Participating Frequently

Question

Adobe Acrobat when doing a signature which invalidates previous signature

Forum|Forum|3 years ago
March 24, 2022
3 replies
6957 views

Hi, I have a problem when I digitally sign a document that has signed once in Acrobat Acrobat states that previous signature "the document has changed after signing" but no changes have been made and the current signature is valid Why does Reader say so and state that the previous signature is invalid?

Security digital signatures and esignatures

This topic has been closed for replies.

W

Whispering_Zest3528

Participant

The issue arises because Adobe Acrobat detects changes in the document after it was initially signed. Even minor alterations, like metadata updates or invisible changes, can cause this. To resolve it:

Check for Invisible Changes: Review recent edits or metadata modifications.
Update Software: Ensure both Acrobat and Reader are up-to-date.
Inspect Signature Fields: Verify if signature fields or properties were altered.
Re-sign if Necessary: Re-sign the document to correct any discrepancies.

MikelKlink

Participating Frequently

The issue arises because Adobe Acrobat detects changes in the document after it was initially signed. Even minor alterations, like metadata updates or invisible changes, can cause this.

While the steps you enumerate generally are a good approach, the issue with the example PDFs at hand differs, see the answers above.

Amal.

Community Manager

Hi there

++ Adding to the discussion

Once the PDF is signed and the signature process is complete, the PDF gets locked for further editing. Even adding new signatures is not allowed. If somehow you sign the already signed PDF it will eventually invalidate the previous signature.

Hope this information will help.

Regards

Amal

2

237286667dqyAuthor

Participating Frequently

Yeah.once the PDF is signed，the PDF gets locked for further editing.

below figure shows the previous signature pdf document properties:

The program sign the other PDF document sequentiallly cannot invalidate the previous signature but expect for this document.

MikelKlink

Participating Frequently

Can you share an example twice-signed PDF for analysis?

And can you clarify how you sign? Your question can be interpreted to only imply that you use Adobe Acrobat to validate the signature, the signature may have been created using a different software.

2

237286667dqyAuthor

Participating Frequently

As shown above,The part above the line marked with Rev1 is revision 1 of the document.When signing the document with a second signature, the program don’t change any of the bytes of revision 1. We add additional content (provided that the first signature allows this content), and
we create a new signature. This new signature is based on a message digest that includes the entire byte array of revision 1. The result is revision 2. When signing the document with a third signature,the bytes of revision 2 are preserved.

Note:the signature contents format is PKCS7.

The previous signature pdf is in below attachment and you can sign this file secondly.

first.pdf

MikelKlink

Participating Frequently

The issue is essentially the same as in this thread (you'll also find some references to stack overflow answers for similar issues there). Merely in that case the error was added with the first signature and in your case it was added before the first signature.

The cause of this issue is an error in the cross reference table of the first revision of the document. PDF viewers in general ignore or repair a lot of minor errors, so no viewer warns about it. Adobe Acrobat also ignores it. Usually that is. Except when checking for a signature (except the final signature of the document) whether there are any disallowed later changes, in that case that error results in such a validation failure.

In detail:

At the end of each revision of a PDF there is a cross reference table or stream mapping object numbers to their respective position in the file. According to the PDF specification the cross reference of the initial revision must not be segmented. Furthermore, there must be a mapping for every object number from 0 to Size-1.

In case of your document, though, it is segmented:

xref
0 2
0000000000 65535 f
0000000017 00000 n
4 46
0000000124 00000 n
[...]
0000144732 00000 n
51 15
0000144824 00000 n
[...]
0000280018 00000 n
67 18
0000280272 00000 n
[...]
0000415611 00000 n
86 29
0000415637 00000 n
[...]
0000578855 00000 n
116 15
0000578882 00000 n
[...]
0000713877 00000 n
132 34
0000714132 00000 n
[...]
0000853009 00000 n
167 70
0000853235 00000 n
[...]
0001003374 00000 n

Also there are no mappings for object numbers 2, 3, 50, 66, 85, 115, 131, and 166.

Thus, you should ask the source of your documents to provide PDFs without such errors for signing.

If you also were responsible for the first signature, you could repair the original PDF. But as you are only responsible for the second one, the error is burnt into the PDF.

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.

Scanning file for viruses.

This file cannot be downloaded