Short answer: the document was digitally signed and has not changed since. What VeriPatra could not do is link the signing certificate to an authority it recognises. You know a key signed the file. You do not know, from the file alone, whose key it really is.
That is why the result is amber, Needs caution, and not green or red. In the app you will see "Has a signature, but the signer could not be fully trusted", and in the checklist "The signing certificate is not from a recognised certifying authority".
What it means
A digital signature answers two separate questions:
- Did the file change after it was signed? That is arithmetic. If this check passed, the answer is no.
- Who signed it? That depends on the certificate that travels with the signature, and on who issued that certificate.
Anyone can create a certificate on their own computer and type any name into it, including the name of a well-known company. A certificate that is signed by its own owner is called self-signed. It proves nothing about identity, because nobody independent checked it.
In India, checking identity before issuing a signing certificate is the job of licensed Certifying Authorities (CAs). They work under the Controller of Certifying Authorities (CCA). The CCA runs the Root Certifying Authority of India, which digitally signs the public keys of the licensed CAs. eSign, the online signing service that confirms who you are through e-KYC, is also provided by licensed CAs.
So "not fully trusted" usually means one of these:
- the certificate is self-signed;
- it was issued by an organisation's own internal authority, or by an authority VeriPatra does not recognise;
- the file does not carry the full chain, so the link to a recognised root could not be built.
None of these, on its own, means the document is false. Plenty of real organisations sign with internal certificates. It means the file does not prove who signed it, so you have to confirm that another way.
What to do
1. Read who the certificate claims to be
Open the full report and look at the signer's name, organisation and issuer. Does the signer match the person or office that sent you the document? A certificate that carries a bank's or a department's name but comes from an unknown issuer deserves more suspicion, not less.
2. Check that nothing else failed
If "The document has not been changed since it was signed" passed and only the authority line is amber, the file is intact. If other lines failed as well, treat the document as could not be verified. The three verdicts page explains the difference.
3. Confirm through a channel you choose
Call or email the organisation using contact details from its official website, not the details printed in the document. Ask them to confirm that they sent it.
4. Ask for a properly signed copy when it matters
For anything involving money, a job, property or a government matter, it is reasonable to ask for a copy signed with a certificate from a licensed CA, or signed through eSign.
Do not pay, share an OTP or sign anything further just because a document "has a signature". A signature from an unknown signer is a claim, not proof.
Common questions
Does amber mean someone tampered with the document?
No. If the integrity check passed, the signed content is exactly what was signed. Amber is about identity: the file cannot prove who the signer is.
Why does another PDF reader show a different result?
Each reader keeps its own list of authorities it trusts, so the same file can look trusted in one app and unknown in another. VeriPatra's list includes the Government of India CCA trust roots.
Can the sender fix this?
Yes. They can sign the document again with a certificate from a licensed CA, or use eSign. The new copy should then come back as Digitally signed and unaltered.
Related reading: Why a digital signature is not a picture of your name and Revocation not checked.
Drop a PDF in and see the eight checks for yourself. No account; the PDF is not retained.