Expired or revoked signature: what it means

A signed document may open with a warning that its certificate has expired, been revoked or been suspended. These are different situations, and none of them by itself prevents you from reading the content. Understanding the result means distinguishing the document, its signature, the certificate and the evidence about time. This guide explains the reader’s messages in practical terms. It does not replace a professional assessment of a document’s effect in a particular process.

Separate the certificate from the signature

A certificate links a public key to a subject and specifies a validity period. The signature uses the corresponding key to bind the signer to the signed data. An integrity check establishes whether the data matches the signature. Certificate verification also needs information about the trust chain and the conditions under which that certificate can be treated as trustworthy for the check being performed.

CAdES is a digital signature standard based on CMS and is often associated with the P7M extension. A CAdES envelope may include certificates and additional evidence. Simply embedding a certificate does not make it trusted. A reader must distinguish information supplied by the file from the trust anchors actually available. Multiple signers and nested signatures also need separate results, rather than applying one signer’s outcome to everyone.

Understand certificate expiry

Expiry is the end of the validity period recorded in the certificate. A certificate that has expired today does not, on its own, establish whether a signature was valid or invalid years earlier. Describing an earlier time requires suitable time evidence and verification information. Comparing two visible dates is not enough to complete that assessment or establish all the relevant conditions.

The signing date shown in a reader may be a claim made by the signer. A trustworthy timestamp requires further checks on its binding to the signature, the authority that issued it and its trust chain. If those checks cannot be completed, the date remains a claim. An expiry warning therefore comes with the limits of the check, rather than an automatic promise that the signature was valid historically.

Understand revocation and suspension

Revocation means that the issuing authority cancelled the certificate before its scheduled expiry. A compromised key or replacement certificate can be among the reasons. Suspension is a separate condition that may be temporary. If authenticated evidence contains a recognised reason, the reader displays it. It does not invent an explanation when no usable reason is available from the issuer’s response.

OCSP is a protocol for requesting certificate status. A CRL is a certificate revocation list published by an issuer. The check uses certificate identifiers and the authority’s services, never the document. An answer is accepted only after its authenticity, certificate binding and freshness are checked. A response that can be parsed but fails authentication is not evidence that the certificate has not been revoked.

Compare revocation with signing time

When a verified timestamp is available, the reader can compare it with the available revocation date. Revocation before signing and revocation after signing need different messages. However, establishing that a trusted date precedes revocation does not automatically prove every other condition. Content integrity, the trust chain and the historical evidence remain distinct parts of verification and must be considered separately.

Without a trustworthy timestamp, the reader explicitly labels the signing date as claimed by the signer. The comparison is not presented as positive proof of validity in the past. Some envelopes include useful historical evidence for expired certificates, but it must be authenticated and apply to the right period. Absence from a current CRL is not sufficient: a list may no longer retain every expired certificate.

Interpret an unavailable check

An issuer’s service may not respond, the connection may be offline, or the evidence may be stale or unsupported. The reader then reports that the check is unavailable. That means neither revoked nor not revoked. Trying again with a working connection may help, but cannot guarantee that an authority still provides all the information needed to establish a historical status.

The document remains readable, and exports already authorised by your license remain possible. Keep the original envelope and the result details if you need further investigation. Where a professional decision has consequences, compare the evidence with the relevant procedures and an appropriate verification tool or adviser. A transparent reader should explain what it cannot establish as clearly as the checks that it successfully completes.

Technical references

The OCSP standard, the certificate and CRL profile and the timestamp protocol describe the mechanisms involved. AgID also provides information about timestamping. These references explain the terminology and technical rules. They do not turn one reader result into a conclusion about a specific legal or business case.