Digital signature verification is the automated check that confirms an electronically signed document hasn’t been altered since signing and that the signer’s credentials were valid at the moment the signature was applied. It happens in under a second when you open the file in a compatible reader, and under the federal E-SIGN Act a signature that passes this check carries the same legal weight as ink for most commercial transactions.1Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity The useful thing to understand is what the software is actually checking, what the result means, and when a “valid” signature still won’t do the job you need it to do.
What the Software Is Actually Checking
A digital signature is built on a pair of mathematically linked cryptographic keys. The signer keeps the private key secret and uses it to sign. The matching public key travels with the document inside a digital certificate issued by a Certificate Authority. Anyone receiving the file can use the public key to verify the signature without ever seeing the private one.
When the signature is created, the signing software first runs the document through a hash function, producing a fixed-length string unique to that exact file. A single-character change anywhere in the document would produce a completely different hash. The software then encrypts that hash with the signer’s private key, and the encrypted result is embedded in the file as the signature.
Verification runs two parallel checks on that embedded data. First, the integrity check: the software generates a fresh hash of the document as it exists right now, decrypts the original hash using the public key from the signer’s certificate, and compares the two. If they match, nothing has been changed since signing. If they don’t, something was altered and the signature fails.2National Institute of Standards and Technology. FIPS 186-5 Digital Signature Standard
Second, the credential check. The software contacts the Certificate Authority that issued the signer’s certificate to confirm it hasn’t been revoked. This happens through OCSP, which queries the Certificate Authority’s server in real time, or through a Certificate Revocation List, a periodically updated roster the software downloads and checks locally. The software also examines the certificate’s expiration date and the embedded timestamp showing when the signature was applied.
Reading the Verification Result
Verification software reports one of three outcomes, and the difference matters before you rely on the document.
A valid result means the hash values match, the certificate was active at the time of signing, and the Certificate Authority confirms the credentials haven’t been revoked. Most readers display a green checkmark. This is the only result that confirms both document integrity and signer identity.
An invalid result means either the document was modified after signing or the certificate has a problem, such as revocation or expiration before the signing date. Treat this as a stop sign. Don’t execute the transaction or file the document.
An unknown result means the software can’t reach the Certificate Authority’s servers or doesn’t recognize the Certificate Authority in its trust store. This isn’t the same as fraud; it means the software can’t confirm what it needs to confirm. Updating trust settings, adding the Certificate Authority to your approved list, or checking your internet connection often resolves it.
One point that regularly catches people out: a printed or scanned copy of a digitally signed document cannot be verified. The cryptographic data lives inside the electronic file. Print it and scan it back in, and every piece of the embedded signature is gone. Verification requires the original electronic file.
Why Verifications Fail Years Later
Digital certificates typically expire after one to three years. Once a certificate lapses, software can no longer confirm whether that certificate was valid at the time of signing, and a signature that verified cleanly on day one can become unverifiable later. For contracts and records you need to keep for years or decades, this is a real problem.
Long-Term Validation addresses it by embedding all the verification data directly into the signed file at the time of signing or shortly after. The OCSP response or Certificate Revocation List showing the certificate was valid, plus a trusted timestamp establishing exactly when the signature was applied, get baked into the document itself. Once embedded, the signature can be verified without contacting any external server.
The timestamp is the piece that matters most. Without it, there’s no way to prove whether the certificate was valid at the moment of signing versus a later date when it had already expired. Industry standards recommend an RFC 3161 timestamp server and storing the validation data in a Document Security Store within the PDF. Because the Document Security Store itself isn’t cryptographically signed, applying another timestamped signature immediately after adding the validation data creates a chain of verifiable events. If you’re signing records that need to hold up for a regulatory or contractual retention period, enabling Long-Term Validation is the step most people skip and later regret.
The Legal Weight of a Verified Signature
Two laws govern whether a digital signature is enforceable in the United States. The federal Electronic Signatures in Global and National Commerce Act prevents any contract or record from being denied legal effect solely because it’s in electronic form, provided the transaction is in or affects interstate or foreign commerce.1Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity E-SIGN defines an electronic signature broadly as any electronic sound, symbol, or process attached to or associated with a record, so long as the person intended to sign.3Office of the Law Revision Counsel. 15 USC 7006 – Definitions That reach covers everything from a typed name up to a full cryptographic digital signature.
The Uniform Electronic Transactions Act complements E-SIGN at the state level and has been adopted in 49 states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands. Under UETA, a record or signature cannot be denied enforceability solely because it’s electronic, and where any law requires a signature, an electronic signature satisfies that requirement. Both statutes are technology-neutral and don’t mandate any particular software, algorithm, or certificate standard.
For a digital signature to hold up under either law, three elements must be present. The signer must demonstrate intent to sign, usually shown by an affirmative action like clicking a “Sign” button or drawing a signature on a touchscreen. The signature must be logically associated with the specific document being signed. And the signed record must be capable of being retained and accurately reproduced by all parties entitled to it.1Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity
When a Digital Signature Won’t Do the Job
E-SIGN carves out specific categories where paper and ink are still required, and a digital signature alone won’t satisfy the legal requirement. Knowing where the law stops is as important as knowing it exists.
The first group covers foundational personal documents: wills, codicils, testamentary trusts, and state-law matters involving adoption or divorce.4Office of the Law Revision Counsel. 15 USC 7003 – Specific Exceptions Most transactions governed by the Uniform Commercial Code are also excluded, though sales of goods (Article 2) and equipment leases (Article 2A) remain eligible.
The second group covers consumer notices where Congress decided the stakes of a missed notification were too high:
- Cancellation or termination of water, heat, or power service.
- Notices of default, foreclosure, eviction, repossession, or the right to cure under a loan secured by your primary residence or a rental agreement for it.
- Termination of health insurance or life insurance benefits (annuities are not excluded).
- Product recalls or material product failures that risk endangering health or safety.
- Documents required to accompany the transport or handling of hazardous materials, pesticides, or other dangerous substances.
Court orders, official court documents, and legal filings required in connection with court proceedings also fall outside E-SIGN’s reach.4Office of the Law Revision Counsel. 15 USC 7003 – Specific Exceptions
Proving the Signature Is Genuine if Someone Disputes It
If a digital signature is challenged in litigation, the party relying on it has the initial burden of showing it’s authentic. Federal Rule of Evidence 901(a) requires enough evidence to support a finding that the item is what the proponent claims.5Legal Information Institute. Federal Rules of Evidence Rule 901 – Authenticating or Identifying Evidence The threshold isn’t especially high. The judge acts as gatekeeper, deciding whether a reasonable jury could find the signature authentic; the judge doesn’t need to be personally convinced.
The strongest evidence is a detailed audit trail from the signing platform. Courts have consistently found electronic signatures enforceable when the platform logs the signer’s unique credentials (user ID, password, or multi-factor authentication), a timestamp for each action, the IP address or device used, and a record showing the signer viewed the document before signing. Where that system-level evidence exists and the opposing party offers only a bare denial, courts have held that speculation about what might have gone wrong isn’t enough to overcome the documented trail.
Two practical implications. If you’re relying on a digital signature, pick a signing platform that generates a tamper-evident audit trail and keep it with the signed file. If you’re challenging one, you’ll generally need concrete evidence that something actually went wrong with the signing, not just a claim that you didn’t do it.
Matching Signature Strength to the Stakes
Not every identity check behind a digital signature is equivalent. NIST’s Digital Identity Guidelines define three Identity Assurance Levels describing how rigorously a signer’s real-world identity was verified before they were issued credentials.6National Institute of Standards and Technology. NIST Special Publication 800-63-3 Digital Identity Guidelines At the lowest level, there’s no requirement to tie the applicant to a real person; self-asserted attributes are accepted. The middle level requires evidence that the claimed identity exists and that the applicant is connected to it, through either remote or in-person proofing. The highest level demands physical presence and examination of identity documents by a trained representative.
High-stakes transactions like real estate closings or large financial agreements typically call for at least the middle level. Routine commercial contracts may accept the lowest. The verification result in your PDF reader tells you the cryptography checks out; the Identity Assurance Level tells you how much the certificate’s claim about who signed is actually worth.
Retention After Signing
E-SIGN doesn’t set its own retention timeline. It requires that electronic records be kept for whatever period other applicable laws demand, that they remain capable of being accurately reproduced for later reference, and that they stay accessible to anyone legally entitled to see them.7Federal Deposit Insurance Corporation. X-3 The Electronic Signatures in Global and National Commerce Act A signed loan agreement might need to be retained for the life of the loan plus several years; an employment contract may be governed by labor regulations with their own schedule. Whatever the period, the electronic version has to remain readable and reproducible throughout, which is where Long-Term Validation stops being optional and starts being the thing that keeps a years-old signature verifiable at all.