Signature is invalid - Invalid Policy Constraint - Certificate from IdenTrust IGC CA 2

According to your screenshot the root certificate of the certificate chain has a common name starting with "Federal Common Policy C". Looking into the Trusted Certificates list of Acrobat here that may be "Federal Common Policy CA" or "Federal Common Policy CA G2".

Both those possible root anchors have policy restrictions, i.e. signatures by certificates issued by these roots are not valid unless those certificates have one of the associated certificate policies.

Thus, have you checked that your certificate has one of those certificate policies?

Hi @Melissa5D61, 

Sorry for the troubled experience, and thanks for reaching out.

You can try the following and let us know how it works:

1. Update Trusted Root Certificates in Acrobat

• Open Acrobat.

• Go to Edit > Preferences > Signatures.

• Under Verification, click More.

• Ensure “Use the Online Certificate Status Protocol (OCSP)” and “CRL” options are enabled for revocation checks.

• Click Update Now under “Trusted Certificates” to fetch the latest list from Adobe.

2. Manually Trust the Signer’s Certificate

If the signer’s certificate is not part of AATL/EUTL:

• In the Certificate Viewer, go to the Trust tab.

• Click Add to Trusted Certificates.

• Check “Use this certificate as a trusted root” and ensure relevant trust options (e.g., Digital Signatures) are selected.

• Click OK and close all dialogs.

Then re-validate the signature.

3. Check for Network or Proxy Restrictions

Ensure Acrobat can access:

• AATL and CRL URLs

• Your firewall or proxy isn’t blocking certificate validation endpoints.

4. Confirm Certificate Usage Policies

You may want to contact the certificate issuer or IT/security team to confirm the policy identifiers embedded in the certificate chain. If they’ve recently changed issuing chains or policies, Acrobat may flag this mismatch as an invalid constraint.

This could be happening because Acrobat is unable to fully trust the signature because:

• The certificate policy in the signer’s certificate doesn’t match what the issuing or trusted root certificate authority (CA) expects.

• Trust settings or revocation checks couldn’t be completed (often due to missing CA certificates or network access restrictions).

• The certificate is not part of Adobe’s Approved Trust List (AATL) or European Union Trusted List (EUTL), which Acrobat uses to validate signatures automatically.