: it matches the NomaSign evidence in the file.
Signed part: Whole document at Rev. 1
Covers the document exactly as it was when signed (Rev. 1)
A signature covers every byte of the document as it was at that moment, except the slot that holds the signature itself.
Signature byte range: saved version 1 of 8
Integrity: Not modified since signing
Document has not been modified since this signature was applied
The signed bytes were hashed and compared with the hash inside the signature, and the signature was verified with the signer's public key. Both match.
Hash and signature verified
Changes after signing: Not allowed
Changed after this signature in a way that is not allowed: the content of page 1 was changed after Rev. 4
The signed version itself is intact, but something was added later that the signer did not allow. Validators can differ in how strictly they apply these rules; Adobe Acrobat marks it as invalid.
Unpermitted change
Signer identity: Trusted by Adobe
Signed with a certificate that Adobe trusts
The signer's certificate leads up to a certificate authority on the Adobe Approved Trust List, the list Adobe Acrobat uses.
Adobe Approved Trust List: GlobalSign R45 AATL Root CA 2020
Time of signature: Proven by a timestamp
Signing time proven by a trusted timestamp: 9 Oct 2026, 11:32:15 UTC
A timestamp authority vouched for the moment of signing, so the time can't be backdated.
Timestamp from Globalsign TSA for AATL - R45 - 2026 TSU-03.001-LCY
Long-term validation: Enabled
Can still be verified in years to come, even offline
The file carries the certificates and the proof that they were not revoked at the time of signing, so the signature stays verifiable after the certificates expire.
LTV enabled
Signature details
- Signature level
- The highest level: verifiable later, and the whole file is sealed with an archive timestamp (PAdES B-LTA)
- Trusted through
- Adobe Approved Trust List: GlobalSign R45 AATL Root CA 2020
- Signature format
- ETSI.CAdES.detached
- Algorithms
- SHA-256, RSA
- Allowed after certification
- Filling in form fields and signing
- Field
- Original-Document-Sender-Certification
- Certificate chain
- Signer: NomaSign Digital Signature (valid until 17 Mar 2029)
- Issued by: GlobalSign GCC R45 AATL CA 2020 (valid until 28 Jul 2030)
- Root: GlobalSign R45 AATL Root CA 2020 (valid until 28 Jul 2030)
Rev. 2: Signed by NomaSign Digital SignatureChanged after signing
- Time
- 9 Oct 2026, 11:37:36 UTC
- Placement
- Signature on page 1
- Name in the signature:
- Naledi Mokoena
- Certificate:
- NomaSign Digital Signature, YOUSOURCE SA (PTY) LTD
- Added by
- Added by NomaSign: it matches the NomaSign evidence in the file.
Signed part: Whole document at Rev. 2
Covers the document exactly as it was when signed (Rev. 2)
A signature covers every byte of the document as it was at that moment, except the slot that holds the signature itself.
Signature byte range: saved version 3 of 8
Integrity: Not modified since signing
Document has not been modified since this signature was applied
The signed bytes were hashed and compared with the hash inside the signature, and the signature was verified with the signer's public key. Both match.
Hash and signature verified
Changes after signing: Not allowed
Changed after this signature in a way that is not allowed: the content of page 1 was changed after Rev. 4
The signed version itself is intact, but something was added later that the signer did not allow. Validators can differ in how strictly they apply these rules; Adobe Acrobat marks it as invalid.
Unpermitted change
Signer identity: Trusted by Adobe
Signed with a certificate that Adobe trusts
The signer's certificate leads up to a certificate authority on the Adobe Approved Trust List, the list Adobe Acrobat uses.
Adobe Approved Trust List: GlobalSign R45 AATL Root CA 2020
Time of signature: Proven by a timestamp
Signing time proven by a trusted timestamp: 9 Oct 2026, 11:37:36 UTC
A timestamp authority vouched for the moment of signing, so the time can't be backdated.
Timestamp from Globalsign TSA for AATL - R45 - 2026 TSU-02.001-LCY
Long-term validation: Enabled
Can still be verified in years to come, even offline
The file carries the certificates and the proof that they were not revoked at the time of signing, so the signature stays verifiable after the certificates expire.
LTV enabled
Signature details
- Signature level
- Signature with a trusted time (PAdES B-T)Not higher because: The revocation data for the timestamp authority's certificates is missing from the file.
- Trusted through
- Adobe Approved Trust List: GlobalSign R45 AATL Root CA 2020
- Signature format
- ETSI.CAdES.detached
- Algorithms
- SHA-256, RSA
- Field
- participant.98793372-205a-5c76-8e08-67cee75c18df.field.14088872-6284-4977-983e-0ef531f46139
- Certificate chain
- Signer: NomaSign Digital Signature (valid until 17 Mar 2029)
- Issued by: GlobalSign GCC R45 AATL CA 2020 (valid until 28 Jul 2030)
- Root: GlobalSign R45 AATL Root CA 2020 (valid until 28 Jul 2030)
Rev. 3: Signed by NomaSign Digital SignatureChanged after signing
- Time
- 9 Oct 2026, 11:37:54 UTC
- Placement
- Signature on page 1
- Name in the signature:
- Daniel Fourie
- Certificate:
- NomaSign Digital Signature, YOUSOURCE SA (PTY) LTD
- Added by
- Added by NomaSign: it matches the NomaSign evidence in the file.
Signed part: Whole document at Rev. 3
Covers the document exactly as it was when signed (Rev. 3)
A signature covers every byte of the document as it was at that moment, except the slot that holds the signature itself.
Signature byte range: saved version 4 of 8
Integrity: Not modified since signing
Document has not been modified since this signature was applied
The signed bytes were hashed and compared with the hash inside the signature, and the signature was verified with the signer's public key. Both match.
Hash and signature verified
Changes after signing: Not allowed
Changed after this signature in a way that is not allowed: the content of page 1 was changed after Rev. 4
The signed version itself is intact, but something was added later that the signer did not allow. Validators can differ in how strictly they apply these rules; Adobe Acrobat marks it as invalid.
Unpermitted change
Signer identity: Trusted by Adobe
Signed with a certificate that Adobe trusts
The signer's certificate leads up to a certificate authority on the Adobe Approved Trust List, the list Adobe Acrobat uses.
Adobe Approved Trust List: GlobalSign R45 AATL Root CA 2020
Time of signature: Proven by a timestamp
Signing time proven by a trusted timestamp: 9 Oct 2026, 11:37:54 UTC
A timestamp authority vouched for the moment of signing, so the time can't be backdated.
Timestamp from Globalsign TSA for AATL - R45 - 2026 TSU-01.001-LCY
Long-term validation: Enabled
Can still be verified in years to come, even offline
The file carries the certificates and the proof that they were not revoked at the time of signing, so the signature stays verifiable after the certificates expire.
LTV enabled
Signature details
- Signature level
- The highest level: verifiable later, and the whole file is sealed with an archive timestamp (PAdES B-LTA)
- Trusted through
- Adobe Approved Trust List: GlobalSign R45 AATL Root CA 2020
- Signature format
- ETSI.CAdES.detached
- Algorithms
- SHA-256, RSA
- Field
- participant.5c75acaf-ce70-5dd8-a2d0-d234c7adcebe.field.91c6b510-369b-4c5c-84fc-59fabe654fc3
- Certificate chain
- Signer: NomaSign Digital Signature (valid until 17 Mar 2029)
- Issued by: GlobalSign GCC R45 AATL CA 2020 (valid until 28 Jul 2030)
- Root: GlobalSign R45 AATL Root CA 2020 (valid until 28 Jul 2030)
Rev. 4: Document timestamp by Globalsign TSA for AATL - R45 - 2026 TSU-01.001-LCYChanged after signing
- Time
- 9 Oct 2026, 11:37:54 UTC
- Placement
- Covers the whole file
- Certificate:
- Globalsign TSA for AATL - R45 - 2026 TSU-01.001-LCY, GlobalSign nv-sa
- Added by
- Added by NomaSign: it matches the NomaSign evidence in the file.
Signed part: Whole document at Rev. 4
Covers the document exactly as it was when signed (Rev. 4)
A signature covers every byte of the document as it was at that moment, except the slot that holds the signature itself.
Signature byte range: saved version 7 of 8
Integrity: Not modified since signing
Document has not been modified since this signature was applied
The signed bytes were hashed and compared with the hash inside the signature, and the signature was verified with the signer's public key. Both match.
Hash and signature verified
Changes after signing: Not allowed
Changed after this signature in a way that is not allowed: the content of page 1 was changed after Rev. 4
The signed version itself is intact, but something was added later that the signer did not allow. Validators can differ in how strictly they apply these rules; Adobe Acrobat marks it as invalid.
Unpermitted change
Signer identity: Trusted by Adobe
Signed with a certificate that Adobe trusts
The signer's certificate leads up to a certificate authority on the Adobe Approved Trust List, the list Adobe Acrobat uses.
Adobe Approved Trust List: GlobalSign R45 AATL TimeStamping Root CA 2021
Timestamp: Seals the finished document
Seals the finished document with a trusted time: 9 Oct 2026, 11:37:54 UTC
An archive timestamp over the whole file, including the revocation data, keeps the document verifiable after the certificates in it expire.
Document timestamp from Globalsign TSA for AATL - R45 - 2026 TSU-01.001-LCY
Long-term validation: Enabled
Can still be verified in years to come, even offline
The file carries the certificates and the proof that they were not revoked at the time of signing, so the signature stays verifiable after the certificates expire.
LTV enabled
Signature details
- Trusted through
- Adobe Approved Trust List: GlobalSign R45 AATL TimeStamping Root CA 2021
- Signature format
- ETSI.RFC3161
- Algorithms
- SHA-256, RSA
- Field
- NomaSign-DocTimeStamp
- Certificate chain
- Timestamp authority: Globalsign TSA for AATL - R45 - 2026 TSU-01.001-LCY (valid until 24 Jul 2037)
- Root: GlobalSign R45 AATL TimeStamping Root CA 2021 (valid until 18 May 2038)
Signer identity is checked against the Adobe Approved Trust List of 24 Sept 2026 and the EU Trusted List of 14 Oct 2026. The file was checked in the browser and not uploaded.
Want to see this in Adobe Acrobat instead? The ten-second test shows what each Acrobat message means, and the Proof File is a real NomaSign(ed) document you can check yourself.
Questions about validation reports
Was my file uploaded to make this report?
Why does a signature say valid when the certificate has expired?
What is the difference between a certification and a signature?
Should I still check the file in Adobe Acrobat?
Send documents that pass every check
Sealed the moment you hit send. Unlimited documents from R99 a month.