Inspect PDF signatures and CRL evidence
Inspect PDF signatures checks the digital signatures in a PDF in your browser. Files are processed in the browser on your device and are not uploaded. This is a limited local check, not a qualified signature validation service.
Inspect a signature
- Select Inspect PDF signatures and choose the original signed PDF. Do not edit and save it again first.
- Select Inspect signatures. Read both the coverage and the cryptographic integrity result. A signature that matches an earlier version of the file may leave later changes unsigned.
- Without trust anchors, the tool does not establish certificate trust. A name in a certificate is not proof of identity.
- To check a certificate path, open Optional trust anchors and select public CA certificates from a source you trust.
- Select Inspect certificate fingerprints, check the fingerprints independently and confirm the certificates you choose as anchors. They are used for this check only and are not added to your browser or operating system.
- Optionally, select a DER certificate revocation list under Optional signer CRL (DER), then inspect again.
Interpreting CRL evidence
A CRL result is given only after the signature's integrity and its path to a selected anchor have been established. The CRL must come from an issuer on that path, be allowed to sign CRLs where the certificate says so, have a valid signature and be current on the date you check it.
| Result | Meaning |
|---|---|
| Listed as revoked | The signer's certificate appears in the supplied, verified and current CRL. Do not rely on that certificate. |
| Not listed | The signer's certificate does not appear in this supplied CRL. This is limited evidence, not a general verdict that the signature is valid. |
| Not established | The CRL is damaged, unsupported, out of date, dated in the future, wrongly signed or cannot be linked to the selected path. Do not treat this as a successful revocation check. |
The tool supports complete, direct CRLs signed with SHA-256, SHA-384 or SHA-512 using RSA or ECDSA. It does not support indirect, scoped (partitioned) or delta CRLs, online retrieval, OCSP, revocation checks for the whole certificate chain, trusted timestamps or long-term validation. It does not show a certificate's status at the time of signing. Removing or changing the evidence clears the previous result.
A CRL can be up to 1 MiB, a trust anchor file up to 256 KiB and an inspected PDF up to 100 MiB. Select public certificates and CRLs only, never private signing keys. The anchors you select are not kept after the check.