Short answer: VeriPatra could not find out whether the authority that issued the signing certificate has since cancelled it. Cancelling a certificate early is called revoking it. Everything else about the signature may be fine. One question is simply unanswered, so VeriPatra leaves that check out instead of marking it as passed.
You will notice it as a missing line. "The authority has not cancelled this certificate" does not appear among the checks.
What it means
Every certificate has an expiry date written into it. But an authority can also cancel a certificate before that date. The usual reasons are that the private key was stolen or exposed, the holder's name changed, or the holder left the organisation the certificate was issued for.
Authorities publish cancellations in two standard ways:
- a CRL (certificate revocation list): a dated list of cancelled certificates, signed by the authority;
- OCSP: an online service that answers good, revoked or unknown for one certificate at a time.
A checker can learn the status in one of two ways. Either the signer packed the answer into the PDF when signing, or the checker asks the authority's CRL or OCSP service directly. When the PDF carries no answer, and the service cannot be reached, does not reply, or replies unknown, the status stays open.
Why it matters
If a signing key was stolen, someone else could sign in the owner's name until the authority cancelled the certificate. The revocation check is what catches that. For a casual document the open question may not matter much. For a contract, a payment instruction or an official order, it deserves a second look.
A secure timestamp helps. It records, independently of the signer, when the document was signed, so the signing time can be compared with any later cancellation. VeriPatra shows it as "A secure timestamp records when it was signed".
What to do
1. Look at the rest of the result
If the signature is intact, the signer chains to a recognised authority and only the revocation answer is missing, the risk is lower than when several checks fail. Read the whole technical report before deciding.
2. Check again later
Authority services are sometimes slow or briefly unreachable. Running the check again later, on a working connection, can fill the gap.
3. For important documents, ask the sender
Ask the sender to confirm that the signing certificate is still in force. You can also ask for a copy signed with long-term validation information included, often called LTV.
4. Keep your record
VeriPatra saves each check as a local record on your device. If the status matters later, you can show what you checked and when.
Common questions
Is this the same as an expired certificate?
No. Expiry is a date inside the certificate, and VeriPatra checks it separately: "The certificate was valid at the time of signing". Revocation is an early cancellation that only the issuing authority can report.
What is LTV?
Long-term validation. The signer includes the certificates and revocation answers needed to check the signature inside the PDF itself, so it can still be checked years later. The European PAdES standard (ETSI EN 319 142-1) describes this as including "all the material required for validating the signature".
Does a self-signed certificate have a revocation answer?
No. A self-signed certificate has no independent authority behind it, so there is nobody independent to ask. That is a separate warning, explained in Valid signature, unknown signer.
Related reading: Changed after signing and the three verdicts.
Drop a PDF in and see the eight checks for yourself. No account; the PDF is not retained.